AI assistants and WordPress abilities

WordPress 6.9 added the Abilities API: a standard way for plugins to say what they can do, so that AI assistants and other tools can use it. Snipfire registers abilities for working with snippets. With the WordPress MCP adapter plugin, an AI assistant that speaks MCP (the Model Context Protocol) can use them; other tools can call them through the REST API.

Nothing here needs an AI service in Snipfire itself: the assistant runs wherever you use it, and talks to your site as you. (Snipfire Pro also has an AI assistant inside the editor, with your own API key. The two are separate and can be used together.)

Switch them on #

The abilities are always there for code running on your own site. Offering them to outside tools is off by default.

1. Go to Snipfire → Tools & Safe Mode → AI assistants.
2. Tick Offer the abilities to AI assistants (MCP) and the REST API.
3. Click Save.

The AI assistants box only appears on WordPress 6.9 and later. Only people with full Snipfire access can change the setting, and with Snipfire Pro the change is recorded in the activity log.

The abilities #

They're in the ability category snipfire. The snippet fields are the same as everywhere else, including smart_tags, the settings form's fields and values, and with Snipfire Pro schedule (with run schedule) and selector (with hook element:selector): see Snippet fields.

The same rules as the editor #

An assistant can't do more than you could do yourself in the editor:

• Every ability runs as the signed-in user, for example through an application password, and checks that person's Snipfire access. With Snipfire Pro's team access, someone with CSS, JS and HTML (no PHP) access can't create or change PHP through an assistant either.
• New snippets start switched off, unless the assistant explicitly asks for "status": "active".
• Switching a snippet on runs the usual checks and a test load of your site. If they fail, the snippet stays off and the assistant gets the errors back.
• Every change is kept in the snippet's history, so you can see and undo what an assistant did.

Before you let an assistant change snippets, read How Snipfire keeps your site safe. Consider giving the assistant a user of its own, with only the access it needs.

Using them with an AI assistant (MCP) #

1. Install the WordPress MCP adapter plugin (wordpress/mcp-adapter) on your site.
2. In Snipfire, switch on Offer the abilities to AI assistants (MCP) and the REST API.
3. Make an application password for the user the assistant should act as: Users → Profile → Application Passwords.
4. Connect your assistant to the adapter's address, https://example.com/wp-json/mcp/mcp-adapter-default-server (with plain permalinks: https://example.com/?rest_route=/mcp/mcp-adapter-default-server). For Claude Desktop, see below.
5. Ask your assistant, for example: "List the PHP snippets on my site that are switched off", or "Write a snippet that adds a reading time to blog posts, check it, and save it switched off."

The assistant sees three MCP tools (discover abilities, get an ability's details, run one) and reaches Snipfire's abilities through them. It sees each ability's description, so it knows to check code before saving it and to leave new snippets off.

It acts as the user whose application password it has, with that user's Snipfire access level: new snippets start switched off, and switching one on test-loads the site.

We test the abilities through the real MCP adapter with the MCP Inspector and the two bridges below (@automattic/mcp-wordpress-remote and mcp-remote), using exactly the configuration shown. If your assistant doesn't see the Snipfire abilities, tell us.

Claude Desktop #

Claude Desktop connects through a small bridge that runs on your computer, so you need Node.js installed. In Claude Desktop, open Settings → Developer → Edit Config and add Snipfire to claude_desktop_config.json:

{
  "mcpServers": {
    "snipfire": {
      "command": "npx",
      "args": [ "-y", "@automattic/mcp-wordpress-remote" ],
      "env": {
        "WP_API_URL": "https://example.com/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "your-username",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Replace the address with your site's, and the user name and application password with the ones from step 3. Restart Claude Desktop.

Or use the mcp-remote bridge instead (one entry is enough, not both):

{
  "mcpServers": {
    "snipfire-via-mcp-remote": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://example.com/wp-json/mcp/mcp-adapter-default-server",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Basic <base64 of your-username:your application password>"
      }
    }
  }
}

Both bridges accept the plain-permalink address too. Your site needs HTTPS: mcp-remote refuses plain http:// addresses unless you add --allow-http (for a local test site only).

Keep the file private: it holds a password to your site. To cut an assistant off, revoke its application password.

Using them over the REST API #

When the setting is on, the abilities are available through WordPress's Abilities REST API, at /wp-json/wp-abilities/v1/. Authenticate as with Snipfire's own REST API.

Abilities that only read are run with GET, with the input in the query string:

curl -u "$USER:$APP_PASSWORD" \
  'https://example.com/wp-json/wp-abilities/v1/abilities/snipfire/list-snippets/run?input[type]=html'

The others are run with POST and a JSON body:

curl -u "$USER:$APP_PASSWORD" -X POST \
  https://example.com/wp-json/wp-abilities/v1/abilities/snipfire/save-snippet/run \
  -H 'Content-Type: application/json' \
  -d '{"input":{"title":"Hide store notice","type":"css","code":".woocommerce-store-notice{display:none}"}}'

GET /wp-json/wp-abilities/v1/abilities lists every ability the signed-in user can see. While the setting is off, Snipfire's abilities aren't in that list.

For your own code, Snipfire's REST API and WP-CLI do everything the abilities do and more.

For add-on developers #

Add your own abilities to the snipfire category on the snipfire_abilities action, and use Snipfire\Abilities::meta() so they follow the AI assistants setting. See PHP hooks.