WordPress Abilities API + MCP: The New Foundation for AI-Powered eCommerce

Every major WordPress release brings its share of coverage and WordPress 6.9 was no exception. The WordPress Abilities API got well-covered in developer circles, with tutorials, videos, and writeups explaining how it works under the hood.

But here’s what most of that coverage didn’t fully address: what it means for the future of WordPress eCommerce. And what it looks like when a major WordPress eCommerce plugin actually builds on it end to end.

SureCart was paying close attention. With its latest release, SureCart became one of the first major WordPress eCommerce plugins to ship a full implementation built on this new foundation.

What is the WordPress Abilities API?

To understand why this is significant, you first need to understand the problem it solves.

Every WordPress plugin that exposes functionality does so in its own way — custom REST endpoints, action hooks, filter patterns, admin-ajax handlers. There’s no shared language, no common structure. If a third-party tool wants to integrate with a plugin, it has to reverse-engineer the plugin’s API, read documentation (if it exists), and write custom glue code. Every integration is bespoke.

The WordPress Abilities API changes this. It gives plugins a standardized way to declare what they can do — not just expose endpoints, but register named, described, structured capabilities that anything can discover and understand.

Think of it less like a REST API and more like a capability manifest. Each ability has a name, a human-readable label, a description, a defined set of inputs and outputs, and critical metadata about its nature. Is this action read-only? Could it be destructive? Is it safe to retry? All of that is part of the ability itself, not something a consuming tool has to guess.

The result is a plugin ecosystem where capabilities are self-describing, discoverable, and safe to call by AI and other automations.

What Is MCP (Model Context Protocol) and Why Does It Matter for WordPress Stores?

At the same time WordPress was building the Abilities API, a different standard was gaining momentum in the AI world: the Model Context Protocol, or MCP.

MCP is an open protocol that defines how AI agents discover and call external tools. Instead of every AI integration requiring custom API wiring, MCP creates a common interface — a tool is described with its name, purpose, inputs, and outputs, and any MCP-compatible AI can pick it up and use it.

Claude supports it. Cursor supports it. VS Code, Continue, and a growing list of AI tools support it. And the ecosystem is moving fast.

Now consider what happens when you put these two things together.

The WordPress Abilities API describes what a plugin can do, in a structured, machine-readable format. MCP provides the transport layer to expose those descriptions to AI agents. Connect the two, and you have a direct line from a natural language prompt to a real action inside your WordPress site with no custom code, no bespoke integration, no API documentation to read.

WordPress Plugin → Abilities API → MCP → AI Agent → Store Action

That’s the architecture. And for WordPress eCommerce, it changes nearly everything.

Real Use Cases: AI-Powered Store Management with SureCart

eCommerce stores are full of repetitive, data-heavy tasks, exactly the kind of work AI agents excel at when given a structured, safe way to perform them. Here’s what that looks like when an AI is connected to a SureCart store:

• “Show me all orders that failed payment in the last seven days and tell me the total revenue at risk.” — Your AI pulls the data, aggregates it, and presents it in seconds.
• “Create a 20% off coupon for our top three products, valid through Sunday.” — Done, without opening a single dashboard tab.
• “Which subscriptions are up for renewal this week? Flag any with failed payment methods.” — Your AI cross-references subscription and payment data and gives you a prioritized list.
• “A customer emailed asking to cancel. Look up their account, cancel the subscription, and confirm it’s done.” — The AI handles the lookup, the action, and the confirmation in one go.
• “Duplicate our best-selling product and set the new price to $49.” — Product duplicated, price updated, ready to publish.
• “Generate an invoice for this order and mark it for follow-up.” — Invoice created without touching the dashboard.
• “How did last month’s revenue compare to the month before? Break it down by product.” — Store dashboard data surfaced instantly, no report-building required.

These aren’t edge cases or demo scenarios. These are the everyday operational tasks that consume merchant hours, now handleable through a single prompt.

You Set the Rules. The AI Follows Them.

This isn’t AI with the keys to your store. It’s AI that works entirely within the boundaries you define and only within those boundaries.

SureCart’s implementation gives you granular control over exactly what any AI client is allowed to do. Enable read-only access for an AI you use for reporting. Add editing permissions for handling operations. Keep deletion access switched off entirely unless you need it. Each tier is independent, each is yours to configure, and none of them can be overridden by the AI itself.

On top of that, every ability in the system carries built-in metadata about its own nature — whether it reads or writes data, whether it’s reversible, whether it requires caution. AI tools that support MCP use this information to make intelligent decisions: acting confidently on safe operations and pausing to confirm with you before anything consequential happens.

And underneath all of it, WordPress role and capability checks run on every single execution. The AI operates as the authenticated user with exactly their permissions, nothing more. Your existing access controls don’t change. The AI just works within them, the same as anyone else on your team.

The result isn’t a compromise between power and safety. It’s both, AI that can genuinely handle real store work, bound precisely by the rules you already have in place.

SureCart: The WordPress eCommerce Plugin Already Running on This Foundation

Most WordPress eCommerce plugins haven’t moved on this yet. The WordPress Abilities API is new, the MCP ecosystem is still maturing, and building a comprehensive, production-ready implementation takes real commitment.

SureCart is one of the first major WordPress eCommerce plugins to fully embrace this direction.

Version 4.1.1 laid the foundation, registering a comprehensive set of e-commerce abilities across the full breadth of store operations: products, orders, customers, subscriptions, pricing, promotions, fulfillments, refunds, and more. Version 4.2 made it accessible to every merchant with a dedicated MCP settings page and guided connection flows for the most popular AI tools.

Getting connected takes just a few minutes and SureCart walks you through every step. Head to SureCart → Settings → MCP, install the MCP Adapter with a single click, then set your permission levels: choose whether your AI client can read store data, edit products and pricing, or handle deletions.

SureCart then presents a built-in setup guide for whichever AI tool you use — Claude, Cursor, VS Code, Continue, and more, generating your credentials and providing the exact configuration to paste in.

Once connected, here’s what opens up for your store:

• Natural language store management: Query orders, customers, and subscription data without touching the dashboard
• AI-assisted operations: Let your AI handle routine tasks like issuing refunds, creating coupons, updating product details, or managing fulfillments
• Instant store intelligence: Ask your AI for sales summaries, customer stats, or order trends and get answers in seconds
• Granular control: Grant each AI client only the permissions it needs, nothing more
• Works with the tools you already use: Claude, Cursor, VS Code, Continue, and more supported out of the box

For the full list of what AI can do in your store, see the SureCart Abilities documentation.

For the WordPress ecosystem, it’s a signal. When a platform-level WordPress eCommerce plugin commits fully to a new infrastructure pattern and ships a polished end-to-end experience, it sets a standard for what serious adoption looks like.

The Future of WordPress eCommerce: AI-Powered and Agent-Ready

There’s a version of this story where WordPress stays a publishing platform that happens to sell things. And there’s a version where WordPress becomes the foundation of intelligent, automated commerce where store owners spend less time on operational tasks and more time on the decisions that actually require human judgment.

The WordPress Abilities API, MCP, and the implementations being built on them are the infrastructure that makes the second version possible. Not someday. Now.

The merchants who connect their AI tools to SureCart today aren’t early adopters chasing novelty. They’re building stores on infrastructure that’s going to define how WordPress eCommerce works for years to come.