Files
WP-LIT-MCP/src/Abilities/Ability.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

41 lines
1.1 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Abilities;
use WP_Error;
defined('ABSPATH') || exit;
/**
* One capability of the MCP server, registered with the WordPress Abilities API.
*/
interface Ability
{
/** Ability name, e.g. "lit/guide". */
public function name(): string;
public function label(): string;
public function description(): string;
/** @return array<string, mixed> JSON Schema of the input. */
public function inputSchema(): array;
/** @return array<string, mixed>|null JSON Schema of the output, null for image results. */
public function outputSchema(): ?array;
/** @return array{readonly?: bool, destructive?: bool, idempotent?: bool} */
public function annotations(): array;
/** Whether the ability is listed as its own MCP tool (otherwise only via meta-tools). */
public function isDirect(): bool;
/** @param array<string, mixed> $input */
public function permission(array $input): bool|WP_Error;
/** @param array<string, mixed> $input */
public function execute(array $input): mixed;
}