Npcink

<p>Npcink Abilities Toolkit provides a standalone toolkit for plugin authors who want to expose safe, agent-callable abilities through the WordPress Abilities API.</p>
<p>The plugin owns ability registration helpers, category helpers, schema normalization, annotation normalization, and optional canonical projection for Npcink AI when Npcink AI is installed.</p>
<p>It can be used by any WordPress plugin or client that consumes the WordPress Abilities API. Npcink AI is one optional consumer, not the owner of this plugin.</p>
<p>It does not own model routing, cloud execution, billing, quota, workflow runtime, MCP governance, or final write approval/governance.</p>
<p>Read-only host composition recipe metadata may document how hosts can compose abilities, but those records do not run queues, schedule jobs, execute workflows, or create a second registry.</p>
<p>Host composition recipe metadata is available through read-only helpers and Abilities API discovery abilities for hosts that need catalog discovery without execution ownership.</p>
<h3>External Services and Remote Requests</h3>
<p>This plugin does not automatically contact Npcink AI, model providers, analytics services, tracking services, or cloud services.</p>
<p>Some abilities can prepare request payloads for a separate host or cloud add-on, but this plugin does not send those payloads to an external service by itself.</p>
<p>The <code>npcink-abilities-toolkit/upload-media-from-url</code> ability can download a media file from a URL provided by an authenticated caller when an approved host runtime commits that ability. In that case WordPress sends an HTTP request to the caller-provided URL in order to fetch the media file for the local media library. The remote endpoint is chosen by the caller, not by this plugin.</p>
<h3>Requirements</h3>
<ul>
<li>WordPress 7.0 or later. This release intentionally targets the WordPress Abilities API baseline available in WordPress 7.0+.</li>
<li>PHP 8.0 or later.</li>
</ul>
<h3>Public API</h3>
<ul>
<li><code>npcink_abilities_toolkit_register_category( $category_id, $args )</code></li>
<li><code>npcink_abilities_toolkit_register_readonly( $ability_id, $definition )</code></li>
<li><code>npcink_abilities_toolkit_register_write_proposal( $ability_id, $definition )</code></li>
<li><code>npcink_abilities_toolkit_normalize_schema( $schema, $default_type )</code></li>
<li><code>npcink_abilities_toolkit_normalize_annotations( $annotations, $risk_level )</code></li>
<li><code>npcink_abilities_toolkit_get_registered()</code></li>
<li><code>npcink_abilities_toolkit_get_workflow_definitions()</code></li>
<li><code>npcink_abilities_toolkit_get_workflow_definition( $recipe_id )</code></li>
</ul>
<h3>Admin Page</h3>
<p>After activation with a Npcink AI host plugin, open Npcink AI -> Abilities in wp-admin. When this standalone package is installed without a Npcink AI host menu, open Tools -> Abilities API Packages instead.</p>
<p>The page verifies Abilities API availability, shows the registered ability catalog, provides copyable REST endpoint values for host/client setup, and can run two official read-only checks: site info and bounded redacted diagnostics summary. It is a connection and discovery surface; it does not run showcase workflows, model calls, write abilities, or demo abilities.</p>
<h3>Built-In Abilities</h3>
<p>The plugin includes migrated low-risk WordPress read abilities, deterministic comment helpers, and host-governed WordPress write/destructive abilities using canonical <code>npcink-abilities-toolkit/*</code> ids.</p>
<p>It also includes <code>npcink-abilities-toolkit/wp-diagnostics-summary</code>, a redacted WordPress-only diagnostics summary for Abilities API clients. This summary intentionally omits Npcink AI settings, MCP settings, API keys, database names, table prefixes, filesystem paths, error logs, and external HTTP probes.</p>
<p>It also includes <code>npcink-abilities-toolkit/search-posts</code> and <code>npcink-abilities-toolkit/search-post-meta</code>, bounded local WordPress search helpers for keyword and explicit post-meta discovery. These are read-only helpers and do not call external search indexes or mutate content.</p>
<p>It also includes <code>npcink-abilities-toolkit/list-workflow-recipes</code> and <code>npcink-abilities-toolkit/get-workflow-recipe</code>, read-only host composition recipe metadata discovery abilities. These expose metadata only and do not execute workflow runtime behavior.</p>
<p>Core governance handoff docs include a catalog snapshot, permission matrix, and schema boundary audit for hosts that consume this plugin through <code>npcink-ai-core</code>.</p>
<h3>Developer Verification</h3>
<p>When the plugin is installed in a local WordPress site, run:</p>
<pre><code>WP_PATH=/path/to/wordpress composer smoke:wp
</code></pre>
<p>For isolated bounded-chain performance validation, run:</p>
<pre><code>composer perf:smoke
</code></pre>


Npcink Abilities Toolkit

Standalone WordPress Abilities API package toolkit for registering agent-callable abilities.

miniOrange

<p>miniOrange Secure MCP Server helps WordPress administrators with AI governance and policy enforcement: understanding, and controlling, what AI assistants and MCP clients are allowed to do on their site.</p>
<p>The WordPress Abilities API (available in WordPress 6.9 and later) lets plugins and WordPress core expose discrete, machine-callable capabilities — for example: get site info, create a post, or generate a summary. This plugin turns those abilities into a remote <strong>Model Context Protocol (MCP)</strong> server so AI clients can discover and invoke them, protected by a self-hosted OAuth 2.1 authorization server.</p>
<p><strong>What this version does</strong></p>
<ul>
<li><strong>Abilities viewer.</strong> A read-only admin screen (in the Secure MCP Server menu) that lists every ability registered on your site, with its label, description, category, source namespace, and full input/output JSON schema.</li>
<li><strong>Connection guide.</strong> A “Connect to AI” tab with step-by-step instructions and your site’s MCP URL for connecting clients such as ChatGPT and Claude.</li>
<li><strong>Built-in content abilities.</strong> Create Post and Update Post abilities (exposed as MCP tools) so connected clients can draft and edit posts, gated by the user’s capabilities.</li>
<li><strong>MCP server.</strong> A single Streamable HTTP endpoint that exposes every registered ability as an MCP tool. Tool calls run through the Abilities API, so each ability’s own permission check still applies.</li>
<li><strong>Self-hosted dynamic OAuth.</strong> WordPress acts as its own OAuth 2.1 authorization server with OAuth 2.0 Dynamic Client Registration (RFC 7591), Protected Resource Metadata (RFC 9728), Authorization Server Metadata (RFC 8414), and Authorization Code flow with PKCE. Clients such as ChatGPT and Claude can register themselves and connect with no manual credential setup.</li>
</ul>
<p>Every MCP request runs as the WordPress user who authorized it, so what an AI client can do is bounded by that user’s own capabilities.</p>


miniOrange Secure MCP Server

AI governance for WordPress: expose your Abilities API as a secure, OAuth-protected MCP server for AI clients like ChatGPT and Claude.

Npcink Abilities Toolkit vs miniOrange Secure MCP Server