WordPress CRUD Abilities

Ready-to-use content CRUD abilities for the WordPress Abilities API — so AI agents and automation tools can manage posts, pages, media, users, taxonomies, and settings through a standard, permission-aware interface.

Works with the Abilities API and optionally the MCP Adapter for Model Context Protocol exposure.

Why this plugin exists

WordPress ships the Abilities API (framework + registry + REST) so plugins can declare discoverable, schema-validated actions for AI and automation.

What core does not ship today is a complete, official set of content-management abilities (create/update/delete posts, pages, media, users, taxonomies, options, and so on).

Until WordPress provides an official alternative, this plugin fills that gap: *40 production-ready `wcrud/` abilities** that any MCP-compatible agent (Claude, ChatGPT, Cursor, VS Code, etc.) can discover and invoke — with normal WordPress capability checks.

Features

• 40 abilities across posts, pages, menus, media, taxonomies, users, settings, and search
• Permission-aware — every ability uses WordPress capabilities (edit_posts, manage_options, etc.)
• Schema-defined inputs/outputs for reliable agent tooling
• MCP-ready — abilities are marked public for MCP Adapter discovery
• Markdown-friendly post content when Jetpack Markdown is enabled
• Lightweight: no admin UI required; activate and go

Requirements

• WordPress 6.8 or later
• PHP 7.4 or later
• Abilities API plugin (or core Abilities API when available on your site)
• MCP Adapter (optional — only needed to expose abilities over MCP)

Installation

1. Install and activate Abilities API
2. Clone or download this plugin into /wp-content/plugins/wordpress-crud-abilities/
3. Activate WordPress CRUD Abilities in WP Admin → Plugins
4. (Optional) Install MCP Adapter and configure your MCP client (see below)

cd wp-content/plugins
git clone https://github.com/matteolavaggi/wordpress-crud-abilities.git

Quick start (MCP)

1. Create a WordPress Application Password for a user with the capabilities you want the agent to have
2. Install MCP Adapter on the site
3. Point your MCP client at the site adapter endpoint

Cursor / VS Code (mcp.json)

{
  "servers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-wordpress-username",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-site.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-wordpress-username",
        "WP_API_PASSWORD": "your-application-password"
      }
    }
  }
}

Replace placeholders, then reload the MCP server. Agents should discover tools namespaced under wcrud/….

Available abilities (40)

Posts (5)

Pages (5)

Menus (3)

Media (4)

Taxonomies (8)

Users (7)

Settings (5)

Search & utilities (3)

Architecture

AI client (Claude / Cursor / ChatGPT / …)
        │  MCP
        ▼
MCP Adapter (WordPress plugin)
        │  Abilities API
        ▼
WordPress CRUD Abilities  →  wcrud/* callbacks
        │
        ▼
WordPress core APIs (posts, users, options, …) + capability checks

Without MCP Adapter, abilities remain usable via the Abilities API PHP/REST surfaces on the site.

Markdown support

When Jetpack Markdown is enabled, post content accepts Markdown (headings, emphasis, lists, code blocks, blockquotes, tables, links, images).

Security

• Read abilities require the usual read/list capabilities
• Create/update abilities require edit capabilities
• Delete abilities require delete capabilities
• Settings/option abilities require manage_options
• Prefer a dedicated Application Password user with least privilege for agents

Hooks & filters

add_filter( 'wp_register_ability_args', function ( $args, $name ) {
    if ( strpos( $name, 'wcrud/' ) === 0 ) {
        // Adjust labels, schemas, meta, etc.
    }
    return $args;
}, 10, 2 );

Roadmap / gaps

Known omissions vs a full “official” content toolkit (contributions welcome):

• Media upload / create-media
• update-tag
• Deeper custom post type and custom taxonomy CRUD
• Attachment upload from remote URLs

If/when WordPress ships official content abilities, this plugin can thin out or become a compatibility bridge — until then it is a practical default for agent-driven site management.

Contributing

Issues and pull requests are welcome on GitHub.

1. Fork the repo
2. Create a feature branch
3. Keep abilities namespaced wcrud/… and permission callbacks strict
4. Open a PR with a short description of the ability or fix

Changelog

See CHANGELOG.md.

License

GPL-2.0-or-later — see LICENSE.

Links

• Abilities API handbook
• Introducing the WordPress Abilities API
• WordPress Abilities API (GitHub)
• MCP Adapter (GitHub)
• This plugin