--- title: "The WordPress Abilities API: What It Is and Why AI Tools Need It" url: https://nexterwp.com/blog/wordpress-abilities-api/ date: 2026-08-18 modified: 2026-08-18 author: "Aditya Sharma" description: "The WordPress Abilities API is the registry that tells AI tools what your site can do. What it is, how it works, what shipped in 6.9 and 7.1, and why it matters." image: https://nexterwp.com/wp-content/uploads/2026/07/9sAqTcdCJvrC1vX3V7-5fkGm0k0TPYHsZ0RipILCUae1cdp9fSJ5ZfM2EfAre3N1FCVktpjQ9v6xLQBzkL9yIw-1024x640.png word_count: 1799 --- # The WordPress Abilities API: What It Is and Why AI Tools Need It ## Key Takeaways - WordPress Abilities API arrives in WordPress 6.9, not 7.0, and the handbook says it is only available for WordPress 6.9 and above. - Abilities API acts as a central registry where WordPress core, plugins, and themes register discrete actions with clearly defined inputs, outputs, and permissions. - wp_register_ability() includes name, label, description, category, input_schema, output_schema, execute_callback, and permission_callback for each ability. - WordPress 7.0 adds the AI Client, while the Abilities API gives that client concrete, permission-checked actions to call. - Nexter Abilities exposes 115 server-side tools on top of Nexter Blocks, with 68 available on the free tier and 47 unlocked by Nexter Blocks Pro. Picture connecting an AI assistant to your WordPress site for the first time. You ask it to publish a draft. It can read your posts easily enough, because the REST API has exposed those for years. What it cannot reliably work out is whether publishing is something it is permitted to do on this particular site, what a valid publish request looks like here, or which of your plugins have quietly added actions of their own. So it guesses. That gap between what a site can actually do and what an outside tool can discover about it is the gap the WordPress Abilities API was built to close. This guide covers what the Abilities API is, why AI tools specifically need it, how it differs from MCP, and what has shipped so far. One correction up front, because it is widely misreported: the Abilities API arrived in WordPress 6.9, not 7.0.   Table of Contents ## What the WordPress Abilities API Actually Is The Abilities API is a registry. WordPress core, plugins and themes register the discrete things they are able to do, and anything else, including software outside your site, can then look up that list and call an entry from it. The Common APIs Handbook describes it as a standardized way to register and discover distinct units of functionality within a WordPress site. Those units are called Abilities, and each one represents a specific action a component can perform, with clearly defined inputs, outputs, and permissions. The handbook is direct about the role it plays: the API acts as a central registry, making it easier for different parts of WordPress, third-party plugins, themes, and external systems such as AI agents to understand and interact with the capabilities available on a specific site. The important word there is discover. Plenty of plugins could already do interesting things. Nothing let an outside tool ask what those things were. ### What One Ability Contains An ability is registered with `wp_register_ability()`, and it is more than a function reference. Each registration declares: - **name**, a unique identifier following the `namespace/ability-name` pattern- **label** and **description**, written for humans and for models reading the registry- **category**, an organizational grouping- **input_schema** and **output_schema**, both expressed in JSON Schema- **execute_callback**, the PHP that actually runs- **permission_callback**, which decides whether the current user is allowed to run it `wp_register_ability( 'my-plugin/publish-draft', array( 'label' => 'Publish a draft', 'description' => 'Publishes an existing draft post by ID.', 'category' => 'content', 'input_schema' => array( /* JSON Schema */ ), 'output_schema' => array( /* JSON Schema */ ), 'execute_callback' => 'my_plugin_publish_draft', 'permission_callback' => 'my_plugin_can_publish', ) );` That shape is the whole point. The schemas mean a caller knows what to send and what it will get back without trial and error. The permission callback means the answer to whether an action is allowed lives with the action itself, not with whichever tool happens to be asking. ![WordPress Roles and Capabilities documentation page listing the six default user roles](https://nexterwp.com/wp-content/uploads/2026/08/coChTEBsutRpuqrRaFHTrjD1XFmTOOBK4Mfzs67L8F0pGHFUrmk2Fl0-LHvWtI_XZBs5asbBGCBcAvaqDn6X5A-scaled.png)Every ability carries a permission_callback, so it answers to the same roles and capabilities system that already governs your human users. ***Also Read:** [WordPress User Roles and Permissions Explained](https://nexterwp.com/blog/wordpress-user-roles/) covers the roles and capabilities that a permission callback ultimately checks against.* ## Why AI Tools Need It The REST API already tells a tool which endpoints exist. That turns out to be a different question from what a site can do. An endpoint list is a map of routes. It does not say that this site can generate an invoice, or that a given action requires an administrator, or that a plugin added a bulk image optimizer last Tuesday. So every AI tool that wanted to work with WordPress had to build its own mapping of site to capability, maintain it, and guess at the edges. Multiply that by every plugin and every tool and the work never finishes. Three properties make the registry useful to a model rather than merely tidy: - **Discovery.** A tool can ask a site what it can do and get a structured answer, instead of needing to be told in advance.- **Typed contracts.** Input and output schemas in JSON Schema give a model a validated shape to fill in, which is what reduces malformed calls.- **Permission at the boundary.** A permission callback runs regardless of which client is asking, so an agent cannot talk its way past a capability check. The WordPress Developer Blog was explicit about the audience when it summarized the 7.1 work: if you are building AI integrations, automation tooling, or protocol adapters, this is the release where the API stops being a foundation and starts being a toolkit. ![Introducing the AI Client in WordPress 7.0 on Make WordPress Core](https://nexterwp.com/wp-content/uploads/2026/07/ZgJhaM-K0CWtdMZlAx3MpUH3x_arT1tp4Py4LfzjQZ_P5A091o7TflwI_GTaemwAKpAMNnGpOFx0KWrJzXYNkQ-scaled.png)WordPress 7.0 added the AI Client. The Abilities API is what gives a client like this something concrete and permission-checked to call. ## Abilities and MCP Do Two Different Jobs These get conflated constantly, and the distinction is genuinely simple. The Abilities API answers what this site can do. It is a server-side registry that lives inside WordPress. The Model Context Protocol answers how an external agent connects and calls something. It is a transport and conversation standard, and it is not WordPress-specific at all. They are complements, not competitors. Abilities without a protocol is a catalogue nobody can reach from outside. A protocol without a registry is a connection with nothing dependable on the other end. The WordPress MCP Adapter is the piece that joins them, taking registered abilities and exposing them to MCP clients. ![WordPress MCP Adapter announcement on the WordPress Developer Blog](https://nexterwp.com/wp-content/uploads/2026/06/on3-Fx41zj0QNwhnckeF2k37TewnQ0Msm8yoS3bhtImipQcztCG9dEV0UTwmwFYFRuQn1kbhqK7HvHze19PgOA-scaled.png)The MCP Adapter is the bridge: abilities are registered on the server, and the adapter is what exposes them to an MCP client. ***Also Read:** [What Is MCP in AI?](https://nexterwp.com/blog/what-is-mcp-in-ai/) is the plain-English explanation of the protocol side, if that half is still fuzzy.* One practical consequence: if you want an AI assistant to do something on your site, both halves have to exist. An ability has to be registered for the thing you want done, and a protocol layer has to be in place for your assistant to reach it. ## What Shipped When: 6.9, 7.0 and 7.1 This timeline is worth getting right, because the Abilities API is routinely credited to WordPress 7.0. ### WordPress 6.9: The Foundation The Abilities API was introduced in WordPress 6.9 as a foundational system that lets plugins, themes and core register and expose their capabilities in a standardized, machine-readable format. The handbook still carries the compatibility notice in plain language: the Abilities API is only available for WordPress 6.9 and above. That release delivered the plumbing rather than the payoff. It shipped a PHP API for registering and managing abilities, REST API endpoints under the `wp-abilities/v1` namespace, and hooks for integration, all framed as part of the wider AI Building Blocks for WordPress initiative. Core itself registered only a small initial set, covering site, environment and current-user information. ![WordPress 7.0 Field Guide on Make WordPress Core](https://nexterwp.com/wp-content/uploads/2026/07/shK-lWg-mA7DqAJSVpKduTotozyO5WaZNbCaWxNpt-hgRCLFAPfSGEZxyRj16Z_wIk_ZF3WD_aK_nySE-kx8oQ-scaled.png)The WordPress 7.0 Field Guide. The Abilities API landed one release earlier, in 6.9, which is the detail most write-ups get wrong. ### WordPress 7.0: The Consumer Arrives WordPress 7.0, released on 20 May 2026 as Armstrong, added the AI Client, a provider-agnostic way for plugins to send prompts to models. A client is only as useful as the actions it can take, which is where the 6.9 registry starts to matter. ### WordPress 7.1: Foundation Becomes Toolkit WordPress 7.1 is the release where the Abilities API becomes properly buildable. It reached Release Candidate 1 on 5 August 2026, with the final release due 19 August 2026. The current stable release is 7.0.4, from 12 August 2026. The Abilities API work documented for 7.1 includes: - New execution lifecycle filters, announced 29 July 2026- JSON Schema preparation for client compatibility, announced 31 July 2026- A unified public exposure flag for abilities, announced 4 August 2026- Filtering registered abilities with `wp_get_abilities()`, announced 5 August 2026 Alongside that, a merge proposal targeting 7.1 adds the first genuinely practical core abilities: `core/read-settings`, `core/read-content` and `core/read-users`. The stated reasoning is to ship a canonical baseline of read abilities for the core entities so the ecosystem builds on them instead of re-implementing them. All three are read-only, which is a deliberate and sensible place to start. ![Roadmap to WordPress 7.1 on Make WordPress Core](https://nexterwp.com/wp-content/uploads/2026/07/9sAqTcdCJvrC1vX3V7-5fkGm0k0TPYHsZ0RipILCUae1cdp9fSJ5ZfM2EfAre3N1FCVktpjQ9v6xLQBzkL9yIw-scaled.png)The 7.1 roadmap. This is the release that turns the Abilities API from infrastructure into something you can realistically build against. ***Also Read:** [WordPress 7.1: What Is New and What Got Deferred](https://nexterwp.com/blog/wordpress-7-1/) covers the rest of the release, including the Tabs block and what slipped again.* ## What This Means If You Do Not Write Code Honestly, there is nothing for you to configure. There is no settings screen and no switch to flip. The Abilities API is infrastructure, and you will meet it through the plugins and AI tools you already use. What it changes is the quality of what becomes possible, and how safe it is: - AI tools stop guessing at your site and start reading a declared list, which means fewer broken edits from a wrong assumption.- Actions stay inside your existing permission model, because a permission callback checks capabilities the same way the admin does.- Plugins gain a shared way to advertise features to AI tools, rather than each shipping a bespoke integration. The reasonable move now is awareness rather than action. When you next evaluate a plugin that advertises AI features, it is fair to ask whether it registers abilities or wraps its own private endpoint. One of those choices will still work with whatever you connect next year. ***Also Read:** [Where WordPress 7.0 AI Actually Helps (and Where It Wrecks Your Site)](https://nexterwp.com/blog/wordpress-7-ai/) is the honest read on letting AI near a production site.* ## Nexter Abilities: The Standard, Applied A registry only becomes interesting when something real is registered in it, which is where our own work sits. Nexter Abilities is the MCP layer on top of Nexter Blocks. The product page puts it plainly: Nexter Abilities turns Claude and any MCP-compatible AI assistant into a hands-on Gutenberg builder, with 115 server-side tools that compose real Nexter Blocks from a single prompt, screenshot, or URL. Of those 115 tools, 68 work on the free tier, and activating Nexter Blocks Pro unlocks the remaining 47. It has been tested with Claude Desktop, Cursor, VS Code, Windsurf, Cline, Zed and Continue. Two honest qualifications. It is a layer over [Nexter Blocks](https://nexterwp.com/nexter-blocks/), so it builds with those blocks rather than acting as a general-purpose site agent. And page-composition abilities are a different category from the read abilities core is standardizing, so the two are complementary rather than interchangeable. The wider point stands without the product. Abilities are how a WordPress site stops being a black box to the software you connect to it, and that shift is already underway in core. ## Suggested Reading - [Where WordPress 7.0 AI Actually Helps (and Where It Wrecks Your Site)](https://nexterwp.com/blog/wordpress-7-ai/)- [What Is MCP in AI? A Plain-English Guide for WordPress Site Owners](https://nexterwp.com/blog/what-is-mcp-in-ai/)- [What Is the Model Context Protocol? A WordPress Guide](https://nexterwp.com/blog/model-context-protocol-wordpress/)- [Is There Still a Future for WordPress Plugin Developers in the AI Era?](https://nexterwp.com/blog/future-of-wordpress-plugin-developers/)- [How to Prep Your WordPress Site for AI Browsers](https://nexterwp.com/blog/prepare-wordpress-for-ai-browsers/) #### Stay updated with Helpful WordPress Tips, Insider Insights, and Exclusive Updates – Subscribe now to keep up with Everything Happening on WordPress! Subscribe