Cowboy MCP 1.6.4: WordPress Abilities API bridge, in both directions

By Andrew Ivanov · Last updated 2026-08-27

Cowboy MCP 1.6.4 connects the plugin to WordPress's Abilities API in both directions. Every tool your settings allow is now registered as a cowboy-mcp/* ability, so WP-CLI, the core REST endpoint, the official MCP Adapter, and WordPress's own AI tooling can call Cowboy's tools — with safe mode, dry run, the audit log, and per-change undo applied to every caller. And the abilities other plugins register — WooCommerce's order and product abilities, core's read abilities — show up as tools your agent can discover and run through the same endpoint.

What this means for you

Until now Cowboy MCP was a self-contained toolset: complete if you connect an MCP client, invisible to everything else in the WordPress AI ecosystem. WordPress 6.9 introduced the Abilities API as the standard way for plugins to expose capabilities, and a growing set of consumers — wp ability run, the /wp-abilities/v1 REST route, the MCP Adapter that plugins such as Rank Math already bundle, the AI plugin's abilities explorer — can call anything registered there. With 1.6.4 those consumers get Cowboy's tools with the guardrails attached, and your MCP agent gets whatever the rest of your plugins register. The bridge needs WordPress 6.9 or newer; on older versions it stays inert and nothing else changes.

What's new

Cowboy tools as abilities. Every tool your settings allow is registered as cowboy-mcp/<tool-name> — the code-execution tools only when Power mode is on. Whoever calls, whether WP-CLI, REST, or the MCP Adapter, goes through Cowboy's own dispatch: safe mode confirmation, dry run, audit log, undo journal.
Other plugins' abilities as tools. Abilities with a public exposure flag appear in a new abilities category, discoverable through cowboy_discover and callable through cowboy_run; read-only abilities honour read-only credentials. They run their own permission checks and are not undoable.
Two switches. Settings → Cowboy MCP gains "Expose tools as abilities" and "Use abilities from other plugins", both on by default.
Connection Doctor reports the bridge: how many tools are registered and withheld, how many inbound abilities are visible, and whether an MCP Adapter is present.
A welcome notice after activation that points a fresh install to the Connection tab, and a one-time feedback prompt once the plugin has done real work on your site — a thumbs-up leads to the WordPress.org review form, a thumbs-down to a support topic. Dismissible, snoozes, never nags.
Fixes: custom key scopes accept Abilities API names; wp_update_option and wp_list_changes declare the value types they accept.

Try it

From WP-CLI on any WordPress 6.9+ site with the plugin active:

wp ability run cowboy-mcp/wp-site-info --user=admin

From your MCP client, with WooCommerce installed: "Which abilities does WooCommerce register on this site? Add a note to order 1042 saying the parcel shipped today."

Read the full 1.6.4 changelog on WordPress.org.