Abilities API

On WordPress 6.9 and later, Refinery Fraud Guard automatically registers abilities with the WordPress Abilities API. These abilities allow AI agents, automation tools, and the WordPress MCP Adapter to query fraud data, manage the blocklist, and run fraud checks programmatically.

Prerequisites

• WordPress 6.9 or later — The Abilities API was introduced in WordPress 6.9. On earlier versions, abilities are not registered and the plugin functions normally.
• WooCommerce — Must be installed and active.
• manage_woocommerce capability — All abilities require store management permissions.

Registered abilities

Refinery Fraud Guard registers the following abilities in the refinery-fraud-guard category. All abilities are exposed through the REST API with show_in_rest enabled.

Ability	Description	Type
refinery-fraud-guard/get-logs	Query the fraud detection log with filtering by action, rule, payment method, date range, and pagination.	Read
refinery-fraud-guard/get-stats	Retrieve dashboard statistics: flagged counts (today, week, month), revenue protected, and rule breakdown.	Read
refinery-fraud-guard/add-to-blocklist	Block an IP address, email, or email domain. Validates IP and email formats before adding. Supports optional expiration.	Write
refinery-fraud-guard/remove-from-blocklist	Remove a blocklist entry by ID.	Write
refinery-fraud-guard/get-blocklist	List blocked IPs, emails, and email domains with filtering and pagination.	Read
refinery-fraud-guard/check-order	Run all fraud rules against an existing WooCommerce order and return the result.	Write

How it works

Abilities are registered on the wp_abilities_api_init action hook when WordPress initializes the Abilities Registry. Each ability defines:

• Input schema — A JSON Schema describing accepted parameters
• Output schema — A JSON Schema describing the response structure
• Execute callback — The function that performs the operation
• Permission callback — Checks that the caller has manage_woocommerce capability

Abilities can be invoked through the WordPress REST API, the WordPress MCP Adapter, or programmatically via WP_Abilities_Registry::get_instance().

Using with the MCP Adapter

Install the WordPress MCP Adapter plugin to expose registered abilities to AI agents that support the Model Context Protocol (MCP). Once installed, any AI agent connected via MCP can discover and invoke Fraud Guard abilities — querying logs, checking stats, managing the blocklist, and running fraud checks — all with proper permission checks.

Backward compatibility

The Abilities API registration is guarded behind a function_exists('wp_register_ability') check. On WordPress versions earlier than 6.9, the abilities are not registered and the plugin continues to function normally. No code changes or configuration are needed.