Cowboy MCP 1.7.6: one entry per connected app, Editors treated like Administrators, and WooCommerce refund fixes

Every time you approve Claude Code, Codex, ChatGPT, Claude or Perplexity, the approval now gets its own row under Connected apps, with its own access level. Editor accounts get the same protection as Administrators, more tools refuse script content by default, and wp_cli database commands are stricter. Two WooCommerce order bugs are fixed, one of them with refunds, and the release carries security hardening throughout. Updating is recommended, and nothing needs doing afterwards.

One entry per connected app

Each approval of Claude Code, Codex, ChatGPT, Claude or Perplexity now appears as its own entry under Connected apps on the Connections tab, with its own access level, Edit access and Revoke. Reconnecting an app adds a new entry with the access you choose on the approval screen. The earlier entry stays listed until it expires, so you can see both and revoke the old one straight away if you no longer need it.

Keys and connections set to custom access now list and read only the resources their access covers.

API keys are also recognised faster. A valid key keeps working while failed attempts from the same IP address are being rate limited, so someone guessing keys can't lock you out. Existing keys are upgraded automatically the first time they are used.

Editors count as a privileged role

On single sites, Editors are now treated like Administrators. Creating an Editor, promoting someone to Editor or changing an Editor's email address needs Power mode, just as it already did for Administrators. An Editor can publish and delete everyone's content, so an agent should not be able to make one without an administrator saying so first.

Stricter defaults for scripts and the database

• More tools refuse script content unless the call passes allow_unfiltered_html: true. The Gutenberg, Elementor and Beaver Builder pages describe how the check works.
• wp_cli database commands are stricter, with and without Power mode. To change options, use wp option.

Fixes

• WooCommerce reports count every order status. Reports filtered by order status now count completed and cancelled orders.
• Order lists work on stores with refunds. Listing WooCommerce orders no longer fails when the store has refunds. The order tools now answer a refund's ID with a clear error. Before, reading or editing a refund through them failed, and deleting one removed the refund.
• Malformed requests get a proper error. They now get a JSON-RPC error instead of a server error.

One new outbound request, during sign-in

Cowboy MCP still sends no telemetry. While a logged-in administrator has the approval screen open for a browser sign-in, your site now fetches the AI app's public description file from that app's own site. The request includes your site's address and the plugin version. It only goes to claude.ai, claude.com, anthropic.com, chatgpt.com, openai.com, perplexity.ai, perplexity.com and nousresearch.github.io, plus any host an administrator has added. The security page is updated to match.

Update

Update from your WordPress dashboard like any other plugin, or install it from WordPress.org. The full changelog is there too.