Cowboy MCP 1.6.6: a rate-limit fix behind the connection errors, plus scheduling and smaller fixes

By Andrew Ivanov · Last updated 2026-09-12

Cowboy MCP 1.6.6 is a round of bug fixes, and the biggest one lives under the single most common complaint about every WordPress MCP plugin: "couldn't reach the server." Some of that is the host or a firewall, which no plugin controls. But one cause was ours, and this release removes it.

The connection fix

WordPress asks a REST endpoint "is this request allowed?" several times while it handles a single call — once to build the list of allowed methods, again to match the handler, again to dispatch. Cowboy's guard against password-guessing counted every one of those as a separate request. So the per-IP limit that reads as "30 a minute" was really closer to seven, and a connector that opens with a short burst of calls — which Claude, ChatGPT, and Cursor all do — could exhaust it during the handshake and get turned away before it ever authenticated.

Two changes fix it. The limiter now decides once per request instead of several times, so the budget you see is the budget you get. And it counts only failed sign-in attempts, so a client holding a valid key is governed by its own generous per-key limit and can never trip the anti-guessing guard at all. The protection against credential stuffing is unchanged; it just stops catching the people it was never meant to catch.

Logged-out OAuth connections

If you started a connection from Claude or another OAuth client while you were signed out of wp-admin, WordPress sent you to the login screen first — and the trip through login was quietly mangling the encoded connection details, so the flow could not resume after you signed in. It is fixed. Thanks to @lukaszliniewicz for finding it and sending the fix.

What else is fixed

Scheduled publishing works. Ask your agent to publish a post next Tuesday at 9am and it schedules for then. wp_create_post and wp_update_post now take a date — "YYYY-MM-DD HH:MM:SS" in your site's timezone, or an ISO 8601 timestamp with an offset — and update accepts the "future" status.
The database health report counts autoloaded options correctly. WordPress 6.6 changed how it marks options for autoloading, and the report had been reading the old marker only, so the numbers came out low on current WordPress.
The Activity tab records the outcome of every call. Each tool call now shows whether it succeeded, failed, or errored, so the log you hand a client is complete.
Cache tools are always available. They no longer require WP Rocket, LiteSpeed, or W3 Total Cache to appear. Without one of those, "flush cache" clears WordPress's own object cache and expired transients instead of the tool being missing.

Update

Cowboy MCP updates itself from your WordPress dashboard like any other plugin. If your connection had been dropping during setup, this is the release to update to. Read the full 1.6.6 changelog on WordPress.org.