Members Only integrates with the WordPress Abilities API to expose its membership operations as first-class, schema-described abilities. This makes membership data and actions discoverable and usable by AI agents (via MCP), WordPress core AI features, automation tools, and other plugins — all with the same permission checks the plugin enforces everywhere else. To connect an AI agent such as Claude to your site, see Using Abilities via MCP.
Requirements
- WordPress 6.9 or later — the Abilities API ships with WordPress core starting in 6.9
- Members Only 1.8.0 or later
There is nothing to configure. On WordPress 6.9+, Members Only registers its abilities automatically. On older WordPress versions the integration is inactive and has no effect. If you disable the Abilities API entirely in WordPress, the integration remains inactive.
How Abilities Work
Every ability is registered under the Members Only ability category with a name like members-only/get-member-status. Each one declares:
- An input schema and output schema (JSON Schema), so agents and tools know exactly what to send and what they will get back
- A permission callback that runs before every invocation — abilities never bypass WordPress capabilities
- Annotations declaring whether it is
readonly,destructive, andidempotent, so agents can treat risky operations with appropriate care
Abilities that operate on a specific user accept a user_id or an email to identify them — provide exactly one, never both. A request carrying both identifiers fails input validation, and a mismatched pair supplied directly to a callback returns members_only_conflicting_identifiers, so an ID/email mix-up can never act on the wrong account. If neither is provided, or no matching user exists, the ability returns an error (members_only_missing_user or members_only_user_not_found).
The Ability Catalog
Members Only registers 25 abilities, organized into six groups. Each group has its own reference doc with full parameter and return details.
| Group | Abilities |
|---|---|
| Member Lookup | get-member-status, list-user-memberships, list-member-subscriptions, list-user-access-passes |
| Member Management | create-member, grant-access-pass, revoke-access-pass |
| Billing & Subscriptions | cancel-subscription, reactivate-subscription, get-billing-portal-link, list-products-and-prices |
| Content Restriction | check-content-access, set-post-restriction, list-restricted-content |
| Reporting | get-membership-stats, get-recent-activity, get-signup-counts, find-members |
| Group Memberships | get-group-overview, list-group-members, add-group-member, remove-group-member, invite-group-members, list-pending-invitations, revoke-invitation |
The seven group abilities are only registered when the Group Memberships extension is active. On sites without it, they simply do not appear.
Permissions and Security
Every ability checks the invoking user’s capabilities before running. The checks mirror what the plugin’s own admin screens enforce:
| Abilities | Required capability |
|---|---|
Member lookup, billing, reporting, content audit (check-content-access, list-restricted-content) | manage_options (site administrator) |
grant-access-pass, revoke-access-pass | edit_users |
create-member | create_users (plus edit_users when also granting an access pass, and manage_options when also adding the new user to a group) |
set-post-restriction | edit_post for the specific post |
Group abilities (except add-group-member) | Site administrator, or the group admin of the targeted group |
add-group-member | manage_options (site staff only — group admins use invitations) |
A few security behaviors worth knowing:
- Subscription abilities verify that the subscription actually belongs to the identified user before acting on it
- Invitation listings never include invitation tokens
- Destructive operations (cancel subscription, revoke access pass, remove group member, revoke invitation) are annotated as destructive, and
cancel-subscriptionsupports adry_runpreview
For Developers
Two filters let you adjust permission decisions:
members_only_manage_members_permission— receives( $allowed, $capability )and gates the member-management capability checks (manage_options,edit_users,create_users)members_only_abilities_permission— receives( $allowed, $context )with a context ofedit_postormanage_group, and gates the post-restriction and group permission checks
See the Actions and Filters doc for the plugin’s full hook reference.