AI agents can now write and edit content on this website — safely. Not through screen-scraping or an all-powerful admin account, but through a narrow, capability-checked interface built on the Model Context Protocol (MCP) and the WordPress Abilities API. This article explains how the setup works — and was itself authored through it.
Large language models are becoming genuinely useful co-workers for content teams: they can draft news articles, restructure layouts, translate posts and keep taxonomies tidy. The hard question is not whether an AI can write — it is how to let an agent touch a production CMS without handing it the keys to everything.
The approach described here emerged from a collaboration between the communications agency Partner & Partner and baseVISION — prototyped remarkably quickly, in a late-night working session between Yves Schürch and Lawrence Markwalder.
The building blocks: MCP and the WordPress Abilities API
The Model Context Protocol is an open standard that lets AI clients such as Claude Code or Codex talk to external systems through well-defined tools. On the WordPress side, recent core versions ship the Abilities API: a registry where a site declares discrete, named capabilities — each with a schema, a description and, crucially, a permission callback.
The MCP Adapter plugin bridges the two worlds. It exposes a default MCP server — reachable over HTTP at the site’s REST endpoint or over STDIO via WP-CLI — with just three meta-tools: discover the available abilities, inspect one ability’s schema, and execute one. Individual abilities are never top-level tools; everything runs through that single, auditable execution layer, and an ability only appears at all if it has been explicitly marked MCP-public.
On this site, the authoring surface consists of a small set of custom abilities: create and update posts, splice blocks into an existing layout, browse and upload media, set featured images, assign taxonomy terms and write a whitelist of ACF fields. Reads require edit rights; every write is checked against the acting user’s real WordPress capabilities on the specific post.
A safety model built on real capabilities
The security model deliberately avoids inventing a parallel permission system. Instead, it leans on what WordPress already does well:
- A dedicated agent user with the Editor role. The agent authenticates as its own WordPress user, and that account’s capabilities are the hard ceiling: it can author content and upload media, but cannot manage plugins, users or settings.
- Every write ability checks a real capability. No permission callback ever simply returns true; per-post edits are checked against that specific post.
- A deletion guard. A small mu-style guard converts permanent deletes of content into “move to bin”, so even a confused agent cannot destroy content irreversibly — emptying the bin remains a human decision.
- The REST API stays locked. The site restricts REST access to authenticated users; the MCP route is deliberately not whitelisted for anonymous access.
- Draft first. The convention for agents is to create content as drafts and let a human publish.
Validation goes beyond permissions. The content model itself is enforced by the abilities: a news post only accepts news_type terms, a service only accepts its solution and journey taxonomies, and ACF writes are limited to a per-type whitelist of fields. An agent that tries to write the wrong field to the wrong content type simply gets an error.
Teaching the agent the house style
Permissions keep an agent safe; they do not make it good. The second half of the setup is onboarding. The MCP server greets every connecting client with short instructions pointing to a dedicated ability that returns the site’s full authoring guide — a human-editable Markdown document describing the content types, which theme blocks to use when, the block-markup rules and the standard workflow. Every other authoring ability carries the same nudge: read the guide before you build.
The guide encodes practical lessons from real agent sessions — for example, how to start a new post from a synced starter pattern and detach it in the same step, so a human editor never has to click through a locked template instance. Because the guide lives in the theme as plain Markdown, refining it is a normal content task, and every future agent session benefits immediately.
The result is a workflow where the agent discovers the abilities, reads the guide, composes block markup in the theme’s own design system, uploads media, assigns the right taxonomy — and leaves a draft for a human to review. Exactly the way this article reached the editorial queue.
The advantages at a glance
Images: Cash Macanaya and Towfiqu barbhuiya via Unsplash.