The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To work with AI agents, a WordPress site needs clearly defined capabilities that an agent can discover and use under appropriate permissions. WordPress’s Abilities API provides a registry for those capabilities; the WordPress MCP Adapter can expose selected abilities to compatible agents as tools or resources. Neither automatically turns every site feature into an agent capability: someone still has to choose what to expose, implement access controls, configure authentication, and test the connection.
What “agent-ready” means for a WordPress site
An agent-ready site does not simply publish more content or install an AI plugin. It presents specific, bounded operations in a form software can understand and invoke. An operation might retrieve a report or prepare a draft; it should have a clear description, defined inputs and outputs, and rules governing who may run it.
As an Amazon Associate I earn from qualifying purchases.
The Abilities API is the site-side registry for these operations. The MCP Adapter is an interoperability layer that can map selected registered abilities to the Model Context Protocol (MCP), which compatible clients use to discover and call tools. WordPress’s developer article describes the adapter’s discovery, ability-information, and execution tools, as well as the option to present read-only data as resources. WordPress Developer Blog, February 4, 2026
This connection does not guarantee that every agent supports the same workflow, or that adding MCP will increase traffic, indexing, or sales. It makes deliberately exposed site functions available to compatible clients; the site owner remains responsible for deciding which functions belong on that surface.
How the Abilities API and MCP Adapter fit together
Abilities define what the site can do
The Abilities API registers a distinct capability with a namespace and name, a human-readable description, input and output schemas, an execution callback, and a permission callback. The handbook says the API is available in WordPress 6.9 and later and documents JSON Schema validation and permission handling. Abilities API – Common APIs Handbook
Core’s initial set of abilities is limited. A useful site-specific action may instead come from a compatible plugin or custom development. An ability should do one bounded job: define what inputs it accepts, what output it returns, and which user capability is required. Validate inputs and reject requests that do not meet the schema or authorization rules.
MCP makes selected abilities available to compatible clients
The MCP Adapter translates registered abilities into MCP primitives. A client can discover available abilities, inspect information about one, and invoke supported operations. Read-only data may be exposed as a resource when that is a better fit than an action. The adapter does not determine whether an operation is appropriate for a particular site or user; that depends on the site’s configuration and the ability’s implementation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor local development, WordPress’s adapter article describes using STDIO through WP-CLI. Remote agents need a way to reach the site, such as an HTTP route or supported proxy. A local WordPress site is not internet-accessible by default; Learn WordPress discusses the adapter and local-site connection considerations in its MCP Adapter learning resource.
Rank #3
Choose a connection path
The right setup depends first on whether the site is hosted at WordPress.com or self-hosted, and then on whether an agent must connect remotely. These options differ in hosting, authentication, exposure control, and who maintains the connection.
| Path | How it works | Plan or access details | What to plan for |
|---|---|---|---|
| WordPress.com hosted MCP service | Connect to the documented endpoint, https://public-api.wordpress.com/wpcom/v2/mcp/v1, using browser-based OAuth 2.1 authorization. |
WordPress.com documentation says access is available on paid plans and, for a free site, during the first 30 days after creation. | Confirm current plan eligibility and decide which tools the connected identity should be able to use. See the WordPress.com MCP Server documentation. |
| Self-hosted WordPress connected to Jetpack | The documentation says Jetpack-connected sites use the WordPress.com MCP server and its tool catalog; it does not describe a separate Jetpack MCP server. | Jetpack AI or Jetpack Complete plan requirements apply according to the documentation. | Check current plan rules and account requirements, then review which site functions are available through the hosted server. See the WordPress.com MCP Server documentation. |
| Self-hosted WordPress with the official adapter | Install and configure the MCP Adapter, then select which registered abilities it exposes. The documentation describes WP-CLI/STDIO for local development. | The cited adapter material does not establish a WordPress.com plan requirement for this self-hosted route. | A remote client needs a reachable HTTP route or supported proxy. The site operator manages exposure, authentication, permissions, and monitoring. See the adapter article and Learn WordPress tutorial. |
These descriptions reflect the cited WordPress.com documentation, last updated September 21, 2026, and the linked adapter materials. Confirm current eligibility and compatibility before deploying, since plan and software requirements can change.
A practical implementation sequence
- Choose one narrow workflow. Start with a clear human benefit, such as retrieving a report or preparing a draft. Avoid beginning with broad access to the site.
- Check for an existing ability. See whether WordPress core or a plugin already provides the required operation. If not, register a bounded custom ability.
- Specify and validate its contract. Give it a meaningful description, explicit input and output schemas, input validation, and a permission callback aligned with the minimum capability needed.
- Expose only what the workflow needs. Configure the MCP server to offer the selected ability. Keep high-impact operations outside the agent surface until they have appropriate safeguards.
- Connect a low-privilege identity and test. Use a dedicated account with only the required capabilities. Test both allowed and rejected requests, then review logs and monitor usage before relying on the integration in production.
This sequence applies WordPress’s implementation and security guidance; it is not a claim that a particular site or agent has been tested.
Set permissions before connecting an agent
Authentication answers who connected; authorization answers what that identity can do. An authenticated agent can still be risky if its account has broad privileges or an ability’s permission callback grants more access than the operation requires.
- Use a dedicated account. Give it only the capabilities needed for the selected workflow.
- Enforce permissions in each ability. Do not rely only on the fact that a client authenticated; the permission callback must check the required capability for that operation.
- Keep destructive actions private unless controls justify exposure. WordPress’s adapter guidance warns against exposing powerful abilities to unaudited clients.
- Prefer read-only abilities for public MCP endpoints. Use custom authentication where needed, and monitor and log use.
- Review returned content as untrusted input. A July 2026 WordPress Core proposal on expanded abilities says sensitive fields should be omitted unless the user has the required capability. It also states that prompt-injection protection is outside the abilities layer: stored data is returned as-is, so consuming agents must treat tool output as data, not instructions. The proposal describes proposed behavior, not a guarantee that every site or release implements it. WordPress Core merge proposal
What is available, and what remains on the roadmap
The Abilities API handbook identifies WordPress 6.9 and later as the supported availability baseline. A July 30, 2026 WordPress tutorial describes the Abilities API, the provider-agnostic AI Client, and the MCP Adapter as complementary components for building an AI-enabled plugin; check current core and plugin compatibility for a specific installation. Build your first AI-Powered WordPress plugin
WordPress AI 1.3.0’s August 18, 2026 announcement describes an opt-in control for exposing plugin abilities and an AI request logging API. Those features underline that exposure and observability involve configuration rather than happening automatically when MCP is enabled. What’s new in AI 1.3.0
WordPress Core’s September 18, 2026 roadmap lists WebMCP experimentation, agent identity and delegation, easier MCP access, and embeddings or semantic search as future work areas. These are roadmap directions, not features to assume are generally available across WordPress sites. Roadmap to 7.2
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhen is this worth implementing?
Consider an agent connection when you can name a narrow task, define what success looks like, and limit the account and operations to what that task needs. If the desired workflow is not represented by an existing ability, or your site cannot safely authenticate and monitor a remote client, the next step is implementation and governance work—not exposing a broad collection of site functions. MCP provides a way to connect compatible agents to selected capabilities; it does not replace the work of deciding what those capabilities should be.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
