Abilities and AI agents

On WordPress 6.9 and later, RedeemID registers its own abilities with the WordPress Abilities API. An ability is a described, permission-checked question with a defined input and answer. The abilities REST routes, the JavaScript client and AI agents (through the MCP Adapter plugin) can all ask them. On older WordPress nothing is registered, and nothing else changes.

The use is support work. “Why can’t jane@example.com read the March report?” becomes one question with the same answer the paywall gives, rule layer by rule layer.

Every RedeemID ability only reads. None of them grants access, changes a level, edits a rule or calls Shopify. They read what WordPress has already synced, so Shopify still decides who is entitled.

For staff

These need an administrator (the manage_options capability).

Ability	What it answers
redeemid/explain-access	Can this viewer read this item, and why? Give the item by ID or address, and the viewer as a guest, a signed-in customer with no tags, a level, a set of tags, or a real user. The answer is the same trace as RedeemID → Access → Test: every rule layer, the effective rule, the level a locked viewer is offered, what they see instead, which blocks show, and how search and search engines treat the item.
redeemid/explain-features	Which features the viewer holds, and which route grants or refuses each one.
redeemid/list-levels	Every level: its tag condition, the levels it includes, its badge and products.
redeemid/get-rules	The site default, how term rules combine, each post type and taxonomy row, the meter, and every term rule.
redeemid/get-member	One user’s synced account, by user ID or email: linked or not, status, tags, levels, features, last sync, level history.
redeemid/site-health	The Health checklist, current webhook problems and the last bulk resync. Configuration values are never shown, only whether each is set.
redeemid/level-changes	Who joined or left a level since a date, as wp redeemid access changes lists it.

For members

These need a signed-in user, and only ever answer about that user.

Ability	What it answers
redeemid/my-membership	The caller’s levels, join and renewal dates, levels that ended, features and last sync, as the Member Account block shows them.
redeemid/can-i-read	Can the caller read this item? If not, the reason and the level that would unlock it, or the date drip opens it. Drafts and private items they can’t see answer “no such item”. Free metered reads aren’t counted.

What fails, and how

An item, user or viewer that doesn’t exist is an error, never an answer. A misspelt level is an error too, not a quiet guest answer. A signed-out visitor can run none of them, and a member can’t run the staff ones.

No ability returns a Shopify token, a client secret, a webhook secret or a raw Shopify response. Customer email and name appear only in get-member and level-changes, for administrators, as on the Customers screen.

Connecting an AI agent

1. Install the MCP Adapter plugin from Plugins → Add New. RedeemID doesn’t bundle it. It needs WordPress 6.9.
2. Create an application password for the user the agent acts as, under Users → Profile → Application Passwords. Use an administrator for the staff abilities. The agent can do only what that user can.
3. Point the agent at the adapter’s default server: https://your-site/wp-json/mcp/mcp-adapter-default-server with that user name and application password, or on the server itself wp mcp-adapter serve --server=mcp-adapter-default-server --user=<login>.

The agent finds RedeemID’s abilities by name and description through the server’s discover tool.

Without an agent, the same abilities answer over REST: GET /wp-json/wp-abilities/v1/abilities?category=redeemid lists them, and GET /wp-json/wp-abilities/v1/abilities/redeemid/list-levels/run runs one.

Keeping them off MCP

All RedeemID abilities are offered to the MCP Adapter. To keep them off it, while REST and PHP keep working, set meta.mcp.public to false with WordPress’s wp_register_ability_args filter:

add_filter( 'wp_register_ability_args', static function ( array $args, string $name ): array {
	if ( str_starts_with( $name, 'redeemid/' ) ) {
		$args['meta']['mcp']['public'] = false;
	}

	return $args;
}, 10, 2 );