If you have built anything against WordPress in the last decade, you know the REST API. It exposes your site as a set of endpoints: /wp/v2/posts, /wp/v2/media, and so on. You send a request, you get JSON back. It is dependable, well documented, and it powers a huge amount of the WordPress world. So a fair question is why an AI agent needs anything else. The short answer is that the REST API and an MCP server are aimed at different readers. One is built for a developer who already knows the shape of the site. The other is built for an agent that has to figure the site out at runtime.
The REST API assumes you already know the map
A REST endpoint is a destination. To use it well you need to know it exists, know its URL, know which parameters it takes, and know what the response means. That knowledge usually lives in a developer’s head or in code they wrote ahead of time. The API does not walk up to a client and explain itself. It answers the questions you already know how to ask.
That is a great fit for a theme, a headless frontend, or a mobile app, where a human planned the integration in advance. It is a worse fit for an agent that connects fresh and needs to reason about what it can do before it does anything.
MCP describes abilities the agent can discover
MCP is built around discovery. When a client connects, it can ask the server what tools exist and read a description of each one: what it does, what inputs it wants, what it returns. The agent does not need a map handed to it beforehand, because the server tells it the map. That is the difference in one line. The REST API exposes endpoints you have to know about. MCP describes abilities an agent can find and reason about on its own.
For an AI client that matters a lot. The agent can look at the available tools, match them to the task in front of it, and pick the right one, all without a developer having pre-wired that specific flow.
Governance is the bigger gap
Discovery is the visible difference. The one that matters more for a site owner is governance, and it is where Agent Abilities for MCP does its real work.
The REST API is capability-checked, but it is a broad surface. Authenticate with enough privilege and a wide range of endpoints answer you. The plugin takes a narrower stance on purpose. Every ability is off until you enable it. The agent connects as a real, least-privilege WordPress user through OAuth or an Application Password, not an admin-equivalent key. A connection only sees the tools that user is allowed to run, and each call re-checks the capability before it executes. There is no arbitrary option or meta write, no remote URL fetch, and no code execution. Deletes go to Trash where WordPress supports it, and the last administrator can never be removed.
On top of that sits the audit log. Every call is recorded in a table in your own database, refused attempts included, with the principal and the argument keys but never the values. That gives you an honest record of what an agent tried, what it managed to do, and what it was stopped from doing. A raw REST integration does not hand you that out of the box.
Built on standards, not a private path
It is worth saying that this is not the plugin bolting a parallel universe onto your site. It runs on the WordPress 6.9 Abilities API and the official MCP Adapter. The Abilities API is where each capability is defined in a way WordPress understands natively. The adapter speaks the protocol. So MCP here is a governed layer over your site’s real abilities, not a rewrite of how WordPress works.
When to reach for which
Use the REST API when a developer is building a known integration: a custom frontend, an app, a scheduled sync, anything where you control both ends and can plan the calls. It is mature and it is the right tool for that job.
Reach for the MCP server when the other end is an AI client that needs to discover your abilities, when you want every capability off until you deliberately switch it on, and when you want a per-call audit trail of what the agent did. The two can coexist on the same site. They are not competitors so much as tools for different callers. The REST API answers the questions a developer already knows to ask. The MCP server lets an agent ask what it can do, and lets you decide, ability by ability, what the answer is.