WordPress 6.9 recently introduced the Abilities API, and while the core team made it look like just another “clean code” standard, there was always a bigger catch. The recently released WordPress MCP Adapter is that catch. It is the plumbing that finally connects your WordPress site logic directly to AI agents like Claude, Cursor, and VS Code.
If you have been following my previous breakdown on the WordPress Abilities API, you know I’m a fan of standardized schemas. However, having a “typed” function is useless if nothing can discover it. The WordPress MCP Adapter solves the discovery problem by implementing the Model Context Protocol (MCP). It essentially tells an AI: “Here is what this site can do, here is how to call it, and here are the permissions required.”
The Architecture: Logic Over Hype
We need to stop thinking about AI as a chatbot and start thinking about it as an executor. When you register an “Ability” in WordPress, you are defining a unit of work. The MCP Adapter takes those registered abilities and wraps them in a protocol that external LLMs understand. Specifically, it maps them to MCP Tools.
In practice, this means if you’ve already refactored your plugin logic to use the Abilities API, you are exactly one array key away from making it AI-ready. This is the end of “spaghetti integrations” where every AI tool needs a custom-coded bridge to your database.
Exposing Your First Ability to MCP
To make an ability discoverable by the default MCP server, you just need to flag it. If you’re registering a new one, you add the meta argument. If you’re working with Core abilities (like getting site info), you use the wp_register_ability_args filter.
<?php
/**
* Hook into the Abilities registration to flip the MCP switch.
*/
add_filter( 'wp_register_ability_args', 'bbioon_enable_mcp_for_core', 10, 2 );
function bbioon_enable_mcp_for_core( array $args, string $ability_name ) {
$target_abilities = array(
'core/get-site-info',
'core/get-user-info',
);
if ( in_array( $ability_name, $target_abilities, true ) ) {
// This is the magic flag the WordPress MCP Adapter looks for
$args['meta']['mcp']['public'] = true;
}
return $args;
}Connecting Your Dev Tools
The WordPress MCP Adapter supports two transport methods: STDIO and HTTP. If you are working locally (which you should be for testing this), STDIO via WP-CLI is the most stable route. For tools like Cursor or Claude Desktop, you’ll need to point their config files to your local wp binary.
Here is a common “gotcha”: AI clients usually read their config on startup. If you update your mcp.json or claude_desktop_config.json and nothing happens, restart the app. Furthermore, ensure your --path argument in the config is an absolute path to the WordPress root, or the adapter will fail to find the environment.
Building a Custom MCP Server
Sometimes you don’t want to dump everything into the default server. You might be building a specialized plugin for a client and want a dedicated namespace. You can initialize a custom server during the mcp_adapter_init action.
<?php
add_action( 'mcp_adapter_init', 'bbioon_register_dedicated_server' );
function bbioon_register_dedicated_server( $adapter ) {
$adapter->create_server(
'client-report-server',
'reports-api',
'mcp',
'Client Reporting Server',
'Exposes sales and inventory data to AI agents.',
'1.0.0',
array( \WP\MCP\Transport\HttpTransport::class ),
\WP\MCP\Infrastructure\ErrorHandling\ErrorLogMcpErrorHandler::class,
\WP\MCP\Infrastructure\Observability\NullMcpObservabilityHandler::class,
array( 'my-plugin/get-sales-report' ) // List of abilities
);
}Security: The Architect’s Critique
Let’s be real—giving an LLM executable access to your backend is terrifying if you’re sloppy. The WordPress MCP Adapter acts as a logged-in user. Consequently, your permission_callback in the ability registration is your only line of defense.
Specifically, I recommend creating a dedicated “AI Service User” with very narrow capabilities. Never, under any circumstances, use __return_true for an ability that deletes or updates content. If the AI hallucinates a command, you want the WordPress core capability system to shut it down immediately.
Look, if this WordPress MCP Adapter stuff is eating up your dev hours, let me handle it. I’ve been wrestling with WordPress since the 4.x days.
The Takeaway
The combination of the Abilities API and the MCP Adapter isn’t just a shiny update; it’s a fundamental shift in how we build plugins. We are moving from building interfaces for humans to building capabilities for agents. Start small with read-only diagnostics and build up your trust in the permission layer before letting an AI touch your database.
“},excerpt:{raw:
