Introduction
What Ability Auditor does#
WordPress 6.9 introduced the Abilities API: a way for plugins and themes to expose actions (called abilities) to the REST API, to MCP servers and to AI agents. Each ability has a permission_callback that decides who may run it. Flags such as show_in_rest, public and mcp.public decide who can see an ability, but they are not security. If the permission check is weak, anyone who can reach the ability can run it.
Ability Auditor reads every registered ability and grades it. It answers four questions:
- Who can run it? The permission check is called as a simulated Anonymous visitor, Subscriber, Contributor, Author, Editor, Shop manager (when WooCommerce is installed) and Administrator.
- Who can reach it? The effective REST and MCP exposure, and whether each value is explicit, inherited from
public, or a default. - What does it say about itself? Read-only, destructive and idempotent annotations, input and output schemas, category and description.
- Who owns it? The plugin, theme or core component whose code defines the ability.
Problems are reported as findings with a severity from Critical to Info, a plain-language explanation of why it matters, and advice on how to fix it.
It never executes an ability#
This is the most important thing to know. Ability Auditor only reads ability definitions and calls permission checks as in-memory users that are never saved to the database. An execution guard blocks any attempt to run an ability while an audit is running, and the report warns you if a permission callback tried.
Who it is for#
- Site owners and agencies who want to know whether the plugins they installed opened anything up to AI agents or the REST API.
- Plugin and theme developers who want to check their own abilities before release, locally and in CI.
- Security reviewers who need a printable report for a client.
What it is best at#
- Catching abilities that visitors or subscribers can run.
- Catching destructive abilities that are exposed to REST or MCP.
- Showing exactly who can run what, in a single role matrix.
- Watching for new problems after plugin updates and emailing you only when something new appears.
Next steps#
- Check the Requirements.
- Follow the Installation and License steps.
- Run your first audit with the Quick Start.