How to Register Custom WooCommerce Abilities for the WordPress MCP Adapter

Summary

A developer’s guide to the new WordPress Abilities API. Learn how to use wp_register_ability() to expose WooCommerce data to AI agents, define input schemas, and implement strict permission callbacks for secure AI-driven commerce.

Details

In our previous post about the Business of AI Agents, we explained why you need an “Agent-First” store. Today, we are going to show you how we actually build it at WPRobo.

The magic of the Model Context Protocol (MCP) lies in a new WordPress Core feature: the Abilities API.

Out of the box, the MCP Adapter is just a bridge. It doesn’t know what “Sales” or “Stock” are. As developers, we have to teach it. We do this by registering “Abilities”—atomic units of logic that AI agents can execute.

Here is a practical example of how we create a custom “Stock Check” ability for our WooCommerce clients.

The Core Function: wp_register_ability()

We don’t hack core files. We use the standardized registration system introduced in the AI Building Blocks initiative.

Here is the code structure we use to let an AI Agent (like Claude) find low-stock products:

[php]
<?php 

add_action( 'wp_abilities_api_init', function() {
    wp_register_ability( 'wprobo/woo-get-low-stock', [
        'label'       => 'Get Low Stock Products',
        'description' => 'Retrieves a list of products where stock is below a specific threshold.',
        
        // 1. Define the Input Schema (What the AI must send us)
        'input_schema' => [
            'type'       => 'object',
            'properties' => [
                'threshold' => [
                    'type'        => 'integer',
                    'description' => 'The stock quantity to check against (e.g., 5).',
                    'default'     => 10,
                ],
            ],
        ],

        // 2. Define the Output Schema (What we send back to the AI)
        'output_schema' => [
            'type'  => 'array',
            'items' => [
                'type' => 'object',
                'properties' => [
                    'id'   => ['type' => 'integer'],
                    'name' => ['type' => 'string'],
                    'stock_quantity' => ['type' => 'integer'],
                ]
            ]
        ],

        // 3. The Logic (The actual work)
        'execute_callback' => function( $args ) {
            $query_args = [
                'status' => 'publish',
                'limit'  => -1,
                'stock_quantity' => $args['threshold'],
                'stock_status'   => 'instock',
                'manage_stock'   => true,
            ];
            $products = wc_get_products( $query_args );
            
            return array_map( function($p) {
                return [
                    'id' => $p->get_id(),
                    'name' => $p->get_name(),
                    'stock_quantity' => $p->get_stock_quantity(),
                ];
            }, $products );
        },

        // 4. Security (Crucial for Enterprise)
        'permission_callback' => function() {
            return current_user_can( 'manage_woocommerce' );
        }
    ]);
});

?>
[/php]

Why This Structure Matters

Notice the four key parts:

1. Input Schema: We force the AI to send structured data (an integer). It can’t just “guess.”
2. Output Schema: We strictly define what data leaves the server. This prevents the AI from accidentally reading sensitive metadata.
3. Execute Callback: This is standard WooCommerce PHP. If you can code a plugin, you can code an Ability.
4. Permission Callback: This is the most important part. Even if an AI connects, it cannot run this function unless the authenticated user (via Application Password) has manage_woocommerce rights.

Beyond Read-Only: The “Action” Abilities

Reading data is useful, but acting is powerful. At WPRobo, we also register abilities like wprobo/woo-create-coupon. Imagine an AI that notices a customer had a bad shipping experience (via a support ticket) and automatically generates a unique $10 apology coupon and emails it to them.

That is not just automation; that is “Intelligent Remediation.”

Testing Your Abilities

Once registered, these abilities appear instantly in any MCP-compatible client. We typically test using Claude Desktop or the WP-CLI command: wp mcp serve --server=default

This transparency allows us to debug exactly what the AI “sees” before we hand the keys over to the client.

Reference URLs

• Developer Documentation: Registering Abilities
• WooCommerce CRUD Methods (Official)
• JSON Schema Specification