About this plugin
Npcink Abilities Toolkit gives your WordPress site a safe toolbox for AI clients: an AI assistant or host product can read articles, media, comments, menus, and site diagnostics, and prepare reviewed suggestions for tags, excerpts, and media metadata.
Every write-like ability is a preview by default. A real change only happens after your host product approves the commit, and the approval decision and the audit trail stay with the host, never with this plugin.
After activation, open Tools -> AI Ability Set to see at a glance what AI clients can do on this site: which abilities are available, which are read-only, and which would require approval from a host product before anything changes. The page is built for site operators first.
For developers and host runtimes, the plugin also provides ability registration helpers, category helpers, schema normalization, annotation normalization, REST discovery values, and optional canonical projection for Npcink AI when Npcink AI is installed.
It can be used by any WordPress plugin or client that consumes the WordPress Abilities API. Npcink AI is one optional consumer, not the owner of this plugin.
The plugin does not run AI models, execute workflows, route prompts, contact model providers, manage billing or quotas, own MCP governance, or approve final WordPress writes.
Read-only host composition recipe metadata may document how hosts can compose abilities, but those records do not run queues, schedule jobs, execute workflows, or create a second registry. Host composition recipe metadata is available through read-only helpers and Abilities API discovery abilities for hosts that need catalog discovery without execution ownership.
Bundled starter locale files are limited to translations intentionally maintained in this repository. Incomplete bundled locale packs are removed until they can be maintained as complete starter translations. org/GlotPress and are not runtime authority owned by this plugin.
External Services and Remote Requests
This plugin does not automatically contact Npcink AI, model providers, analytics services, tracking services, or cloud services.
Some abilities can prepare request payloads for a separate host or cloud add-on, but this plugin does not send those payloads to an external service by itself.
The npcink-abilities-toolkit/upload-media-from-url ability is inert as a dry-run preview unless a separate authenticated host supplies approval context and commits the operation. When an approved host runtime commits that ability, WordPress sends an HTTP request to the caller-provided URL in order to fetch the media file for the local media library. The remote endpoint is chosen by the caller, not by this plugin.
This plugin stores no provider credentials or remote-service configuration for that ability. This is not provider routing, cloud execution, or stored external-service configuration.
Requirements
- WordPress 6.9 or later. WordPress 6.9 introduced the Abilities API used by this plugin.
- PHP 8.0 or later.
- The WordPress Abilities API REST routes must be available before third-party
provider plugins or external clients can discover and run abilities.
Public API
- npcink_abilities_toolkit_register_category( $category_id, $args )
- npcink_abilities_toolkit_register_readonly( $ability_id, $definition )
- npcink_abilities_toolkit_register_write_proposal( $ability_id, $definition )
- npcink_abilities_toolkit_normalize_schema( $schema, $default_type )
- npcink_abilities_toolkit_normalize_annotations( $annotations, $risk_level )
- npcink_abilities_toolkit_get_registered()
- npcink_abilities_toolkit_get_workflow_definitions()
- npcink_abilities_toolkit_get_workflow_definition( $recipe_id )
The workflow definition helpers return read-only recipe metadata for host-side composition. They are not a workflow registry, execution engine, scheduler, approval store, audit store, model router, prompt registry, or final write authority.
Third-Party Integration Quickstart
Provider plugins should wait until plugins_loaded, check that the public
helper exists, and then register their abilities through the helper functions:
if ( function_exists( 'npcink_abilities_toolkit_register_readonly' ) ) { npcink_abilities_toolkit_register_readonly( 'acme/site-summary', $definition ); }
Do not include files from this plugin’s includes/ directory or instantiate
classes in the Npcink_Abilities_Toolkit namespace. Those are implementation
details.
Use npcink_abilities_toolkit_register_readonly() for read-only context and
diagnostic abilities. Use npcink_abilities_toolkit_register_write_proposal()
only when the callback returns a proposal, preview, diff, or handoff payload.
Third-party provider callbacks should not perform final host-governed commits.
Approval, audit, quota, and final write authorization belong to the consuming
host runtime.
REST clients should first discover the catalog through:
- /wp-json/wp-abilities/v1/categories
- /wp-json/wp-abilities/v1/abilities
- /wp-json/wp-abilities/v1/abilities/{namespace}/{name}/run
- /wp-json/npcink-abilities-toolkit/v1/contract
The contract endpoint is a compatibility and boundary discovery endpoint for
authenticated host runtimes. It does not replace the WordPress Abilities API
catalog and does not run abilities.
Full provider examples and REST client notes are maintained in the public
repository:
com/npcink/npcink-abilities-toolkit
If the wp-abilities/v1 REST routes are missing, enable the WordPress
Abilities API baseline or compatibility plugin before connecting third-party
providers or clients.
Admin Page
After activation with a Npcink AI host plugin, open Npcink AI -> AI Ability Set in wp-admin. When this standalone package is installed without a Npcink AI host menu, open Tools -> AI Ability Set instead.
The page is designed for site operators first: it shows site ability status, the ability package list with write safeguards, plain-language capability groups, and next actions. Under Developer Tools, the Checks view can run two official read-only checks: site info and bounded redacted diagnostics summary, explaining what each check proves and what it does not prove before it runs. Check results are shown as a plain summary table, with raw JSON kept behind a support disclosure.
The Connection view keeps copyable REST endpoint values, raw discovery fetches, and ability ID export available for host/client setup. It does not run showcase workflows, model calls, write abilities, approval flows, or demo abilities. The Tools -> AI Ability Set page remains the standalone surface when no Npcink AI host menu is active; host detection must not create approval, quota, audit, or workflow control-plane behavior in this plugin.
Built-In Abilities
The plugin includes migrated low-risk WordPress read abilities, deterministic comment helpers, and host-governed WordPress write/destructive abilities using canonical npcink-abilities-toolkit/* ids.
It also includes npcink-abilities-toolkit/wp-diagnostics-summary, a redacted WordPress-only diagnostics summary for Abilities API clients. This summary intentionally omits Npcink AI settings, MCP settings, API keys, database names, table prefixes, filesystem paths, error logs, and external HTTP probes.
It also includes npcink-abilities-toolkit/search-posts and npcink-abilities-toolkit/search-post-meta, bounded local WordPress search helpers for keyword and explicit post-meta discovery. These are read-only helpers and do not call external search indexes or mutate content.
It also includes npcink-abilities-toolkit/list-workflow-recipes and npcink-abilities-toolkit/get-workflow-recipe, read-only host composition recipe metadata discovery abilities. These expose metadata only and do not execute workflow runtime behavior.
Core governance handoff docs include a catalog snapshot, permission matrix, and schema boundary audit for hosts that consume this plugin through npcink-ai-core.
Source-level verification commands for contributors are documented in the public repository’s README and CONTRIBUTING files.