=== Seeb Abilities ===
Contributors: sanzeeb3
Tags: ai, mcp, abilities api, ai agent, automation
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds new abilities to the WordPress Abilities API, so AI agents and MCP clients can manage posts, blocks, templates, media and more.

== Description ==

**Seeb Abilities adds 53 new abilities to WordPress**, so AI agents can write and edit posts, build pages block by block, manage patterns and templates, moderate comments and more, instead of only reading information about your site.

WordPress 6.9 introduced the [Abilities API](https://developer.wordpress.org/apis/abilities-api/): a standard way for plugins to describe what they can do, with typed inputs and outputs and permission checks, so that AI assistants, [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) clients and automation tools can discover and use them. Core registers only a few read-only abilities, such as site and environment information. Seeb Abilities fills the gap with the everyday content-management tasks.

Seeb Abilities is best used with the free [MCP Adapter](https://wordpress.org/plugins/mcp-adapter/) plugin, which turns these abilities into MCP tools that [Claude](https://claude.ai/), [ChatGPT](https://chatgpt.com/), [Cursor](https://cursor.com/), [VS Code](https://code.visualstudio.com/) and other MCP clients can use directly.

Every ability:

* Uses WordPress's own functions (`wp_insert_post()`, [`wp_update_post()`](https://developer.wordpress.org/reference/functions/wp_update_post/), `wp_set_object_terms()` and so on), so hooks, caches, revisions and other plugins behave exactly as they do in the admin.
* Checks the current user's [capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) for that specific object. An agent connected as an Author can edit their own posts, but not someone else's and not the site settings.
* Declares input and output schemas, and annotations (read-only, destructive, idempotent) that clients use to decide when to ask before acting.
* Is available through the [WordPress REST API](https://developer.wordpress.org/rest-api/) (`/wp-json/wp-abilities/v1/`) and, when the MCP Adapter plugin is active, as MCP tools.

= 53 new abilities =

All abilities use the `seeb-abilities/` namespace and are grouped into categories.

**Content** (posts, pages and public custom post types)

* `posts-query`: find posts by type, status, author, search term, taxonomy term or date
* `post-get`: get a post with its content, terms and featured image
* `post-create`: create a post, page or custom post type item
* `post-update`: update title, content, excerpt, status, slug, author, date or featured image
* `post-delete`: move a post to the trash, or delete it permanently with `force`
* `post-revisions`: list the [revisions](https://wordpress.org/documentation/article/revisions/) of a post, pattern, navigation menu or customized template
* `revision-restore`: restore any of these to an earlier revision
* `post-restore`: restore a post from the trash
* `post-duplicate`: copy a post, with its terms, featured image and the custom fields you're allowed to edit, as a new draft
* `post-meta-get`: read a post's custom fields registered with [`register_post_meta()`](https://developer.wordpress.org/reference/functions/register_post_meta/)
* `post-meta-update`: update a post's registered custom fields
* `content-search`: search across all public post types at once

**Taxonomies**

* `terms-query`: find categories, tags or custom taxonomy terms
* `term-create`: create a term
* `term-update`: rename a term or change its slug, description or parent
* `post-set-terms`: set or append a post's terms

**Blocks and patterns** ([block editor](https://developer.wordpress.org/block-editor/))

* `block-types-list`: list the registered blocks, with their category, title and description
* `block-type-get`: get one block's attributes, supports, styles and variations, so an agent can write valid block markup
* `post-blocks-get`: get a post's content as a tree of blocks, each with its path (for example `2.0` for the first block inside the third)
* `block-insert`: insert one or more blocks at a path, or before or after a block
* `block-update`: change a block's attributes or inner content without touching the rest of the post
* `block-move`: move a block to another position
* `block-remove`: remove a block and its inner blocks
* `blocks-replace`: replace every block of one type, or with a given attribute value, across a post (for example turn all `core/quote` blocks into `core/pullquote`)
* `blocks-validate`: check block markup before saving and report unknown blocks, invalid attributes and broken nesting
* `block-usage-find`: find the posts, pages, templates and patterns that use a block type
* `patterns-list`: list registered and [synced patterns](https://wordpress.org/documentation/article/reusable-blocks/), with their categories
* `pattern-insert`: insert a pattern into a post, either as a synced reference or as a copy of its blocks
* `pattern-create`: save blocks as a new synced or unsynced pattern
* `pattern-update`: update a synced pattern, which changes it everywhere it is used

All block edits are saved as revisions, so any change can be undone with `revision-restore`. The first change to a theme template creates a customized copy, which `template-reset` removes again.

**[Site editor](https://wordpress.org/documentation/article/site-editor/)** (block themes)

* `templates-list`: list templates and template parts, and whether they are customized
* `template-get`: get a template or template part as blocks
* `template-update`: edit a template or template part with the same block abilities as posts
* `template-reset`: remove customizations and go back to the theme's version
* `global-styles-get`: read the site's [global styles](https://developer.wordpress.org/themes/global-settings-and-styles/): colors, typography and spacing presets, so new blocks match the theme

**Navigation**

* `menus-list`: list [menus](https://wordpress.org/documentation/article/appearance-menus-screen/) and their locations
* `menu-items-query`: list the items of a menu
* `menu-item-add`: add a page, post, term or custom link to a menu

**Media**

* `media-query`: find media library items
* `media-sideload`: import an image or file from a URL into the media library
* `media-update`: update alt text, caption, title or description

**Comments**

* `comments-query`: find comments by post, status or author
* `comment-moderate`: approve, unapprove, mark as spam or trash a comment
* `comment-reply`: reply to a comment as the current user

**Users**

* `users-query`: list users with their roles (read-only, requires the `list_users` capability, never returns passwords)
* `current-user-get`: get the connected user's role and capabilities, so an agent knows what it is allowed to do

**Site**

* `settings-get`: read general and reading settings
* `settings-update`: change site title, tagline, timezone, date format and other allowlisted settings
* `plugins-list`: list installed plugins and whether they are active
* `post-types-list`: list registered post types and taxonomies
* `site-health-get`: get the [Site Health](https://wordpress.org/documentation/article/site-health-screen/) status and the tests that need attention
* `cron-events-list`: list [scheduled (cron) events](https://developer.wordpress.org/plugins/cron/) and when they run next
* `themes-list`: list installed themes and which one is active

= Safe by default =

* Deleting moves to the trash. Permanent deletion needs `force: true` and is marked as destructive.
* Settings can only be read and changed from a fixed allowlist. Arbitrary options are never touched.
* Protected post meta (keys starting with `_`) cannot be written.
* Password-protected content is only returned to users who can edit it.
* No ability runs PHP or SQL, edits files, or installs or activates plugins.
* Query results are paginated with a maximum page size.
* Site owners can turn off any ability, or a whole category, under **Settings → Seeb Abilities**.

= For developers =

* Filter `seeb_abilities_ability_args` to change an ability's arguments before it is registered.
* Filter `seeb_abilities_enabled` to enable or disable abilities in code.
* Filter `seeb_abilities_allowed_settings` to change which settings `settings-get` and `settings-update` can access.

== Installation ==

1. Install and activate the plugin from **Plugins → Add New**, or upload the `seeb-abilities` folder to `/wp-content/plugins/`.
2. Recommended: install the free [MCP Adapter](https://wordpress.org/plugins/mcp-adapter/) plugin to use the abilities from MCP clients like Claude, Cursor or VS Code.
3. Optional: go to **Settings → Seeb Abilities** to turn off abilities you don't want to expose.

Abilities run as the user who is authenticated, for example with an [application password](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/). Use an account that only has the role the agent actually needs.

== Frequently Asked Questions ==

= Do I need the MCP Adapter plugin? =

No and yes. The abilities are registered with the WordPress Abilities API and can be used through its REST endpoints or from PHP. To use them from AI assistants and MCP clients, we recommend the free [MCP Adapter](https://wordpress.org/plugins/mcp-adapter/) plugin.

= Can an AI agent break my site with this? =

An agent can do only what the connected user's role allows, and only through the listed abilities. It cannot run code, change arbitrary options or manage plugins. Deleting content moves it to the trash by default. For extra safety, connect with an Editor or Author account and turn off the categories you don't need.

= Does the plugin send data to any external service? =

No. The plugin makes no external requests of its own. The only exception is `media-sideload`, which downloads the file from the URL given in the request.

= Does it work with custom post types and taxonomies? =

Yes, if they are registered with `show_in_rest` set to true. Custom post types are subject to their own capabilities.

= Why does it require WordPress 6.9? =

The Abilities API was added to core in WordPress 6.9 (see the [Abilities API announcement](https://make.wordpress.org/core/2025/11/10/abilities-api-in-wordpress-6-9/)). On older versions the plugin does nothing.

== Changelog ==

= 1.0.0 =
* Initial release with 53 abilities.
