Skip to content

Early-bird lifetime licence: $199 once, for the first 200 buyers only. See the offer

All docs

AI assistants and WordPress abilities

WordPress 6.9 added the Abilities API: a standard way for plugins to say what they can do, so that AI assistants and other tools can use it. Snipfire registers abilities for working with snippets. With the WordPress MCP adapter plugin, an AI assistant that speaks MCP (the Model Context Protocol) can use them; other tools can call them through the REST API.

Nothing here needs an AI service in Snipfire itself: the assistant runs wherever you use it, and talks to your site as you.

Switch them on

The abilities are always there for code running on your own site. Offering them to outside tools is off by default.

  1. Go to Snipfire → Tools & Safe Mode → AI assistants.
  2. Tick Offer the abilities to AI assistants (MCP) and the REST API.
  3. Click Save.

The AI assistants box only appears on WordPress 6.9 and later. Only people with full Snipfire access can change the setting, and with Snipfire Pro the change is recorded in the activity log.

The abilities

Ability What it does Access needed
snipfire/list-snippets Lists the snippets (without their code): title, type, status, location, folder. Filters: type, status, folder, search View only
snipfire/get-snippet One snippet with its code and all its settings. Input: id View only
snipfire/list-locations The places each type of snippet can run (the hook setting), with a description of each. Optional type View only
snipfire/validate-snippet Checks code without saving it: PHP syntax errors, functions that already exist, CSS that doesn't compile. Needs type and code CSS, JS and HTML
snipfire/save-snippet Creates a snippet (no id) or updates one (with id; only the fields given change) CSS, JS and HTML
snipfire/set-snippet-status Switches a snippet on or off. Input: id, active (true or false) CSS, JS and HTML
snipfire/list-library Lists the snippet library, and whether each snippet is installed. Optional search or pack View only
snipfire/install-library-snippets Installs library snippets (slugs, or a whole pack) into the Library folder, switched off CSS, JS and HTML
snipfire/list-activity Pro The activity log: who changed what, newest first. Filters: snippet, user, action, search, limit (up to 200) View only

They're in the ability category snipfire. The snippet fields are the same as everywhere else: see Snippet fields.

The same rules as the editor

An assistant can't do more than you could do yourself in the editor:

  • Every ability runs as the signed-in user, for example through an application password, and checks that person's Snipfire access. With Snipfire Pro's team access, someone with CSS, JS and HTML (no PHP) access can't create or change PHP through an assistant either.
  • New snippets start switched off, unless the assistant explicitly asks for "status": "active".
  • Switching a snippet on runs the usual checks and a test load of your site. If they fail, the snippet stays off and the assistant gets the errors back.
  • Every change is kept in the snippet's history, so you can see and undo what an assistant did.

Before you let an assistant change snippets, read How Snipfire keeps your site safe. Consider giving the assistant a user of its own, with only the access it needs.

Using them with an AI assistant (MCP)

We test the abilities over the REST API. The MCP adapter is a separate plugin with its own setup; if your assistant doesn't see the Snipfire abilities, tell us.

  1. Install the WordPress MCP adapter plugin and set it up with your assistant, following its instructions.
  2. In Snipfire, switch on Offer the abilities to AI assistants (MCP) and the REST API.
  3. Ask your assistant, for example: "List the PHP snippets on my site that are switched off", or "Write a snippet that adds a reading time to blog posts, check it, and save it switched off."

The assistant sees each ability's description, so it knows to check code before saving it and to leave new snippets off.

Using them over the REST API

When the setting is on, the abilities are available through WordPress's Abilities REST API, at /wp-json/wp-abilities/v1/. Authenticate as with Snipfire's own REST API.

Abilities that only read are run with GET, with the input in the query string:

curl -u "$USER:$APP_PASSWORD" \
  'https://example.com/wp-json/wp-abilities/v1/abilities/snipfire/list-snippets/run?input[type]=html'

The others are run with POST and a JSON body:

curl -u "$USER:$APP_PASSWORD" -X POST \
  https://example.com/wp-json/wp-abilities/v1/abilities/snipfire/save-snippet/run \
  -H 'Content-Type: application/json' \
  -d '{"input":{"title":"Hide store notice","type":"css","code":".woocommerce-store-notice{display:none}"}}'

GET /wp-json/wp-abilities/v1/abilities lists every ability the signed-in user can see. While the setting is off, Snipfire's abilities aren't in that list.

For your own code, Snipfire's REST API and WP-CLI do everything the abilities do and more.

For add-on developers

Add your own abilities to the snipfire category on the snipfire_abilities action, and use Snipfire\Abilities::meta() so they follow the AI assistants setting. See PHP hooks.

Something unclear or missing? Tell us