Cowboy MCP vs Enable Abilities for MCP

What is Enable Abilities for MCP?

Enable Abilities for MCP is a free WordPress plugin that registers a large set of abilities — posts, pages, menus, WooCommerce, SEO, translations, LMS courses — and leaves serving them to the official MCP Adapter plugin. It is the work of one developer, Fabio Montenegro, was added to the WordPress.org directory on 24 March 2026 and is at version 2.15.0 (6 November 2026). The listing shows 6,000+ active installs and seventeen reviews, all five stars. It needs WordPress 6.9 or newer and PHP 8.0, and does nothing on its own until the MCP Adapter is installed beside it.

Its strengths are real:

• Everyone signs in as themselves. Its OAuth connector for claude.ai and its Application Password route both run as the WordPress user who connected, so an editor or an author can connect their own AI app and get exactly what their role allows.
• Coverage Cowboy MCP does not have. Polylang and WPML translations, LearnDash and Tutor LMS courses, JetEngine queries and the Code Snippets plugin each have their own abilities.
• Close to core. Every ability is a standard WordPress ability served by the official adapter, and it adds on/off switches for abilities that other plugins register.
• Careful with code. A snippet the AI writes is saved inactive, and an administrator must approve that exact code in wp-admin before it runs.
• Multisite. Each subsite gets its own connector.
• An active maintainer. The changelog shows frequent releases and security fixes credited to outside reports.

How do Cowboy MCP and Enable Abilities for MCP differ?

Both are free and both run entirely on your own site. The difference is what sits around the actions: Enable Abilities for MCP is a set of abilities for the official adapter to serve, while Cowboy MCP is a complete server that wraps every write in safety checks and an undo journal.

• The server: Enable Abilities for MCP needs the MCP Adapter plugin, which serves its abilities at /wp-json/mcp/.... Cowboy MCP is its own server at /wp-json/cowboy-mcp/v1/endpoint and needs nothing else, on WordPress 6.2 or newer.
• Going back: Enable Abilities for MCP has no undo journal or dry run; a deleted post goes to the WordPress trash. Cowboy MCP journals every write for seven days, can preview any write as a dry run, and takes full-database checkpoints.
• Who connects: Enable Abilities for MCP lets each WordPress user connect with their own role. Cowboy MCP connections are approved by an administrator and limited per connection instead: Full, Read-only, Drafts only or a custom list of tools.

The table lines them up; every Enable Abilities claim links to a primary source.

Last verified: 8 November 2026, against Enable Abilities for MCP 2.15.0 and Cowboy MCP 1.7.7.

When is Enable Abilities for MCP the better choice?

Enable Abilities for MCP is the better choice when several people will each connect their own AI app, and their WordPress roles should decide what each of them can do. An author who connects gets an author's reach and nothing more, enforced by WordPress's own capability checks on every post.

It is also the better fit in these cases:

• Multilingual or course sites. You run Polylang, WPML, LearnDash, Tutor LMS or JetEngine.
• Official pieces only. You want every action to be a standard WordPress ability served by the official adapter, with nothing but abilities added on top.
• Code snippets with sign-off. You want the AI to draft snippets that an administrator approves before they run.

The tradeoff is the safety net. There is no undo journal, no dry run and no confirmation step for destructive actions outside code snippets, so a wrong bulk edit has to be fixed by hand or from a backup.

When is Cowboy MCP the better choice?

Cowboy MCP is the better choice when the site matters enough that every AI change should be reversible, and you want one plugin rather than two. Every write — a changed price, an edited post, an updated option — goes into the undo journal and can be rolled back on its own or in a batch for seven days by default; the undo guide walks through it. A database checkpoint is taken before plugin and theme updates, safe mode holds destructive tools on the server, and any write can be previewed as a dry run, as the security page sets out.

It also reaches further into running the site: plugin and theme installs and updates, Gutenberg block edits, Wordfence, files, WP-CLI and the database, each behind its own guardrails. And it works on WordPress 6.2 or newer, with no adapter to install. The price is that connections run as the administrator who approved them, limited by scope rather than by each person's role.

Can you run both at the same time?

Yes, and you may not need to connect both. Enable Abilities for MCP registers its abilities with WordPress itself, whether or not the MCP Adapter is installed, and marks them public. On WordPress 6.9 or newer, Cowboy MCP serves public abilities from other plugins as tools, so the abilities you switch on in Enable Abilities for MCP show up in Cowboy MCP's tool list too — translations, LMS and Code Snippets included. Those calls run under each ability's own permission check, appear in Cowboy MCP's audit log, and are marked as not undoable, because Cowboy MCP cannot capture the state before another plugin's action.

If you keep both connected separately, they use different endpoints and different tokens. Cowboy MCP's own tools are registered as abilities as well, so the adapter can list them; each plugin reverses only the changes made through its own tools.

FAQ