WordPress 6.9 shipped something that will matter more than its announcement suggested. The Abilities API gives plugins and themes a standard way to describe what they can do, in a form that other software — including AI assistants — can discover and call. It is the foundation the WordPress project is building its AI story on, and unlike most AI features it is not a chatbot bolted onto the admin.
The problem it solves
Until now, if you wanted an external tool to change something in WordPress, you had three options and all of them were bad.
You could use the REST API, which covers posts, pages, users and taxonomies well and plugin settings barely at all. Most plugins store their configuration in options the REST API has never heard of.
You could write directly to the database, which works right up until the plugin changes its storage format and your integration silently corrupts something.
Or every plugin could invent its own endpoint, its own authentication and its own conventions — which is what happened, and why integrating with several plugins meant learning several unrelated systems.
The Abilities API replaces all three with a register-and-discover model. A plugin declares an ability once, and anything that speaks the standard can find it and call it correctly.
What an ability actually is
An ability is a named capability with a schema. It has an identifier like astra/update-post-meta, a human-readable label and description, a declaration of whether it reads or writes, a schema describing exactly what input it accepts, and a permission callback deciding who is allowed to run it.
That last part is the important one. An ability is not a hole in your site. It carries its own permission check, and WordPress enforces it the same way it enforces everything else. If the ability requires edit_post and the current user cannot edit that post, it refuses — regardless of what asked.
A real example
The Astra theme registers its per-page settings as abilities. Disable Title, container layout, sidebar layout, header and footer display, breadcrumbs — each is a validated key with a defined set of acceptable values.
Before that existed, changing the title setting on a page from outside WordPress meant knowing that Astra stores it in post meta under site-post-title with the value disabled. That is undocumented, easy to get wrong, and liable to change. Write the wrong value and nothing errors; the setting simply does not apply.
With an ability, Astra publishes the key list, validates the value, checks the permission and reports what it did. The integration no longer has to know Astra’s internals, and when Astra changes them, the ability keeps working.
Where MCP comes in
Abilities describe what WordPress can do. MCP — the Model Context Protocol — is how an AI assistant discovers and calls tools. The WordPress MCP Adapter connects the two: it takes registered abilities and exposes them to an MCP client.
The result is that a plugin author does not write any AI integration at all. They register an ability because it is a good way to expose functionality, and their plugin becomes usable by an assistant for free.
That is a considerably better arrangement than every plugin shipping its own AI feature, which is the direction things were heading.
What this means if you run a site
Very little today, and potentially quite a lot within a year.
Right now adoption is thin. Astra is early. Most plugins register nothing, and several gate registration behind their own setting that is off by default — so even an adopting plugin may be publishing nothing until you enable it.
The direction of travel is clear though. If you are choosing between plugins and one of them registers abilities, that is a genuine advantage: it means the plugin can be automated, scripted and connected to an assistant without anyone reverse-engineering its database tables.
What it is not
The Abilities API is not a permission system that makes AI safe. It is a description format with permission callbacks attached. Whether something is safe still depends on what abilities exist and who can run them.
It also does not make an assistant competent. An ability tells a tool what is possible and what input is valid. It does not decide whether changing that setting is a good idea.
And it is not a replacement for the REST API. Content operations are still better served by REST. Abilities cover the long tail REST never reached: settings, configuration, and plugin-specific operations.
Trying it
You need WordPress 6.9 or later, and at least one plugin or theme that registers abilities. Astra is the easiest place to start, with Enable Abilities and Enable Edit Abilities in its settings.
To call them from an assistant you need something that bridges abilities to MCP. The official MCP Adapter does this, and Marketur MCP includes a bridge that calls registered abilities in-process, alongside its own tools for content, SEO, menus and settings.
If you are new to this, connecting ChatGPT or Claude to WordPress covers the practical setup and, more usefully, what you should not expose.