@@ -0,0 +1,67 @@
+# MCP Access
+
+## Summary
+
+The MCP Access experiment wires a site up to the [MCP Adapter](https://wordpress.org/plugins/mcp-adapter/) companion plugin and gives site owners control over which abilities are exposed to AI agents over the Model Context Protocol. Enabling the experiment installs and activates the MCP Adapter plugin from WordPress.org if it is not already active.
+
+## Overview
+
+### For End Users
+
+When enabled, a new admin page appears under `Tools > MCP Access`. The page provides:
+
+- The MCP server **endpoint URL**, read from the adapter's registered servers
+- The adapter's **install state**, with a manual install/activate button when it is missing or inactive
+- A table of registered abilities with per-ability **expose/hide** controls; a **Status** column shows which abilities are overridden, and toggling a checkbox back restores the default
+
+This plugin's own abilities (`ai/*`) are exposed by default, since they only register while the feature or experiment providing them is enabled. Other abilities keep their developer-declared visibility unless the site owner changes them. Two groups are not listed: the adapter's own default-server abilities (`mcp-adapter/*`), which are the server's machinery and are active whenever the server runs, and deprecated aliases, which stay hidden because their replacement is listed instead.
+
+While the experiment is enabled, the MCP Adapter plugin is installed and activated automatically on the first admin page load by a user who can install plugins. The attempt runs once per experiment activation: deactivating the adapter afterwards is respected, and toggling the experiment off and on runs the install again. Exposure overrides are only enforced while the experiment is enabled.
+
+### For Developers
+
+The experiment consists of:
+
+1. **Experiment class** (`WordPress\AI\Experiments\MCP_Adapter\MCP_Adapter`): Boots the exposure filter, REST route, admin page, and installer
+2. **Auto-installer** (`WordPress\AI\Experiments\MCP_Adapter\Plugin_Installer`): Installs and activates the adapter from WordPress.org once per experiment enable, via `plugins_api()` and `Plugin_Upgrader`
+3. **Exposure overrides** (`WordPress\AI\Experiments\MCP_Adapter\Exposure_Overrides`): Injects saved overrides into ability registration meta so the adapter's default server honors them
+4. **REST controller** (`WordPress\AI\Experiments\MCP_Adapter\Settings_Controller`): Powers the admin page over `ai/v1/mcp/settings`
+5. **React admin app** (`src/experiments/mcp-adapter/`): Renders the install state and the ability exposure table
+
+## Architecture & Implementation
+
+### Key Hooks & Entry Points
+
+`WordPress\AI\Experiments\MCP_Adapter\MCP_Adapter::register()` wires:
+
+- `wp_register_ability_args` (via `Exposure_Overrides`) to apply exposure defaults and saved overrides as `meta.mcp.public`
+- `rest_api_init` to register the `ai/v1/mcp/settings` route
+- `admin_menu` and `admin_enqueue_scripts` for the Tools page
+- `admin_init` (via `Plugin_Installer`) for the once-per-enable install attempt
+
+### Exposure Flow
+
+1. The MCP Adapter resolves an ability's exposure from `meta.mcp.public`, falling back to `meta.public`.
+2. Overrides saved on the MCP Access screen are stored as an ability-name map and injected into that meta key at registration time, so the adapter picks them up with no hard dependency between the plugins. Class-based abilities extending `Abstract_Ability` merge the filtered meta over the meta their class declares.
+3. Without an override, `ai/*` abilities are injected as exposed, and abilities whose meta has a `deprecated` key are injected as hidden. Everything else is left untouched.
+4. The default is captured before injection, so the screen can always report and restore it.
+5. Overrides for the reserved `mcp-adapter/*` namespace and for deprecated aliases are never listed, accepted, or applied.
+
+### Install Flow
+
+1. On `admin_init`, if the current enable cycle has not been handled and the visitor can activate plugins, the installer resolves the adapter's install state.
+2. An active copy (including one installed under a non-standard directory, detected via the adapter's classes) marks the cycle handled with no action.
+3. Otherwise the installer claims the cycle atomically, downloads the plugin from WordPress.org if missing, and activates it. Success or failure is recorded; a failure is surfaced on the MCP Access screen with the manual button as the retry path.
+4. Disabling the experiment clears the marker, so re-enabling runs a fresh attempt.
+
+### Data Storage
+
+The experiment uses two options:
+
+- `wpai_mcp_exposed_abilities`: exposure override map (`ability_name -> bool`); abilities not present keep their default
+- `wpai_mcp_adapter_autoinstall_handled`: once-per-enable marker (`'1'` on success, the error message on failure)
+
+### Filters
+
+- `wpai_mcp_adapter_plugin_slug`: Filters the WordPress.org slug of the companion plugin (useful for testing the install flow against a stand-in plugin)
+- `wpai_pre_mcp_adapter_autoinstall`: Short-circuits the automatic install; return `true` to report success or a `WP_Error` to report failure without touching the filesystem
@@ -29,7 +29,11 @@ abstract class Abstract_Ability extends WP_Ability {
 	/**
 	 * Constructor.
 	 *
+	 * Meta from the registration args is merged over the class meta, so
+	 * `wp_register_ability_args` filters can adjust it.
+	 *
 	 * @since 0.1.0
+	 * @since x.x.x Merges meta from the registration args.
 	 *
 	 * @param string              $name       The name of the ability.
 	 * @param array<string,mixed> $properties The properties of the ability. Must include `label`.
@@ -45,7 +49,10 @@ public function __construct( string $name, array $properties = array() ) {
 				'output_schema'       => $this->output_schema(),
 				'execute_callback'    => array( $this, 'execute_callback' ),
 				'permission_callback' => array( $this, 'permission_callback' ),
-				'meta'                => $this->meta(),
+				'meta'                => array_replace_recursive(
+					$this->meta(),
+					isset( $properties['meta'] ) && is_array( $properties['meta'] ) ? $properties['meta'] : array()
+				),
 			)
 		);
 	}
 
@@ -270,4 +270,32 @@ static function () use ( $message ) {
 			);
 		}
 	}
+
+	/**
+	 * Enqueues the DataViews component styles.
+	 *
+	 * Uses the WP-registered handle when a WordPress release ships one;
+	 * otherwise falls back to the copy bundled into build/ by the build step.
+	 *
+	 * @since x.x.x
+	 */
+	public static function enqueue_dataviews_style(): void {
+		if ( wp_styles()->query( 'wp-dataviews' ) ) {
+			wp_enqueue_style( 'wp-dataviews' );
+			return;
+		}
+
+		$dataviews_css = WPAI_PLUGIN_DIR . 'build/admin/dataviews.css';
+
+		if ( ! file_exists( $dataviews_css ) ) {
+			return;
+		}
+
+		wp_enqueue_style(
+			'ai-dataviews',
+			WPAI_PLUGIN_URL . 'build/admin/dataviews.css',
+			array(),
+			(string) filemtime( $dataviews_css )
+		);
+	}
 }
@@ -43,6 +43,7 @@ final class Experiments {
 		\WordPress\AI\Experiments\Editorial_Notes\Editorial_Notes::class,
 		\WordPress\AI\Experiments\Editorial_Updates\Editorial_Updates::class,
 		\WordPress\AI\Experiments\Excerpt_Generation\Excerpt_Generation::class,
+		\WordPress\AI\Experiments\MCP_Adapter\MCP_Adapter::class,
 		\WordPress\AI\Experiments\Meta_Description\Meta_Description::class,
 		\WordPress\AI\Experiments\Revision_Change_Summary\Revision_Change_Summary::class,
 		\WordPress\AI\Experiments\Slug_Generation\Slug_Generation::class,
 
@@ -0,0 +1,70 @@
+<?php
+/**
+ * Admin page for the MCP Access screen.
+ *
+ * @package WordPress\AI\Experiments\MCP_Adapter
+ */
+
+declare( strict_types=1 );
+
+namespace WordPress\AI\Experiments\MCP_Adapter;
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+/**
+ * Registers and renders the MCP Access admin page.
+ *
+ * @since x.x.x
+ */
+class Admin_Page {
+	/**
+	 * The admin page slug.
+	 *
+	 * @since x.x.x
+	 * @var string
+	 */
+	public const PAGE_SLUG = 'ai-mcp-access';
+
+	/**
+	 * Initializes the admin page hooks.
+	 *
+	 * @since x.x.x
+	 */
+	public function init(): void {
+		add_action( 'admin_menu', array( $this, 'add_admin_menu' ) );
+	}
+
+	/**
+	 * Adds the Tools submenu page.
+	 *
+	 * @since x.x.x
+	 */
+	public function add_admin_menu(): void {
+		add_submenu_page(
+			'tools.php',
+			__( 'MCP Access', 'ai' ),
+			__( 'MCP Access', 'ai' ),
+			'manage_options',
+			self::PAGE_SLUG,
+			array( $this, 'render_page' )
+		);
+	}
+
+	/**
+	 * Renders the page mount point for the React app.
+	 *
+	 * @since x.x.x
+	 */
+	public function render_page(): void {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'ai' ) );
+		}
+
+		echo '<div class="wrap">';
+		echo '<h1>' . esc_html__( 'MCP Access', 'ai' ) . '</h1>';
+		echo '<div id="ai-mcp-access-root"></div>';
+		echo '</div>';
+	}
+}
Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,11 @@ abstract class Abstract_Ability extends WP_Ability {`
`29`	`29`	`/**`
`30`	`30`	`* Constructor.`
`31`	`31`	`*`
	`32`	`+ * Meta from the registration args is merged over the class meta, so`
	`33`	+ * `wp_register_ability_args` filters can adjust it.
	`34`	`+ *`
`32`	`35`	`* @since 0.1.0`
	`36`	`+ * @since x.x.x Merges meta from the registration args.`
`33`	`37`	`*`
`34`	`38`	`* @param string $name The name of the ability.`
`35`	`39`	* @param array<string,mixed> $properties The properties of the ability. Must include `label`.
`@@ -45,7 +49,10 @@ public function __construct( string $name, array $properties = array() ) {`
`45`	`49`	`'output_schema' => $this->output_schema(),`
`46`	`50`	`'execute_callback' => array( $this, 'execute_callback' ),`
`47`	`51`	`'permission_callback' => array( $this, 'permission_callback' ),`
`48`		`- 'meta' => $this->meta(),`
	`52`	`+ 'meta' => array_replace_recursive(`
	`53`	`+ $this->meta(),`
	`54`	`+ isset( $properties['meta'] ) && is_array( $properties['meta'] ) ? $properties['meta'] : array()`
	`55`	`+ ),`
`49`	`56`	`)`
`50`	`57`	`);`
`51`	`58`	`}`