Get started
How do you control Kraft Booking with an AI assistant (WordPress Abilities and MCP)?
With WordPress 6.9 or later, GDA Kraft Booking exposes functions an AI can use through WordPress Abilities and MCP. List of functions, use cases and security rules.
With WordPress 6.9 or later, GDA Kraft Booking declares some of its functions as WordPress Abilities. This lets an AI assistant that supports the MCP protocol look up your accommodations, availability and latest bookings, prepare a quote, or create an accommodation and a draft booking page, within the rights of the WordPress user it acts as. As with any delegated access, security rests on three rules: a dedicated user with minimal rights, human approval for any sensitive action, and the ability to cut off access at any time.
What are we talking about?
- WordPress Abilities are a programming interface built into WordPress core since version 6.9. A plugin declares “abilities” there: a name, a description, the expected input, the returned data and a permission check (see the WordPress core team's notes on the Abilities API).
- MCP (Model Context Protocol) is an open protocol that lets an AI assistant discover and call external tools in a standardised way.
- An MCP adapter makes the connection: it presents a WordPress site's Abilities as tools that an MCP client (a desktop AI assistant, an agent, a code editor) can use.
In other words: GDA Kraft Booking describes what it can do, WordPress controls who is allowed to do it, and the AI assistant calls those functions on behalf of a specific user.
AI control is included in the edition downloaded from your Kraft GDA customer area (free account): no add-on to install (see Why create a Kraft GDA account?). WordPress 6.9 or later is required: on an earlier version, no function is declared.
What do you need to install to connect an AI?
GDA Kraft Booking declares its functions but does not include an MCP server: for an AI assistant to connect, you add an MCP adapter plugin to the site. Three steps:
- WordPress 6.9 or later, with the GDA Kraft Booking edition downloaded from your Kraft GDA client area (free account).
- An MCP adapter on the same site, for example the official MCP Adapter plugin published by WordPress.org, or a third-party adapter such as Novamira. Kraft Booking's functions appear there automatically, with no setup on our side.
- Your AI assistant (Claude, ChatGPT or an MCP-compatible code editor), connected to the adapter as its documentation explains, using a dedicated WordPress user (see below).
Without an MCP adapter, nothing is exposed to an AI: the functions stay declared and inactive.
Which functions are available?
During the public beta, the following functions are exposed. The sample requests are for illustration only.
| Function | Sample request | Type | Risk level |
|---|---|---|---|
| Site overview | “Give me an update on my booking site” | Read | Low |
| List and details of accommodations | “Which accommodations are set up, and with what capacity?” | Read | Low |
| Availability | “Is the cottage free from 14 to 21 August?” | Read | Low |
| Quote | “How much is a week in July for 4 people?” | Read | Low |
| Latest bookings, without personal data | “How many bookings this week, and for which dates?” | Read | Low |
| Design components | “Which components can I place on a page?” | Read | Low |
| Create or edit an accommodation | “Create a Garden Studio accommodation for 2 people” | Write | Medium, review it |
| Add a unit (site connected to Kraft GDA) | “Add a unit to this accommodation” | Write | Medium, review it |
| Create a draft booking page | “Prepare a booking page for the studio” | Write, as a draft | Low, nothing is published |
These functions do not cover cancellations, refunds or sending emails to customers: you still do those yourself in the admin or in Kraft Console. The main benefit, for a manager or an agency, is saving time on look-ups, quotes and setting up a new accommodation, while keeping control over publication.
How do you set up safe access?
1. Create a dedicated user
Never connect an AI assistant with your administrator account. Create a specific WordPress user, with the most restricted role that allows the intended use. Each Ability's permission check relies on WordPress roles and capabilities: a user without management rights cannot trigger a management action, even if the assistant asks it to.
2. Start with read-only use
Begin with look-up use cases. Only move on to actions once you have seen, over several weeks, that the answers are reliable.
3. Require human approval for sensitive actions
Set your MCP client to ask for your confirmation before every tool call that changes data. This applies in particular to:
- creating or editing an accommodation: check capacity, description and rates before opening bookings;
- adding a unit, which creates one more bookable unit;
- the booking page created as a draft: review it before publishing it yourself.
4. Protect personal data
The “latest bookings” function returns bookings without personal data: guests' names and contact details are not passed to the assistant. This is consistent with GDA Kraft Booking's approach of keeping this data on your WordPress site (see GDPR and personal data). Stay careful all the same: do not paste information about your customers into the conversation yourself, as everything you type is sent to the AI model provider. Check its privacy policy before professional use.
5. Stay in control
- Revoke the dedicated user's access (application password, token or account) as soon as it is no longer needed.
- Review the accommodations created or edited after a working session with the assistant.
- Do not hand an assistant a commercial or legal decision (cancellation policy, dispute).
What about the security of the plugin itself?
GDA Kraft Booking's write operations rely on a signed authorisation, renewed automatically by Global Digital Agency's Kraft GDA platform: if the site switches to read-only mode, only the accommodation record can still be edited, and the AI is subject to the same limits (adding a unit, for example, is blocked; see Read-only mode and reconnection). The functions never delete anything. Payments are still processed on the Stripe-hosted page: no card number passes through your site or the assistant, and no exposed function triggers a payment or a refund.
For the property manager, day-to-day monitoring remains simpler in Kraft Console, without any additional tool.
Frequently asked questions
Do I need a particular AI assistant?
You need WordPress 6.9 or later, an MCP adapter installed on the site (for example MCP Adapter or Novamira: GDA Kraft Booking does not include an MCP server) and an MCP-compatible assistant such as Claude or ChatGPT. Follow the adapter's documentation to connect your assistant.
Can the AI perform an action my user is not allowed to perform?
No. Each Ability checks the permissions of the WordPress user on whose behalf the assistant acts. This is why choosing a dedicated user with minimal rights is essential.
Is this required to use GDA Kraft Booking?
No. AI control is an extra option, included in the edition downloaded from your customer area; every function remains available in the admin and in Kraft Console.
Are the AI's answers always accurate?
Not necessarily. An assistant can misinterpret a request. Check any important information in the interface before acting, and never let an irreversible action go ahead without reviewing it.
GDA Kraft Booking is available for free on WordPress.org. View on WordPress.org