Abilities API - CourtneyR.dev's 2nd Brain

Abilities API 🔗 **Source:** [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) > [!note]+ Document Notes > tags: [WordPress, Abilities-API, MCP] > author: Merlin AI > source: YouTube > reference: [https://www.youtube.com/watch?v=m19VM2yIbHU] > date created: > > # 🏷️ Title: Abilities API >  ## 🧰 Action Inbox - [H1] Map Abilities API to MCP tools — context/https://github.com/WordPress/abilities-api #articleseed - [H2] Draft governance note on permissions callbacks — context/https://github.com/WordPress/abilities-api #addendum - [H3] Build demo plugin exposing two safe abilities — context/https://github.com/WordPress/abilities-api #articleseed - [H4] Test REST exposure flags in staging — context/https://github.com/WordPress/abilities-api #xref - [H5] Sketch Workflows API chain example for posts — context/https://github.com/WordPress/wordpress-develop #articleseed - [H6] Share MCP adapter setup gist with The WPOCC — context/https://github.com/WordPress/ai-experiments #share - [H7] Compare server vs client abilities in DX doc — context/https://modelcontextprotocol.io #xref - [H8] Write incident note on input schema validation — context/https://github.com/WordPress/abilities-api #articleseed - [H9] Cross-reference OSPO policy on application passwords — context/https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ #xref - [H10] Invite maintainers to workflow clinic session — context/https://make.wordpress.org/ #share - [H11] Note aphorism: “Describe first, execute second.” — context/Video #aphorisms - [H12] Park bmf: TX-generated block for Mermaid previews — context/https://tx.sh/ #bmf ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - WordPress Abilities API repository and docs: https://github.com/WordPress/abilities-api - MCP (Model Context Protocol): https://modelcontextprotocol.io - WordPress REST API auth guide: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ - WordPress Developer Blog and Make: https://make.wordpress.org/ - TX block generator: https://tx.sh/ - A2A agent protocol overview: https://blog.langchain.dev/agent-to-agent-protocol/ *(third-party; availability may vary)* - Video source: https://www.youtube.com/watch?v=m19VM2yIbHU ## 📝 Summary - The stream explores the WordPress Abilities API. - The API standardizes capability descriptions for tools and workflows. - Stakeholders include core, plugin authors, AI tool vendors, and The WPOCC. - Risks involve permission errors, schema mismatches, and REST exposure gaps. - Bottom line: describe abilities cleanly, gate them correctly, then compose workflows. ## 📖 Main Content - The Abilities API registers named abilities with schemas and permissions. - MCP adapters expose those abilities as tools for agents. - Workflows chain abilities into user-facing commands. - Input and output schemas support validation and safety. - REST exposure is opt-in via flags; authentication is required. - Server abilities run in PHP; client abilities run in JavaScript. - The architecture separates description from transport. - This allows future protocols beyond MCP. - The stream demonstrates registration, execution, and common pitfalls. - Common pitfalls include missing categories and invalid input objects. - Another pitfall is forgetting REST exposure when testing from JS. - App passwords are required for remote access via MCP. - These choices improve interoperability and safety across plugins. - Uncertainties remain around evolving docs and final 6.9 scope. - The approach aligns with sustainable governance and OSPO needs. ### 🗒️ Notes #### ⏱️ [00:07:58](https://www.youtube.com/watch?v=m19VM2yIbHU&t=478) Abilities describe actions for AI use ### [H1] Abilities describe actions for AI tools > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “The abilities API defines what abilities of actions WordPress can execute via AI.” Enables consistent tooling across plugins and agents. Validates inputs and permissions. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=478) #xref #articleseed ID:rw_vid_478 #### ⏱️ [00:09:51](https://www.youtube.com/watch?v=m19VM2yIbHU&t=591) MCP adapter exposes tools ### [H2] MCP adapter exposes abilities as tools > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “We need an extra layer which is the MCP adapter… exposing them as tools.” Clarifies transport separation. Keep descriptions protocol-agnostic. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=591) #xref ID:rw_vid_591 #### ⏱️ [00:26:57](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1617) Workflows chain abilities ### [H3] Workflows chain abilities into commands > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Chaining commands together… output of one ability is connected to the input of another.” Supports multi-step admin tasks and guided flows. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1617) #articleseed ID:rw_vid_1617 #### ⏱️ [00:25:57](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1557) Categories are required ### [H4] Abilities require a category assignment > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Each ability must belong to exactly one category.” Aids discovery, grouping, and UI surfacing. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1557) #xref ID:rw_vid_1557 #### ⏱️ [00:24:05](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1445) Schemas and permissions ### [H5] Schemas validate inputs; callbacks gate execution > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Input and output schemas… and a permission callback.” Establishes safety and predictable behavior. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=1445) #xref #articleseed ID:rw_vid_1445 #### ⏱️ [02:02:20](https://www.youtube.com/watch?v=m19VM2yIbHU&t=7340) REST is opt-in ### [H6] REST exposure is an explicit ability flag > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “By default… not exposed via the REST API.” Set `show_in_rest: true` to execute from JS. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=7340) #xref ID:rw_vid_7340 #### ⏱️ [01:44:48](https://www.youtube.com/watch?v=m19VM2yIbHU&t=6288) Execution callback details ### [H7] Execute callbacks must match schema contracts > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “The properties must contain a valid execute callback function.” Return types must match declared output. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=6288) #xref ID:rw_vid_6288 #### ⏱️ [02:06:33](https://www.youtube.com/watch?v=m19VM2yIbHU&t=7593) Input object gotcha ### [H8] Empty input must still be an object > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Input is not of type object.” Use `{}` when no fields are required. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=7593) #articleseed ID:rw_vid_7593 #### ⏱️ [02:21:54](https://www.youtube.com/watch?v=m19VM2yIbHU&t=8514) MCP auth ### [H9] Application passwords enable remote MCP access > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “It should be an application password.” Use per-user app passwords for the MCP client. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=8514) #xref ID:rw_vid_8514 #### ⏱️ [01:18:31](https://www.youtube.com/watch?v=m19VM2yIbHU&t=4711) Client vs server abilities ### [H10] Client abilities run in JS; server in PHP > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Execute server-side PHP abilities… register client-side JavaScript abilities.” Pick the right runtime for the task. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU&t=4711) #xref ID:rw_vid_4711 ## 📚 References - WordPress Abilities API (repo): https://github.com/WordPress/abilities-api - Model Context Protocol: https://modelcontextprotocol.io - WordPress REST Authentication: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ - TX block generator: https://tx.sh/ - Video: https://www.youtube.com/watch?v=m19VM2yIbHU ## 🗣️ Paraphrase - Abilities standardize what WordPress components can do for tools and agents. MCP then exposes those abilities. - Schemas and permissions keep execution safe. Workflows will chain abilities into repeatable admin tasks. ## 📰 Newsletter - WordPress 6.9 work adds an Abilities API for structured actions. - MCP adapters turn abilities into agent tools with guardrails. - Try a demo plugin that exposes a read-only site info ability. - Then add `show_in_rest: true` and call it from the editor console. - Helpful links: Abilities repo, MCP docs, REST auth guide. ## ✅ Action Items #### DevRel - Publish a tutorial: register ability, expose via REST, call from JS. - Record a quick-start screencast using a safe read-only ability. - Add a sample app to the GoDaddy WordPress toolkit. #### OSPO - Document permission callback patterns and reviewer checklists. - Require schemas and tests before enabling destructive abilities. - Track MCP usage and app password hygiene in audits. #### Community - Run a workflow clinic on chaining common admin tasks. - Host a “first ability” pairing for new contributors. - Share success stories through Make posts and meetups. #### WordPress - Core: finalize category taxonomy and naming conventions. - Playground: add an Abilities API sandbox recipe. - Documentation: include REST exposure pitfalls and examples. - Training: create lessons on schemas and safe execution. - Meta: surface abilities in DevHub once stable. #### The WPOCC - Pilot maintainer stipends for workflow templates. - Fund microgrants for documentation sprints on abilities. - Publish transparent ledgers for funded abilities work. ### FAIR - Define provenance for ability definitions and versioning. - Create covenants for destructive operations with sunset clauses. - Ship operator agreement templates for hosted MCP servers. ## 🧪 Hypotheses - Clear schemas reduce execution errors by at least 50%. - Categories improve ability discovery in tools by 30%. - REST exposure defaults reduce accidental public endpoints. - Workflow templates increase reuse across teams by 40%. ### 📊 Methodology - Compare error rates before and after schema enforcement. - A/B test discovery with and without category tags. - Scan endpoints for exposure flags across sample sites. - Track workflow template adoption and time to task completion. ### ❓ Questions - Should destructive abilities require explicit user confirmation? - How should multi-tenant hosts gate MCP tools safely? - What telemetry best reflects ability usefulness without PII? ### 🔮 Future Research - Standardize ability categories across core and popular plugins. - Prototype a Workflows API with human-in-the-loop steps. - Evaluate A2A for remote agent orchestration in WordPress. ### 💡 Implications - Better onboarding for contributors and maintainers. - Safer automation for hosts and enterprises. - Clearer governance for AI-driven operations in WordPress. ### 🧠 Learning Styles Assessment - Reading level estimate: Flesch-Kincaid Grade ~10–11. #### 👀 Visual learners - Present: diagrams in slides and repos. - Improve: sequence diagrams for tool calls. #### 🔊 Aural learners - Present: livestream talk-throughs. - Improve: 3-minute audio summaries. #### 🗣️ Verbal learners - Present: definitions and examples. - Improve: glossary with code snippets. #### 🧩 Kinesthetic learners - Present: plugin demos. - Improve: guided labs in Playground. #### 🧠 Logical learners - Present: schemas and validation logic. - Improve: decision trees for permissions. #### 🧑‍🤝‍🧑 Social learners - Present: chats and Q&A. - Improve: cohort-based learning sprints. #### 🧘‍♀️ Solitary learners - Present: written docs. - Improve: self-check quizzes. #### 🌿 Naturalistic learners - Present: sustainability links minimal. - Improve: lifecycle and carbon notes for hosting. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: headings and landmarks in docs. - Improve: alt text and language attributes. #### Keyboard navigation - Present: basic focus states. - Improve: remove traps; ensure reachability. #### Contrast and readability - Present: adequate contrast in samples. - Improve: line-height and large-text checks. #### Text resizing and reflow - Present: responsive docs. - Improve: prefer-reduced-motion support. #### Media and captions - Present: YouTube captions. - Improve: downloadable transcripts. #### Forms and interactions - Present: basic labels in demos. - Improve: inline validation and target sizes. #### Standards reference - Map gaps to WCAG 2.2 AA criteria. ### 🌍 DEIB Assessment #### Cultural breadth - Present: global community context. - Improve: more non-English examples. #### Inclusive language - Present: neutral terminology. - Improve: expand glossaries and plain-language notes. #### Neurodiversity support - Present: chunked content via sections. - Improve: predictable patterns and icon+text labels. #### Representation - Present: varied contributor mentions. - Improve: balanced quoting across regions. #### Psychological safety - Present: respectful framing. - Improve: explicit moderation and escalation paths. ### ✅ Logical Validity #### Strong reasoning - Separation of description and transport improves future-proofing [H2]. - Schema validation reduces runtime errors and clarifies inputs [H5], [H8]. - Categories aid discoverability and tooling composition [H4], [H3]. #### Fallacies - None prominent; claims remain bounded and evidence-based. - Avoid overgeneralizing from a single demo; note evolving docs. #### Tone of voice - Exploratory, candid about blockers, and oriented toward practice. ### 🛡️ DARVO Analysis - Deny: no denial patterns observed. - Attack: no personal attacks observed. - Reverse victim/offender: not present. - Discourse focuses on debugging and learning. ## 🎯 Conclusion - The Abilities API formalizes what WordPress can do. - MCP exposes those abilities as safe, validated tools. - Workflows will chain them into efficient flows. - Next steps: ship demos, finalize docs, and fund maintainer time through The WPOCC. ## 🔖 Zettel Candidates - **Abilities describe actions for AI tools** — Core idea; enables tool ecosystems. https://github.com/WordPress/abilities-api Links: [[MCP adapter exposes abilities as tools]] [[REST exposure is an explicit ability flag]] - **MCP adapter exposes abilities as tools** — Transport layer, protocol-agnostic by design. https://modelcontextprotocol.io Links: [[Abilities describe actions for AI tools]] [[Client abilities run in JS; server in PHP]] - **Workflows chain abilities into commands** — Compose multi-step tasks with inputs. https://github.com/WordPress/wordpress-develop Links: [[Schemas validate inputs; callbacks gate execution]] [[REST exposure is an explicit ability flag]] - **Abilities require a category assignment** — Improves discovery and UI grouping. https://github.com/WordPress/abilities-api Links: [[Workflows chain abilities into commands]] - **Schemas validate inputs; callbacks gate execution** — Safety and predictability. https://github.com/WordPress/abilities-api Links: [[Empty input must still be an object]] - **REST exposure is an explicit ability flag** — Prevents accidental public endpoints. https://developer.wordpress.org/rest-api/ Links: [[Client abilities run in JS; server in PHP]] - **Empty input must still be an object** — `{}` even when no fields exist. https://github.com/WordPress/abilities-api Links: [[Schemas validate inputs; callbacks gate execution]] - **Client abilities run in JS; server in PHP** — Choose runtime by task needs. https://github.com/WordPress/abilities-api Links: [[MCP adapter exposes abilities as tools]] - **Application passwords enable remote MCP access** — Safer auth for tooling. https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ Links: [[MCP adapter exposes abilities as tools]] ## 🏷️ Tag Coverage #articleseed: 4 • #xref: 3 • #share: 2 • #bmf: 1 • #addendum: 1 • #aphorisms: 1 ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: **H3**. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] 5–10-word present-tense claim > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) by [[Merlin AI]] via [[YouTube]]. Published [MISSING]. Accessed . > “Short quote, verbatim, ≤25 words.” Two lines: context and use. Cite data if relevant. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] 5–10-word present-tense claim > [!quote] [Abilities API](https://www.youtube.com/watch?v=m19VM2yIbHU) > “Short quote, verbatim, ≤25 words.” Two lines: context and use. [view highlight](https://www.youtube.com/watch?v=m19VM2yIbHU#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: **H4**. - Each item: one idea, present tense, specific, testable. #### [Z1] 5–10-word present-tense claim - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[Parent-Concept]] [[Related-Idea]] #### [Z2] 5–10-word present-tense claim - Scope/condition in one line. - Pointer to page/time or dataset. - Links: [[Parent-Concept]] [[Related-Idea]] --- ### ✏️ Fleeting Queue (Extract by Selection) - Purpose: Capture quick actions or sparks for Fleeting notes. - Extraction: **Select one line** → “Refactor: Extract selection to new note (content only).” - Keep each line short and self-contained. - [F1] Short action — context/https://www.youtube.com/watch?v=m19VM2yIbHU #fleeting #inbox - [F2] Short action — context/https://github.com/WordPress/abilities-api #fleeting #inbox - [F3] Short action — context/https://modelcontextprotocol.io #fleeting #inbox ---