Let AI agents search your library (Abilities API & MCP) Free

WordPress 6.9 added the Abilities API: a plugin describes what it can do in a machine-readable form, and the MCP Adapter exposes those descriptions over the Model Context Protocol. An agent — Claude, Cursor, ChatGPT — can then use them without knowing anything about FileDeck specifically.

FileDeck registers three abilities. They are in the free version: the Abilities API is core WordPress plumbing, and this is an integration rather than a feature to sell.

What an agent can do

Ability	What it returns
filedeck/search-documents	Documents matching a keyword — title, summary, link, categories, file type and size
filedeck/get-document	The same details for one document by ID
filedeck/list-categories	The category list, with parents, so an agent can narrow a search

What an agent cannot do

All three are read-only. There is no ability to publish, edit, delete, change access, or hand out a download.

That is a deliberate stance rather than a first step. An agent acts on instructions it reads, and some of what it reads will be text somebody else wrote. A library that can only be queried cannot be turned into something worse by a cleverly worded document.

Access is enforced, not assumed

Results are filtered by the same rules a library render uses, for the user the agent is acting as:

• A restricted document never appears in a search — not even its title.
• Asking for a restricted document by ID returns the same answer as asking for one that does not exist. Two different answers would tell an agent which hidden documents are real.
• Categories that are client areas are not named.
• A document behind a WordPress post password, which an agent cannot enter, never appears in a search, and asking for it by ID gets the not-found answer too.

Only what your library still offers

Search leaves out what the library itself has retired, so an agent does not answer from an out-of-date file:

• documents past their expiry date
• documents superseded by a newer version (Pro) — the newer one still appears when it matches
• documents with no file or link attached yet

Agents are given a page link, never a direct download URL. A download URL would be a second door around lead capture, the terms gate and the bot check — the gates the download route exists to apply.

Setting it up

1. Install the MCP Adapter plugin.
2. Point your agent at the site’s MCP endpoint, following that plugin’s documentation.
3. FileDeck’s abilities appear automatically, with no further setup here.

Connect the agent with a dedicated account that sees only what it should — for example a Subscriber with just the groups or client areas it needs. Results are filtered for the account the agent signs in as. Don’t use an administrator’s account: an administrator sees every restricted document, and the agent can repeat what it finds to whoever is talking to it.

Without the Adapter, the same abilities answer over WordPress’s REST API, for example:

GET /wp-json/wp-abilities/v1/abilities/filedeck/search-documents/run?input[query]=leave+policy

Calls are throttled per visitor. An agent that asks too quickly gets a "too many requests" answer and can try again shortly.

On WordPress older than 6.9 no abilities are registered and the site behaves as before.

Restricting who can ask

By default the abilities answer anyone, because the results are already filtered per caller — a public library is public, and refusing anonymous callers would be pretending otherwise about documents anyone can read over HTTP.

To require a login, or to lock it down further:

add_filter( 'filedeck_abilities_permission', function () {
	return is_user_logged_in();
} );