Title: Npcink Abilities Toolkit Author: Npcink Published: June 5, 2026 Last modified: October 13, 2026 --- Search plugins ![](https://ps.w.org/npcink-abilities-toolkit/assets/banner-772x250.png?rev=3563029) ![](https://ps.w.org/npcink-abilities-toolkit/assets/icon-256x256.png?rev=3581135) # Npcink Abilities Toolkit By [Npcink](https://profiles.wordpress.org/muze233/) [Download](https://downloads.wordpress.org/plugin/npcink-abilities-toolkit.0.7.0.zip) * [Details](https://twd.wordpress.org/plugins/npcink-abilities-toolkit/#description) * [Reviews](https://twd.wordpress.org/plugins/npcink-abilities-toolkit/#reviews) * [Installation](https://twd.wordpress.org/plugins/npcink-abilities-toolkit/#installation) * [Development](https://twd.wordpress.org/plugins/npcink-abilities-toolkit/#developers) [Support](https://wordpress.org/support/plugin/npcink-abilities-toolkit/) ## Description Npcink Abilities Toolkit gives your WordPress site a safe toolbox for AI clients: an AI assistant or host product can read articles, media, comments, menus, and site diagnostics, and prepare reviewed suggestions for tags, excerpts, and media metadata. Every write-like ability is a preview by default. A real change only happens after your host product approves the commit, and the approval decision and the audit trail stay with the host, never with this plugin. After activation, open Tools -> AI Ability Set to see at a glance what AI clients can do on this site: which abilities are available, which are read-only, and which would require approval from a host product before anything changes. The page is built for site operators first. For developers and host runtimes, the plugin also provides ability registration helpers, category helpers, schema normalization, annotation normalization, REST discovery values, and optional canonical projection for Npcink AI when Npcink AI is installed. It can be used by any WordPress plugin or client that consumes the WordPress Abilities API. Npcink AI is one optional consumer, not the owner of this plugin. The plugin does not run AI models, execute workflows, route prompts, contact model providers, manage billing or quotas, own MCP governance, or approve final WordPress writes. Read-only host composition recipe metadata may document how hosts can compose abilities, but those records do not run queues, schedule jobs, execute workflows, or create a second registry. Host composition recipe metadata is available through read-only helpers and Abilities API discovery abilities for hosts that need catalog discovery without execution ownership. Bundled starter locale files are limited to translations intentionally maintained in this repository. Incomplete bundled locale packs are removed until they can be maintained as complete starter translations. WordPress.org directory translations are managed separately through translate.wordpress.org/GlotPress and are not runtime authority owned by this plugin. ### External Services and Remote Requests This plugin does not automatically contact Npcink AI, model providers, analytics services, tracking services, or cloud services. Some abilities can prepare request payloads for a separate host or cloud add-on, but this plugin does not send those payloads to an external service by itself. The `npcink-abilities-toolkit/upload-media-from-url` ability is inert as a dry-run preview unless a separate authenticated host supplies approval context and commits the operation. When an approved host runtime commits that ability, WordPress sends an HTTP request to the caller-provided URL in order to fetch the media file for the local media library. The remote endpoint is chosen by the caller, not by this plugin. This plugin stores no provider credentials or remote-service configuration for that ability. This is not provider routing, cloud execution, or stored external- service configuration. ### Requirements * WordPress 6.9 or later. WordPress 6.9 introduced the Abilities API used by this plugin. * PHP 8.0 or later. * The WordPress Abilities API REST routes must be available before third-party provider plugins or external clients can discover and run abilities. ### Public API * `npcink_abilities_toolkit_register_category( $category_id, $args )` * `npcink_abilities_toolkit_register_readonly( $ability_id, $definition )` * `npcink_abilities_toolkit_register_write_proposal( $ability_id, $definition )` * `npcink_abilities_toolkit_normalize_schema( $schema, $default_type )` * `npcink_abilities_toolkit_normalize_annotations( $annotations, $risk_level )` * `npcink_abilities_toolkit_get_registered()` * `npcink_abilities_toolkit_get_workflow_definitions()` * `npcink_abilities_toolkit_get_workflow_definition( $recipe_id )` The workflow definition helpers return read-only recipe metadata for host-side composition. They are not a workflow registry, execution engine, scheduler, approval store, audit store, model router, prompt registry, or final write authority. ### Third-Party Integration Quickstart Provider plugins should wait until `plugins_loaded`, check that the public helper exists, and then register their abilities through the helper functions: ``` if ( function_exists( 'npcink_abilities_toolkit_register_readonly' ) ) { npcink_abilities_toolkit_register_readonly( 'acme/site-summary', $definition ); } ``` Do not include files from this plugin’s `includes/` directory or instantiate classes in the `Npcink_Abilities_Toolkit` namespace. Those are implementation details. Use `npcink_abilities_toolkit_register_readonly()` for read-only context and diagnostic abilities. Use `npcink_abilities_toolkit_register_write_proposal()` only when the callback returns a proposal, preview, diff, or handoff payload. Third-party provider callbacks should not perform final host-governed commits. Approval, audit, quota, and final write authorization belong to the consuming host runtime. REST clients should first discover the catalog through: * `/wp-json/wp-abilities/v1/categories` * `/wp-json/wp-abilities/v1/abilities` * `/wp-json/wp-abilities/v1/abilities/{namespace}/{name}/run` * `/wp-json/npcink-abilities-toolkit/v1/contract` The contract endpoint is a compatibility and boundary discovery endpoint for authenticated host runtimes. It does not replace the WordPress Abilities API catalog and does not run abilities. Full provider examples and REST client notes are maintained in the public repository: ``` https://github.com/npcink/npcink-abilities-toolkit ``` If the `wp-abilities/v1` REST routes are missing, enable the WordPress Abilities API baseline or compatibility plugin before connecting third-party providers or clients. ### Admin Page After activation with a Npcink AI host plugin, open Npcink AI -> AI Ability Set in wp-admin. When this standalone package is installed without a Npcink AI host menu, open Tools -> AI Ability Set instead. The page is designed for site operators first: it shows site ability status, the ability package list with write safeguards, plain-language capability groups, and next actions. Under Developer Tools, the Checks view can run two official read-only checks: site info and bounded redacted diagnostics summary, explaining what each check proves and what it does not prove before it runs. Check results are shown as a plain summary table, with raw JSON kept behind a support disclosure. The Connection view keeps copyable REST endpoint values, raw discovery fetches, and ability ID export available for host/client setup. It does not run showcase workflows, model calls, write abilities, approval flows, or demo abilities. The Tools -> AI Ability Set page remains the standalone surface when no Npcink AI host menu is active; host detection must not create approval, quota, audit, or workflow control-plane behavior in this plugin. ### Built-In Abilities The plugin includes migrated low-risk WordPress read abilities, deterministic comment helpers, and host-governed WordPress write/destructive abilities using canonical` npcink-abilities-toolkit/*` ids. It also includes `npcink-abilities-toolkit/wp-diagnostics-summary`, a redacted WordPress- only diagnostics summary for Abilities API clients. This summary intentionally omits Npcink AI settings, MCP settings, API keys, database names, table prefixes, filesystem paths, error logs, and external HTTP probes. It also includes `npcink-abilities-toolkit/search-posts` and `npcink-abilities-toolkit/ search-post-meta`, bounded local WordPress search helpers for keyword and explicit post-meta discovery. These are read-only helpers and do not call external search indexes or mutate content. It also includes `npcink-abilities-toolkit/list-workflow-recipes` and `npcink-abilities- toolkit/get-workflow-recipe`, read-only host composition recipe metadata discovery abilities. These expose metadata only and do not execute workflow runtime behavior. Core governance handoff docs include a catalog snapshot, permission matrix, and schema boundary audit for hosts that consume this plugin through `npcink-ai-core`. Source-level verification commands for contributors are documented in the public repository’s README and CONTRIBUTING files. ## Screenshots [⌊Overview tab: site ability status tiles, the ability package list with write safeguards, plain-language capability groups, and next actions.⌉⌊Overview tab: site ability status tiles, the ability package list with write safeguards, plain-language capability groups, and next actions.⌉[ Overview tab: site ability status tiles, the ability package list with write safeguards, plain-language capability groups, and next actions. [⌊Ability Catalog view under Developer Tools: searchable catalog with filters, risk grouping, availability, and technical details for support.⌉⌊Ability Catalog view under Developer Tools: searchable catalog with filters, risk grouping, availability, and technical details for support.⌉[ Ability Catalog view under Developer Tools: searchable catalog with filters, risk grouping, availability, and technical details for support. [⌊Checks view under Developer Tools: read-only checks explained before running, summary results, and raw responses kept behind a support disclosure.⌉⌊Checks view under Developer Tools: read-only checks explained before running, summary results, and raw responses kept behind a support disclosure.⌉[ Checks view under Developer Tools: read-only checks explained before running, summary results, and raw responses kept behind a support disclosure. [⌊Connection view under Developer Tools: copyable REST endpoint values, raw discovery fetches, and ability ID export.⌉⌊Connection view under Developer Tools: copyable REST endpoint values, raw discovery fetches, and ability ID export.⌉[ Connection view under Developer Tools: copyable REST endpoint values, raw discovery fetches, and ability ID export. ## Installation 1. Install and activate the plugin through the Plugins screen, or upload the plugin folder to wp-content/plugins/ and activate it from there. 2. Confirm the site runs WordPress 6.9 or later so the Abilities API registration functions and REST routes exist. 3. A one-time welcome notice on the Plugins screen links to the status page. Open Tools -> AI Ability Set (or Npcink AI -> AI Ability Set when a Npcink AI host menu is present) and check that the site ability status is working. 4. To expose abilities from your own plugin, register them on plugins_loaded through the public helpers listed under Public API; see the Third-Party Integration Quickstart below. ## FAQ ### Does this plugin run AI models? No. Npcink Abilities Toolkit exposes WordPress abilities and support information through the WordPress Abilities API. Model routing, prompt selection, hosted runtime execution, and workflow execution belong to a separate host product or client. ### Will this plugin change my posts, media, terms, comments, or settings by itself? No. The admin page checks are read-only. Some built-in abilities describe write- like or destructive operations, but final commits require a host runtime with its own approval, authorization, and audit layer. ### Do I need Npcink AI to use this plugin? No. Npcink AI is an optional consumer. The plugin can also be used by other plugins or clients that consume the WordPress Abilities API. ### What do the Safe Checks prove? Site Info proves that an authorized ability client can read basic WordPress site information. Redacted Diagnostics proves that the site can return a support-friendly environment summary with sensitive fields omitted. These checks do not call models, generate content, contact external services, or fix configuration automatically. ### Does Redacted Diagnostics expose secrets? No. The diagnostics summary intentionally omits Npcink AI settings, MCP settings, API keys, database names, table prefixes, filesystem paths, error logs, and external HTTP probes. ### What should I do if abilities are not visible to a host product or AI client? Open Tools -> AI Ability Set, or Npcink AI -> AI Ability Set when a Npcink AI host menu is present. Use the Checks tab to confirm safe read-only responses, then use Available Abilities to review what the site exposes. Developers and host products can use Developer Access for REST endpoint values and raw discovery responses. ### What if the wp-abilities/v1 REST routes are missing? The WordPress Abilities API routes must be available before clients can discover and run abilities. Enable the WordPress Abilities API baseline or compatibility plugin for the target site. ### What does uninstalling remove? Uninstalling removes the plugin’s stored options, per-admin notice state (welcome and health notice dismissals), the media backup cleanup schedule, and backup files and deletion manifests stored by this plugin. Shared legacy media replacement history is preserved by default. Expiring transients are left to their normal lifecycle. Hosts can preserve backup files and their deletion manifests with `npcink_abilities_toolkit_uninstall_preserve_media_backups`, or explicitly remove shared history with `npcink_abilities_toolkit_uninstall_preserve_media_history` set to false. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Npcink Abilities Toolkit” is open source software. The following people have contributed to this plugin. Contributors * [ Npcink ](https://profiles.wordpress.org/muze233/) [Translate “Npcink Abilities Toolkit” into your language.](https://translate.wordpress.org/projects/wp-plugins/npcink-abilities-toolkit) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/npcink-abilities-toolkit/), check out the [SVN repository](https://plugins.svn.wordpress.org/npcink-abilities-toolkit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/npcink-abilities-toolkit/) by [RSS](https://plugins.trac.wordpress.org/log/npcink-abilities-toolkit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.7.0 Restores ability discovery on real REST requests while preserving the light anonymous frontend and operator read-only mode. Adds a read-only flagged-media removal plan and a separate governed attachment deletion ability with explicit no-backup or retained- backup branches. Host approval is required for every deletion or restore. Toolkit backups can recreate a deleted attachment with a new id; old references and plugin- specific relationships require separate review. Ten new runtime strings ship in all seven bundled locales. #### 0.6.0 User-visible operator read-only mode release: site owners can turn off the write and destructive ability packages from the AI Ability Set Overview while keeping read abilities available. The narrowing-only setting composes with the host package filter, applies on the next request, is removed on uninstall, and leaves dry-run defaults and host-governed approval unchanged. The release also includes the 0.5.12 locale terminology alignment and the completed read-only implementation from #242/# 243. #### 0.5.12 User-experience and operator-guidance release from the 2026-10 end-user audit: no ability contract, schema, response-shape, or behavior changes to abilities. The bundled troubleshooting guide now opens with a no-command-line section for site operators and documents how to turn ability packages on or off with a copy-paste snippet, and the admin ability package list links to that guidance. A disabled safe- check button now explains that its ability is not registered instead of greying out silently, and the raw check response and raw discovery outputs gained Copy response buttons for support handoff. All admin help links share one filterable documentation base (npcink_abilities_toolkit_docs_base_url) so sites with unreliable GitHub access can point them at a mirror they maintain. Three new admin strings ship in all seven bundled locales, and this readme’s description now leads with what the plugin gives you before boundary language. #### 0.5.11 Security and performance hardening release from the 2026-10 audit: no ability contract, schema, or response-shape changes. Publishing reports enforce per-post edit permission, anonymous frontend pageviews skip built-in ability registration and catalog fingerprinting( faster pageviews, no behavior change on admin, REST, cron, or CLI), the runtime contract endpoint serves from a bounded cache, media file paths are validated segment- by-segment on both read and write sides, every registered ability re-checks its capability before its callback runs, and site operators get a health warning when a host integration allows commits unconditionally. Uninstall now keeps the shared legacy media replacement history by default; set the npcink_abilities_toolkit_uninstall_preserve_media_history filter to false to restore the old delete behavior. #### 0.5.10 Documentation-follow-up release: records the article-publish-preflight closed-loop host proof, corrects the preflight proof failure attribution, and keeps the 0.5.9 code base unchanged so the conventional release tag can point at the current candidate head. #### 0.5.9 * User-experience localization and onboarding release: no ability contract, schema, or behavior changes; ability ids and response shapes are identical to 0.5.8. * Workflow scenario cards now follow the site language. Recipe titles and task examples are localized at render time while the discovery payloads stay untranslated contract data. * A one-time welcome notice after activation links to the ability status page and clears once the page has been visited or the notice dismissed. * The admin page heading now matches the “AI Ability Set” menu label, overview attention notes link troubleshooting guidance, connection values explain which endpoints need an authenticated admin session, and catalog filter selects apply immediately. * Uninstalling now also removes per-admin notice state (welcome and health notice dismissals). * Bundled locales gained the workflow scenario strings and two admin strings at full template parity; a guard test keeps the hand-maintained scenario template entries from being dropped by regeneration. #### 0.5.8 * Maintenance and repository-health release: no ability contract, schema, or behavior changes; ability ids and response shapes are identical to 0.5.7. * Split the largest media read module into smaller trait files with byte-for-byte purity proofs and test-suite ownership assertions, keeping the class surface unchanged while making future media reads easier to review. * Added automated debt ratchets: file-size ceilings on source modules, a repository- wide static-analysis total that only moves downward at release time, and a conservation rule so relocated static-analysis findings are never misread as new debt. * Removed provably dead null-coalescing fallbacks in read paths (runtime-identical) while deliberately keeping the defensive fallbacks on filterable WordPress surfaces and partial-object inputs. * Streamlined the development workflow: a fast ~25-second iteration test tier, a mechanical post-merge steady-state check, an archived documentation library with an evergreen index, and Dependabot maintenance pull requests that are no longer blocked by the human-oriented PR body contract. #### 0.5.7 * Shipped the user-experience hardening batch: direct post-meta write abilities now invalidate the bounded read cache instead of serving stale reports, admin health notices fail loud when ability registration is unavailable or the catalog is empty, and uninstall removes media replacement history and the plugin backups directory behind explicit preserve filters. * Hardened the runtime contract endpoint: `ability_catalog_available` now reflects the live Abilities API route, and the contract response serves a quoted sha256 ETag with a filterable `Cache-Control` (default `private, no-cache`) plus empty 304 responses for matching `If-None-Match` polls. * Improved the admin surface: a read-only ability packages overview section, explicit empty states, copy-button failure fallback, request buttons that disable while running, and translated page title registration. * Kept the packaged plugin error-free for Plugin Check by routing the uninstall backup-tree file deletion through the WordPress file API. * Backfilled the bundled locales de_DE, es_ES, fr_FR, ja, ko_KR, and pt_BR to full template parity and refreshed the translation template to 0.5.7. #### 0.5.6 * Fixed `rename-media-file` commits, which previously failed after copying and discarded the copied file, and corrected expired-backup cleanup history timing. * Restructured the admin tools page into two audience tabs: a one-screen Overview for site owners and task-based sub navigation for developers. * Added five machine-readable workflow recipes (article-production, media-seo-handoff, media-governance-scan, site-operations-scan, diagnostics-triage) with replay- fixture locks. * Documented the host-agnostic Host Approval Contract for governing write and destructive commits. * Added ability response-shape registration and scope-semantics contract drift gates. * Backfilled the bundled zh_CN locale to full parity. #### 0.5.5 * Isolate the packaged Plugin Check regression test from inherited local WordPress CLI runtime settings. #### 0.5.4 * Added bounded media backup retention cleanup and preserved exact-manifest batch backups until explicit operator confirmation. * Aligned cleanup cron registration with the enabled write package and cleared it during uninstall. * Required semantic body evidence for internal-link candidates and kept final application in the visible editor. * Added canonical media fingerprints and replacement lineage to governed media operations. #### 0.5.3 * Corrected the minimum WordPress version to 6.9 and added a real minimum-version release smoke. * Made Toolkit the canonical owner of reusable static workflow definitions without adding workflow runtime state. * Replaced the raw ability-count gate with representative contract assertions and documented WordPress Core convergence rules. * Made write and destructive callbacks fail safe unless commit intent is explicit and host-governed. * Restricted post-meta reads to explicit non-sensitive keys and required host allowlists for setting patch targets. * Validated remote media before uploads, removed the obsolete in-memory fallback, and redacted reversible setting fragments. * Added internal autoloading, lazy package construction, and a cold-bootstrap performance budget. * Removed the incomplete bundled Traditional Chinese starter locale until it can be maintained as a complete pack. #### 0.5.2 * Added read-only review artifacts for image candidates, internal link candidates, taxonomy suggestions, and comment reply suggestions. * Kept candidate review helpers suggestion-only and host-governed; they do not create proposals, approve work, execute writes, or contact external providers. * Expanded acceptance contracts and first-party pack documentation for the new handoff artifacts. #### 0.5.1 * Added Composer dependency advisory audit to the default local and CI source gate. * Aligned CI and PHPStan with the package PHP 8.0 runtime floor. * Published the canonical public GitHub repository and documented the post-publication gate baseline. * Upgraded GitHub Actions checkout to the Node 24-compatible `actions/checkout@ v5`. #### 0.5.0 * Improved the admin page as a connection and discovery surface with clearer package status, catalog navigation, copyable REST endpoints, and two bounded read-only checks. * Added bundled translation templates and starter locale packs for the admin connection/ discovery surface, API ability labels/descriptions, and common runtime error messages. * Removed development demo ability controls from the admin page and kept showcase, model-call, write, and workflow execution outside this package surface. * Renamed nonproduction cleanup abilities and media cleanup inputs to avoid public` test` terminology in released ability ids and schema fields. * Added taxonomy assignment proposal support and strengthened Core consumer handoff checks for harvested workflow surfaces. * Hardened media replacement and Cloud derivative adoption previews so approved replacements can repair exact post-content media URLs, including old intermediate- size URLs. * Documented the foundation-layer testing strategy and default local source gate. #### 0.4.0 * Added read-only host composition recipe metadata discovery abilities and public PHP helpers. * Added Core governance handoff documentation, a catalog snapshot fixture, a permission matrix, and a schema boundary audit. * Hardened write-like contracts with `requires_approval`, explicit dry-run and commit defaults, and bounded idempotency keys. * Expanded REST verification coverage for governance metadata and schemas. * Added a consumer example for preparing Core proposal payloads from discovered ability contracts. #### 0.3.0 * Added package and sub-pack filters so hosts can keep a full catalog by default or opt into a light `core_wordpress_read` profile. * Kept public third-party helpers read-only/write-proposal oriented and documented that final commit authorization belongs to the host runtime. * Made Npcink AI catalog projection thin by default and added a projection-row filter for host-owned policy expansion. * Established `npcink-abilities-toolkit/*` as the canonical id namespace for abilities owned by this plugin. * Added explicit read/comment sub-pack maps as the split point for future source- file extraction. * Verified Npcink AI catalog compatibility against a WordPress site. #### 0.2.0 * Stabilized the public helper contract and ability metadata rules. * Documented host-governed write/destructive semantics and the Npcink AI integration boundary. * Added first-party ability pack grouping and 0.2 candidate verification evidence. * Strengthened lightweight tests for schema controls, Npcink catalog projection, provider defaults, and invalid ability ids. * Verified WordPress REST coverage and Npcink AI consumer split-boundary checks. #### 0.1.0 * Initial standalone release. * Added migrated WordPress read abilities, deterministic comment helpers, host- governed write/destructive abilities, and standalone redacted WordPress diagnostics. ## Meta * Version **0.7.0** * Last updated **4 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.9 or higher ** * Tested up to **7.1.3** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/npcink-abilities-toolkit/) * Tags * [abilities-api](https://twd.wordpress.org/plugins/tags/abilities-api/)[Agents](https://twd.wordpress.org/plugins/tags/agents/) [AI](https://twd.wordpress.org/plugins/tags/ai/)[automation](https://twd.wordpress.org/plugins/tags/automation/) * [Advanced View](https://twd.wordpress.org/plugins/npcink-abilities-toolkit/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/npcink-abilities-toolkit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/npcink-abilities-toolkit/reviews/) ## Contributors * [ Npcink ](https://profiles.wordpress.org/muze233/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/npcink-abilities-toolkit/)