The WordPress AI glossary: MCP, abilities, agents, skills — every term defined

The WordPress AI conversation has produced an unusual amount of overlapping vocabulary in a short time, and several terms mean different things depending on who is selling. This is a plain-English glossary of everything you will meet, with the distinctions that actually matter marked clearly. Bookmark it; the confusing pairs are near the end.

Core protocol terms

Start here — these define the plumbing.

• MCP (Model Context Protocol). An open standard for connecting AI models to external systems through typed tools. Published by Anthropic in 2024, now supported across major AI clients.
• MCP server. The thing exposing capabilities. On WordPress it is a plugin that turns your site into the server. Your site is the server; your AI app is the client.
• MCP client. The AI application connecting to servers — Claude Code, Cursor, ChatGPT, Windsurf, VS Code, a custom agent.
• Tool. A single callable function with a name, description and JSON schema. “Create a post” is a tool.
• Schema. The contract describing a tool's arguments. It is what makes a call validate or fail cleanly rather than being loosely interpreted.
• Transport. How client and server talk — usually HTTP with JSON-RPC for a hosted server like a WordPress site, or stdio for local processes.

WordPress-side terms

• Ability. NibWP's word for one typed tool on your site — nibwp/wp-create-post, nibwp/woo-update-product. WordPress core is standardising a similar “abilities” concept.
• Integration. A set of abilities for one plugin — WooCommerce, ACF, Yoast, WPML. Installing the plugin makes its abilities appear.
• Scope. The permission level on a connection: read, write, manage, files, code. Grant the least you need.
• Application password. WordPress's built-in per-application credential, revocable without changing your password. Often what an MCP connection uses under the hood.
• Approval gate. The step where a proposed write is shown to you before it runs.
• Audit log. The record of every tool call: which tool, which arguments, which user, what result.
• Snapshot. A saved state you can restore — the practical undo for bulk operations.

Agent and model terms

• Agent. A model that can call tools, observe results and decide the next step. The loop is what distinguishes it from a chatbot.
• Context window. How much text the model can consider at once. Relevant because loading 400 posts into context is a bad idea; calling a tool that returns the five you need is not.
• Tool call. One invocation of a tool by the model, with arguments.
• Prompt. What you type. In an agentic setup it describes an outcome, not a procedure.
• Hallucination. The model inventing facts. Typed tools reduce it structurally: the agent reads real data rather than guessing at it.
• Grounding. Giving the model real data to work from — exactly what a read tool does.

The confusing pairs (read this part)

These are the distinctions that cause the most support tickets and the most bad purchases.

Claude Skills vs NibWP Pro Skills

Different things, same word. A Claude Skill is a client-side folder with a SKILL.md that tells Claude how to do a job — anyone can write one. A NibWP Pro Skill is a licensed, server-side workflow inside the plugin that produces validated builder output and works from any MCP client. The full comparison is in Claude Skills vs MCP tools vs Pro Skills.

REST API vs MCP

Both let software talk to WordPress. The REST API is the transport layer developers have used for years; MCP adds discovery (the agent can ask what exists), typing that a model understands, and a permission and audit layer built for AI. A good MCP server calls the REST API and plugin APIs underneath rather than bypassing them.

AI plugin vs MCP server

An AI plugin adds features inside wp-admin — a button that writes a paragraph. An MCP server exposes your site to your own AI client, so the interface is your chat window and the capability set is everything the tools cover.

Automation vs agent

Zapier-style automation is deterministic: a trigger fires a fixed sequence. An agent decides the sequence at run time based on what it reads. Automation is better for known, repeated triggers; agents are better for jobs that require looking first.

Safety and governance terms

• Least privilege. Granting only the permissions needed for the job — a read token for audits, write only where required.
• Draft mode. Writes land as drafts rather than published content, so review is structural rather than optional.
• Dry run. Execute the plan without persisting, to see the output first.
• Validation. Checking output against domain rules before it is written — element whitelists, naming grammar, token mapping.
• Preflight token. A single-use token minted before a validated write, so an agent cannot skip the validation step and persist directly.
• Rate limit. A cap on how many operations run in a window, so a bulk job cannot run away.

Where to go deeper

Definitions are the start. For the mechanics, what MCP is in WordPress; for the capability inventory, every ability an agent can call; for the safety argument in full, is AI write access safe.

FAQ

What is the difference between an ability and a tool?

Is an MCP server the same as an API?

Not quite. An API is an interface for code you already know how to call. MCP adds discovery and typed descriptions so a model can find and use capabilities it was never explicitly programmed for, plus a permission and audit layer.

Are Claude Skills and Pro Skills the same?

No. Claude Skills are client-side instruction files anyone can write. NibWP Pro Skills are licensed server-side workflows that produce validated builder output and work from any MCP client.

Each tool declares a schema for its arguments. Calls are validated against that schema before running, so a model cannot invent a parameter or pass the wrong shape of data.

What is an application password in WordPress?

A per-application credential you can create and revoke in your user profile without changing your main password. It is commonly what an MCP connection authenticates with.

Do I need to know these terms to use AI on WordPress?

No, but two are worth knowing before you buy anything: scope (what a connection is allowed to do) and audit log (whether you can prove what happened).