Abilities for Easy Digital Downloads

Exposes Easy Digital Downloads to AI agents through the WordPress Abilities API, so an assistant connected over MCP can look up orders, customers, products and discounts, pull sales stats, refund an order, and more, with the same permissions the connected WordPress user has in the admin.

It also covers the Software Licensing and Recurring Payments add-ons. Their abilities register only when the add-on is active.

The plugin is standalone. It does not depend on Groundhogg or on any MCP plugin; it registers abilities and any Abilities API consumer can use them.

Requirements

• WordPress 6.9 or later (the Abilities API is in core from 6.9)
• PHP 7.4 or later
• Easy Digital Downloads 3.x (developed and tested against 3.5.3)
• Optional: EDD Software Licensing (tested on 3.9.1), EDD Recurring Payments (tested on 2.13.9)

Installation

1. Copy this folder to wp-content/plugins/edd-abilities, or install a zip of it.
2. Activate Abilities for Easy Digital Downloads.
3. To let an AI client use the abilities, expose them over MCP (next section).

Exposing the abilities over MCP

Abilities on their own are just PHP. To let Claude, Cursor, VS Code or any other MCP client call them, use the official WordPress MCP Adapter, which turns registered abilities into an MCP server.

1. Install the MCP Adapter

wp plugin install https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip --activate

(or download the zip from the releases page and install it like any plugin). It needs WordPress 6.9+ and PHP 7.4+.

2. Nothing to configure here

Every ability in this plugin is registered with meta.public = true, which is what the adapter's default server looks for. There is no setting to switch on. Once both plugins are active the abilities are available on the adapter's default server, mcp-adapter-default-server.

The default server does not list each ability as its own MCP tool. Clients reach them through three tools the adapter provides:

3. Connect a client

Pick a transport. Both authenticate as a WordPress user, and the ability's own capability check (see the table below) is applied to that user.

Local site, over STDIO with WP-CLI

{
  "mcpServers": {
    "my-store": {
      "command": "wp",
      "args": [
        "--path=/path/to/your/wordpress/site",
        "mcp-adapter",
        "serve",
        "--server=mcp-adapter-default-server",
        "--user=admin"
      ]
    }
  }
}

Remote or local site, over HTTP with an Application Password

Create an Application Password for the user (Users > Profile), then use the @automattic/mcp-wordpress-remote proxy:

{
  "mcpServers": {
    "my-store": {
      "command": "npx",
      "args": [ "-y", "@automattic/mcp-wordpress-remote@latest" ],
      "env": {
        "WP_API_URL": "https://your-site.example/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-username",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

4. Try it

From a terminal, list the EDD abilities, then run one (STDIO, on a local site):

echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"mcp-adapter-discover-abilities","arguments":{}}}' \
  | wp mcp-adapter serve --user=admin --server=mcp-adapter-default-server

echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"mcp-adapter-execute-ability","arguments":{"ability_name":"edd/get-store-stats","parameters":{"range":"last_30_days"}}}}' \
  | wp mcp-adapter serve --user=admin --server=mcp-adapter-default-server

Or, once a client is connected, just ask: "How much did we earn last month, and what were the top three products?" or "Refund $10 of order 1234, the second item only."

Keeping it safe

• The token can do what its user can do. Connect a dedicated user with just the roles you're happy for an assistant to hold (for example Shop Manager) rather than an administrator.

• Two abilities are marked destructive so a well-behaved client asks before running them: edd/refund-order and edd/cancel-subscription. Neither can be undone from here.

• Hide an ability entirely by removing it from the registry:

  add_filter( 'edd_abilities/abilities', function ( $classes ) {
      return array_diff( $classes, [ \EDD_Abilities\Abilities\Orders\Refund_Order::class ] );
  } );

• Or keep it registered but out of MCP, so other Abilities API consumers still see it:

  add_filter( 'wp_register_ability_args', function ( $args, $name ) {
      if ( 'edd/refund-order' === $name ) {
          $args['meta']['mcp']['public'] = false;
      }
      return $args;
  }, 10, 2 );

Available abilities

22 abilities: 16 that need only EDD, plus 3 each for Software Licensing and Recurring Payments. "Requires" is the capability the connected user must hold. Read abilities change nothing.

Orders

Customers

Customer abilities follow EDD's edd_view_customers_role / edd_edit_customers_role filters, so a store that remaps who can see or edit customers is respected. By default that is view_shop_reports to read and edit_shop_payments to change.

Products

Discounts

Reports

Software Licensing (only when EDD Software Licensing is active)

Recurring Payments (only when EDD Recurring Payments is active)

Conventions

• Lists take limit (default 20, max 100) and offset and return total_items for the whole match, so a client can page. Where an ability has costly extras they are opt-in through expand / include.
• Money is a plain number in the order's currency. Dates come back as { utc, local, timezone }.
• Errors are returned as WordPress errors with a stable code, e.g. edd_abilities_not_found, refund_validation_error, ability_invalid_permissions.

Not included yet: creating or editing products, licensing activations and renewals, and subscription changes other than cancelling.

Adding your own abilities

Other plugins can register abilities and categories next to these. WordPress only accepts registrations while its wp_abilities_api_init / wp_abilities_api_categories_init actions run, so call these on plugins_loaded or earlier (calling later is reported with _doing_it_wrong()):

add_action( 'plugins_loaded', function () {
    \EDD_Abilities\Registry::add_category( 'my-addon', [
        'label'       => 'My Add-on',
        'description' => 'Abilities from my add-on.',
    ] );

    \EDD_Abilities\Registry::add_ability( \My_Addon\Do_The_Thing::class );
} );

A class extends \EDD_Abilities\Abilities\Ability: set the NAME, CATEGORY, CAPABILITY, READONLY, DESTRUCTIVE and IDEMPOTENT constants, return the JSON schemas from get_args(), and do the work in __invoke( $input ). Reuse the Abilities\Schemas\* classes (get_schema() / transform()) for EDD objects. An ability can declare public static function is_available(): bool to register only when the plugin it wraps is active.

Development

• Classes autoload from includes/ by name: EDD_Abilities\Abilities\Orders\List_Orders lives in includes/abilities/orders/list-orders.php.
• Tests are WordPress-integration PHPUnit tests that run every ability through the real Abilities API against a real EDD. See tests/phpunit/README.md.

License

GPL-3.0-or-later.