WordPress Abilities API Best Practices: 9 Design Rules From Shipping 53 AI Tools
An ability can pass every test, satisfy its JSON Schema and have a hardened permission_callback, and still be a bad ability, because the model will not pick it, picks it for the wrong job, or calls it four hundred times in a row. We ship a commercial MCP server with 32 mail tools and up to 21 calendar tools on live customer mailboxes. Here are the nine design rules that surface bought us, each translated into runnable wp_register_ability() code.