Ibrahim

Tessera is a developer library for plugin authors who register abilities via <code>wp_register_ability()</code> and want snapshot capture, audit logging, approval workflows, and one-click rollback for every invocation across REST, MCP, internal PHP, and WP-CLI without building it themselves.
Declare what state your ability touches; Tessera handles the safety wrapper.
<h4>What you get out of the box</h4>
<ul>
<li>Pre + post snapshots. Every safety-enabled invocation captures declared state before the callback and (on success) after, so the audit log can show a real diff.</li>
<li>Audit log. One row per invocation with ability name, caller (REST/MCP/CLI/internal), user, args, result, status, duration, pre/post hashes, and parent_invocation_id for nested calls.</li>
<li>One-click rollback. Restore captured state from post_meta, options, taxonomy term assignments, user roles + caps. File contents support tiered drift detection (mtime / mtime_size / critical_hash / full_hash) plus opt-in real byte-level rollback via <code>full_content</code> strategy.</li>
<li>Drift check on rollback. Live state is hashed and compared to the snapshot’s post-state before restoring; if they differ the rollback returns an error unless forced.</li>
<li>Concurrency lock. Capture + execute is serialised per surface set via a MySQL advisory lock so two simultaneous invocations do not capture each other’s mid-states.</li>
<li>Encrypted redaction. Scrub secrets out of args, results, and snapshots. Stores redacted values as AES-256-GCM envelopes so rollback can still restore them.</li>
<li>Approval queue. When <code>safety.requires_approval</code> is set, the wrapper blocks execution and returns a 202 pending response. A human approves or rejects via wp-admin, WP-CLI, or REST. Multi-stage sequential or parallel approval chains are supported.</li>
<li>Multisite support. Each subsite gets its own set of <code>wp_<N>_abilityguard_*</code> tables, with auto-install on <code>wp_initialize_site</code> and auto-drop on <code>wpmu_drop_tables</code>.</li>
<li>Retention. Daily WP-Cron prunes old log rows (defaults: 30 days normal, 180 days destructive) and orphaned snapshots.</li>
</ul>
<h4>Surfaces</h4>
<ul>
<li>PHP API with <code>wp_register_ability( $name, [ ..., 'safety' => [...] ] )</code> and helpers <code>abilityguard_rollback</code>, <code>abilityguard_snapshot_meta</code>, <code>abilityguard_snapshot_options</code>.</li>
<li>REST: <code>/abilityguard/v1/log</code>, <code>/log/<id></code>, <code>/log/export</code>, <code>/rollback/<id></code>, <code>/rollback/bulk</code>, <code>/approval</code>, <code>/approval/<id>/approve</code>, <code>/approval/<id>/reject</code>, <code>/approval/bulk</code>, <code>/approval/export</code>, <code>/retention</code>, <code>/retention/prune</code>, <code>/health</code>.</li>
<li>WP-CLI: <code>wp abilityguard log list/show</code>, <code>wp abilityguard rollback <id></code>, <code>wp abilityguard approval list/approve/reject <id></code>, <code>wp abilityguard prune</code>.</li>
<li>wp-admin: Tools > Tessera. Hybrid timeline + command-palette search, snapshot drawer, JSON-highlighted Input/Result tabs, invocation chain navigation, and real rollback against the captured snapshot.</li>
</ul>
<h4>Example</h4>
<pre><code>wp_register_ability( 'my-plugin/update-product-price', array(
 'label' => 'Update product price',
 'description' => 'Updates the price on a WooCommerce product.',
 'category' => 'woocommerce',
 'input_schema' => array( /* ... */ ),
 'permission_callback' => fn() => current_user_can( 'manage_woocommerce' ),
 'execute_callback' => fn( $args ) => update_post_meta( $args['product_id'], '_price', $args['price'] ),
 'safety' => array(
 'destructive' => true,
 'requires_approval' => false,
 'snapshot' => fn( $input ) => array(
 'post_meta' => array( $input['product_id'] => array( '_price', '_regular_price' ) ),
 'options' => array( 'woocommerce_last_price_change' ),
 ),
 ),
) );
</code></pre>
<h4>Documentation</h4>
Full plugin-author documentation lives at the GitHub repo: https://github.com/ibrahimhajjaj/abilityguard
<h3>Source Code</h3>
The full source for Tessera, including the unminified React source for the admin app, lives on GitHub: https://github.com/ibrahimhajjaj/abilityguard
<ul>
<li>The admin bundle <code>assets/admin.js</code> is compiled from <code>assets/admin.jsx</code> (React + JSX, no preprocessor magic beyond JSX).</li>
<li>The bundler is <a href="https://esbuild.github.io/" rel="nofollow ugc">esbuild</a>, configured in <code>scripts/build.mjs</code>.</li>
<li>To rebuild the admin bundle from a fresh checkout, run <code>npm install</code> once, then <code>npm run build</code> whenever <code>assets/admin.jsx</code> changes. This regenerates <code>assets/admin.js</code> in place.</li>
<li>The release zip published to the WordPress.org directory is produced by <code>scripts/build-release.sh</code>, which excludes development artifacts (tests, examples, build configs) but keeps everything required for the plugin to run.</li>
</ul>

Tessera for the Abilities API

Snapshot, audit, and rollback layer for plugins that register abilities via the WordPress Abilities API.

Azizul Hasan

AtlasAiDev

AI Agent Hub is the most complete AI integration plugin for WordPress. It provides 80+ abilities across 10 modules, a built-in MCP (Model Context Protocol) server for AI agent connectivity, AI experiments directly in the Gutenberg block editor, role-based access control, JWT authentication, a workflow builder, and full WooCommerce support.
<h4>Highlights</h4>
<ul>
<li>80+ registered abilities covering posts, pages, media, users, custom post types, REST API discovery, site diagnostics, WordPress settings, WooCommerce, and AI-powered content analysis.</li>
<li>11 independently toggleable modules – enable only what you need.</li>
<li>Error Debugger – Monitor PHP errors in real time, receive email alerts with a one-click fix command, and fix errors directly from your AI assistant via MCP (Pro).</li>
<li>AI Experiments in the Block Editor – Generate excerpts, feature images, and more directly from the post editor with multi-provider AI support.</li>
<li>Built-in MCP server – expose abilities as tools, resources, and prompts to AI agents over JSON-RPC 2.0.</li>
<li>External Abilities – automatically discovers and integrates abilities from WordPress core and third-party plugins via the Abilities API.</li>
<li>JWT authentication – secure MCP and REST API access with token-based auth.</li>
<li>Workflow builder – combine abilities into reusable workflows from the admin dashboard or the post editor meta box.</li>
<li>Multi-provider AI – connect OpenAI, Google Gemini, or Anthropic Claude via the WordPress AI Client.</li>
<li>Role-based access control – assign abilities per WordPress role so each MCP connection only exposes what that user is allowed to use.</li>
<li>Backward compatible – bundles the WordPress Abilities API and MCP Adapter as vendor dependencies, so it works on WordPress 6.8+ (not just 6.9+ where these APIs ship in core).</li>
</ul>
<h4>AI Agent Hub Pro</h4>
Unlock the full power of AI Agent Hub with <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>:
<ul>
<li>Unlimited Workflows – Create unlimited MCP workflows (free: 3 max).</li>
<li>T/R/P Access Modes – Granular per-ability Tool/Resource/Prompt toggles for fine-grained MCP control.</li>
<li>Advanced AI Experiments – Templates library, batch generation mode, explain AI reasoning, generation history, and keyboard shortcuts.</li>
<li>Workflow Prompt Builders – 6 pre-built prompt builder workflows (SEO Audit, Content Brief, Site Overview, and more).</li>
<li>External Abilities – Discover and expose third-party plugin abilities via the Abilities API.</li>
<li>Per-Ability RBAC – Assign individual abilities (not just modules) to each WordPress role.</li>
<li>MCP Fix Command – Error emails include a ready-to-paste MCP command that lets your AI assistant read, analyse, and fix the error with one paste — automatic backup included.</li>
<li>Webhook Notifications – Send error alerts to Slack, Discord, or a custom webhook.</li>
<li>Backups Manager – All AI-applied fixes are backed up automatically; restore any backup with one click.</li>
<li>Priority Support – Direct support from the development team.</li>
</ul>
<a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">Upgrade to Pro</a>
<h4>Modules</h4>
Each module can be independently enabled or disabled from the AI Agent Hub dashboard.
<h4>1. AI Content Steward (8 abilities)</h4>
AI-powered content analysis, generation, and improvement for posts and pages.
<h4>2. Posts Manager (13 abilities)</h4>
Full CRUD for WordPress posts, categories, and tags.
<h4>3. Pages Manager (5 abilities)</h4>
CRUD operations for WordPress pages.
<h4>4. Media Manager (7 abilities)</h4>
Upload, update, and manage media files.
<h4>5. Users Manager (7 abilities)</h4>
Search, create, and manage WordPress users.
<h4>6. Custom Post Types Manager (6 abilities)</h4>
CRUD operations for any registered custom post type.
<h4>7. REST API Tools (3 abilities)</h4>
Discover and execute any WordPress REST API endpoint dynamically.
<h4>8. Site Info & Diagnostics (4 abilities)</h4>
View site info, plugins, themes, and users at a glance.
<h4>9. Settings Manager (3 abilities)</h4>
View and update WordPress site settings.
<h4>10. AI Store Manager – WooCommerce (24 abilities)</h4>
Full WooCommerce management through AI. Requires WooCommerce to be active.
<ul>
<li>Products: search, get, add, update, delete.</li>
<li>Product categories: list, add, update, delete.</li>
<li>Product tags: list, add, update, delete.</li>
<li>Product brands: list, add, update, delete.</li>
<li>Orders: search.</li>
<li>Reports: coupons totals, customers totals, orders totals, products totals, reviews totals, sales.</li>
</ul>
<h4>11. Error Debugger</h4>
Monitor PHP errors in real time and fix them faster. Works out of the box — no configuration required to start tracking errors.
Free features: 
* Real-time PHP error tracking grouped by file and message. 
* Email notifications for errors in plugins and themes — configurable recipient, severity levels, and rate limit. 
* Fix Command in every email — a pre-filled text snippet you can paste into any AI assistant to get fix instructions. 
* Admin dashboard widget showing the last 5 errors and a 24-hour error count. 
* Debug log scanner catches errors that occur before the plugin loads (e.g. fatal parse errors during activation).
Pro features (requires AI Agent Hub Pro): 
* MCP Fix Command — paste directly into Claude Desktop, Cursor, or any connected MCP client. The AI reads the file, suggests a fix, creates a backup, and applies it. 
* Webhook notifications — send error alerts to Slack, Discord, or a custom URL. 
* Backups Manager — all AI-applied fixes are backed up; restore any backup with one click. 
* Extended error sources — monitor WordPress Core, MU-Plugins, and Drop-ins in addition to plugins and themes.
<h4>Coming Soon</h4>
<ul>
<li>AI Support Desk – Summarize comment threads, suggest reply drafts, categorize support requests.</li>
<li>AI Automation Recipes / Workflows – Rule-based AI automations triggered by WordPress events.</li>
</ul>
<h4>AI Experiments in the Block Editor</h4>
AI Agent Hub adds AI-powered experiment panels directly into the WordPress block editor:
<ul>
<li>Excerpt Generation – Generate SEO-friendly excerpts from post content with one click. Appears in the post sidebar excerpt panel.</li>
<li>Image Generation – Generate AI feature images from post content. Integrated into the Featured Image panel.</li>
</ul>
With <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>, experiments gain advanced features: prompt templates library, batch generation mode, “Explain This Generation” reasoning, generation history, and keyboard shortcuts.
<h4>Error Debugger</h4>
The Error Debugger module monitors PHP errors on your WordPress site and helps you fix them faster.
How it works:
<ol>
<li>Enable the Error Debugger module from the AI Agent Hub dashboard.</li>
<li>Optionally enable Email Notifications and configure the recipient address, severity levels, and rate limit.</li>
<li>When a PHP error occurs in a plugin or theme, an email is sent with full error details and a How to Fix block.</li>
<li>Copy the fix command from the email and paste it into your AI assistant to get step-by-step fix instructions.</li>
</ol>
Free fix flow: 
Copy the pre-filled text from the email → paste into ChatGPT, Claude, Gemini, or any AI chat → the AI explains the error and how to fix it.
Pro fix flow (MCP): 
Copy the MCP command block from the email → paste into Claude Desktop, Cursor, or any MCP client connected to your site → the AI reads the file, suggests a fix, creates a backup, and applies it automatically.
Admin dashboard widget: 
When the Error Debugger module is active, a “AI Agent Hub — Recent Errors” widget appears on the WordPress admin dashboard showing the last 5 errors and a 24-hour error count. You can disable the widget from the Error Debugger settings without disabling the module.
<h4>Connecting AI Agents via MCP</h4>
AI Agent Hub includes a built-in MCP (Model Context Protocol) server that lets external AI agents interact with your WordPress site. The MCP endpoint is:
<pre><code>https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Any MCP-compatible AI client can connect and use all enabled abilities as tools, resources, and prompts.
<h4>Post Editor Meta Box</h4>
On every post and page edit screen, the AI Content Steward meta box provides:
<ul>
<li>Provider selection (Auto, OpenAI, Gemini, Claude).</li>
<li>Ability checkboxes to select which analyses to run.</li>
<li>Editable prompt preview that updates as you select abilities.</li>
<li>One-click workflow execution.</li>
<li>Save workflows for reuse.</li>
</ul>
<h3>Connecting AI Agents</h3>
<h4>Claude Desktop</h4>
Claude Desktop supports MCP servers natively. To connect it to your WordPress site:
Step 1: Generate a JWT token
Send a POST request to your site to get a JWT token:
<pre><code>curl -X POST "https://your-site.com/wp-json/jwt-auth/v1/token" -H "Content-Type: application/json" -d "{\"username\":\"your-username\",\"password\":\"your-password\",\"expires_in\":2592000}"
</code></pre>
This returns a token valid for 30 days (2592000 seconds). Copy the <code>token</code> value from the response.
Step 2: Configure Claude Desktop
Open the Claude Desktop config file:
<ul>
<li>Windows: <code>%APPDATA%\Claude\claude_desktop_config.json</code></li>
<li>macOS: <code>~/Library/Application Support/Claude/claude_desktop_config.json</code></li>
</ul>
Add this MCP server entry:
<pre><code>{
 "mcpServers": {
 "wordpress": {
 "command": "npx",
 "args": [
 "-y",
 "@anthropic-ai/mcp-wordpress-remote@latest",
 "--url",
 "https://your-site.com/wp-json/awfah_mcp/mcp"
 ],
 "env": {
 "JWT_TOKEN": "paste-your-jwt-token-here"
 }
 }
 }
}
</code></pre>
Step 3: Restart Claude Desktop
After saving the config, restart Claude Desktop. All enabled abilities will appear as tools. You can then ask Claude to manage posts, pages, media, users, settings, and WooCommerce from natural language.
<h4>Claude Code (CLI)</h4>
Claude Code can also connect to MCP servers. Add the server using:
<pre><code>claude mcp add wordpress -- npx -y @anthropic-ai/mcp-wordpress-remote@latest --url https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Then set the JWT token as an environment variable before running Claude Code:
<pre><code>export JWT_TOKEN="paste-your-jwt-token-here"
</code></pre>
<h4>Cursor / Windsurf / Other MCP Clients</h4>
Any editor or AI tool that supports MCP can connect. The setup is similar:
<ol>
<li>Generate a JWT token (see above).</li>
<li>Point the MCP client to: <code>https://your-site.com/wp-json/awfah_mcp/mcp</code></li>
<li>Use the <code>@anthropic-ai/mcp-wordpress-remote</code> transport package, or configure your client’s native MCP settings with the URL and JWT token.</li>
<li>The authentication header format is: <code>Authorization: Bearer <your-jwt-token></code></li>
</ol>
<h4>Postman / API Testing</h4>
You can test the MCP endpoint directly using Postman or any HTTP client. The MCP protocol uses JSON-RPC 2.0 over HTTP.
Step 1: Initialize a session
Send a POST request to <code>https://your-site.com/wp-json/awfah_mcp/mcp</code> with:
<ul>
<li>Header: <code>Authorization: Bearer <your-jwt-token></code></li>
<li>Header: <code>Content-Type: application/json</code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “id”: 1, 
 “method”: “initialize”, 
 “params”: { 
 “protocolVersion”: “2024-11-05”, 
 “capabilities”: {}, 
 “clientInfo”: { “name”: “postman”, “version”: “1.0” } 
 } 
}</li>
</ul>
Copy the <code>Mcp-Session-Id</code> header from the response.
Step 2: Send initialized notification
Send a POST with the session ID header:
<ul>
<li>Header: <code>Mcp-Session-Id: <session-id-from-step-1></code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “method”: “notifications/initialized” 
}</li>
</ul>
Step 3: Call a tool
Now you can call any ability as a tool:
<pre><code>{
 "jsonrpc": "2.0",
 "id": 2,
 "method": "tools/call",
 "params": {
 "name": "awfah-site-get-site-info",
 "arguments": {}
 }
}
</code></pre>
Note: In MCP tool names, the <code>/</code> in ability IDs is replaced with <code>-</code>. So <code>awfah-site/get-site-info</code> becomes <code>awfah-site-get-site-info</code>.
<h4>JWT Token Management</h4>
AI Agent Hub provides three JWT endpoints:
<ul>
<li>Generate token: <code>POST /wp-json/jwt-auth/v1/token</code> – Pass <code>username</code>, <code>password</code>, and optional <code>expires_in</code> (seconds, min 3600, max 2592000).</li>
<li>List tokens: <code>GET /wp-json/jwt-auth/v1/tokens</code> – List all active tokens (requires authentication).</li>
<li>Revoke token: <code>POST /wp-json/jwt-auth/v1/revoke</code> – Revoke a specific token (requires authentication).</li>
</ul>
Tokens are signed with HS256 using a per-site secret key stored in the <code>awfah_jwt_secret_key</code> option. Each token includes the user ID, issued-at time, expiration, and a unique JTI.
<h4>Role-Based MCP Access</h4>
AI Agent Hub provides role-based access control for MCP connections. This means different WordPress users see different abilities depending on their role.
How it works:
<ol>
<li>An administrator configures which abilities each WordPress role can access via the Access Control tab in the AI Agent Hub dashboard.</li>
<li>When an AI client connects via MCP, it authenticates as a specific WordPress user (using JWT or Application Password).</li>
<li>The plugin checks that user’s role and only exposes the abilities assigned to that role.</li>
<li>The AI client can only see and execute the allowed abilities — everything else is hidden.</li>
</ol>
Example scenarios:
<ul>
<li>Administrator — Full access to all 80+ abilities including post CRUD, site settings, user management, media, WooCommerce, and content analysis.</li>
<li>Editor — Content-focused abilities only (e.g. analyze posts, generate excerpts, suggest titles, focus keywords). No access to site settings, user management, or destructive operations.</li>
<li>Author / Contributor — Can be fully restricted or given a minimal subset of abilities as configured by the site admin.</li>
</ul>
Setting up role-based access:
<ol>
<li>Go to the AI Agent Hub dashboard in WordPress admin.</li>
<li>Click the Access Control tab.</li>
<li>Select a role from the dropdown.</li>
<li>Check or uncheck abilities to grant or revoke access for that role.</li>
<li>Click Save. Changes take effect immediately for all MCP connections using that role.</li>
</ol>
Multiple MCP connections:
You can create multiple MCP connections in your AI client config, each authenticating as a different WordPress user. For example:
<ul>
<li>A “full-access” connection using an administrator account.</li>
<li>A “content-only” connection using an editor account.</li>
</ul>
This lets you switch between permission levels depending on the task at hand.
<h4>Application Passwords (Alternative)</h4>
If you prefer not to use JWT, you can also authenticate with WordPress Application Passwords (available in WordPress 5.6+):
<ol>
<li>Go to Users > Profile > Application Passwords.</li>
<li>Create a new application password.</li>
<li>Use Basic Auth with your username and the application password.</li>
</ol>
However, JWT is recommended for MCP connections as it avoids sending credentials with every request.

MCP Server & AI Experiments – WooCommerce Compatible

AI-powered WordPress hub: 80+ abilities, MCP server, block editor AI experiments, RBAC, JWT auth, and workflows.

Tessera for the Abilities API vs MCP Server & AI Experiments – WooCommerce Compatible