Use the Abilities API to define discoverable WordPress capabilities, REST API to expose HTTP resources and operations, and WP-CLI for trusted command-line administration. These interfaces can complement each other. The right choice depends on caller, environment, interaction model, authentication, latency, and operational risk. This guide supports the AI architecture cluster.
At a Glance
| Area | Control |
|---|---|
| Abilities API | Capability registry and execution contract |
| REST API | HTTP integration surface |
| WP-CLI | Trusted operational command interface |
| MCP | AI-facing protocol that can call bounded abilities |
| Policy | Shared permission and audit layer |
Choose Abilities for Domain Actions
An ability can describe input and output schemas, permissions, and execution for a meaningful action. It can be reused by AI, UI, REST, or automation adapters.
Choose REST for Remote Applications
REST is appropriate for structured HTTP access, versioned endpoints, pagination, caching, web clients, and external services.
Choose WP-CLI for Operations
WP-CLI suits trusted shells, deployment pipelines, maintenance, batch work, and administrative scripts with controlled server access.
Avoid Duplicated Business Logic
Put domain rules in services or abilities, then adapt them to REST, CLI, or MCP. Separate interfaces should not implement conflicting validation.
Apply Interface-Specific Security
REST needs authentication, authorization, rate limits, and input validation. CLI needs host access control and command safeguards. Abilities need permission callbacks and bounded schemas.
Design for Observability
Use shared correlation IDs, audit events, result codes, and safe errors across interfaces.
Select by Failure Model
Remote APIs face latency and retries; CLI faces operator mistakes and environment risk; AI calls face tool-selection and instruction risk.
Implementation Checklist
- Caller and environment identified
- Domain logic shared
- Permissions consistent
- Schemas versioned
- Remote limits defined
- CLI safeguards added
- Audit format unified
- Failure and recovery tested
Frequently Asked Questions
Can Abilities replace REST?
No. Abilities define capabilities and execution contracts, while REST provides an HTTP interface. An ability can be exposed through a REST adapter.
Can MCP call WP-CLI?
It could, but broad shell access creates high risk. Prefer bounded abilities or services rather than arbitrary commands.
Which is best for AI agents?
Abilities are a strong domain contract, often exposed through MCP. The server still needs identity, permissions, confirmation, and audit.
Which is best for integrations?
REST, events, queues, or files may fit depending on latency and reliability. Abilities can centralize the WordPress operation behind them.
Which is best for deployments?
WP-CLI is useful in trusted deployment and maintenance environments with non-interactive safeguards.
Can all three coexist?
Yes. A mature platform may use shared domain services with separate REST, CLI, UI, and MCP adapters.
Interface selection should reduce duplicated logic while preserving the right security and operating boundary.
