Cowboy MCP News

Cowboy MCP 1.6.5: no more half-written mu-plugins

2026-09-07T00:00:00Z

Cowboy MCP 1.6.5 is a small release about one bad afternoon. A user asked their agent for a quick fix, the agent wrote a temporary must-use plugin, and the file that reached the disk was incomplete. WordPress loads everything in mu-plugins on every request, so the site went down, wp-admin went down, and so did the MCP endpoint that holds the undo journal that would have reversed it. The agent could not repair what it had broken, and the user fixed it by hand over SFTP. This release makes that sequence impossible from the file tool.

What this means for you

Two things now stand between an agent's payload and your server. First, every PHP file goes through PHP's own parser before a single byte is written; a cut-off or malformed file is refused with the line number, the agent sees exactly why, and nothing changes on disk. Second, the mu-plugins folder is off-limits unless an administrator has turned on Power mode in wp-admin. Regular plugins and themes are still fair game, because WordPress recovery mode can pause those when they fatal, and the undo journal can roll them back. Must-use plugins get neither safety net, which is why they now need a human's say-so. Neither guard adds noticeable latency: the syntax check takes about a millisecond per 80 KB of PHP.

We chose Power mode rather than a safe mode confirmation on purpose. A confirmation prompt is answered by the agent, not by you, so it would have changed nothing that day. And gating on safe mode would push people to switch safe mode off site-wide for one file, which loses far more than it protects. Power mode is the existing admin-only switch for exactly this kind of "I know what I am doing" job, and it leaves safe mode untouched.

What's new

PHP syntax check on every write. wp_write_file refuses PHP content that does not parse and reports the error with its line number; the original file, if any, is untouched. CSS, JavaScript, and other files are not affected.
mu-plugins needs Power mode. Writes anywhere under wp-content/mu-plugins are refused unless Power mode is on. The refusal tells the agent to ship the code as a regular plugin and activate it with wp_activate_plugin instead, which is what it should have done in the first place.
Honest dry runs. A dry run of a file write now runs the same checks and says "would be refused" with the reason, rather than a generic preview.
Short writes fail cleanly. If the disk is full or a quota hits mid-write, the tool reports a failure instead of renaming a truncated file into place.
The agent is told up front. The connection instructions every MCP client receives now carry the rule, so a well-behaved agent never tries mu-plugins on a site that has not opened it.

Try it

Ask your agent for something that used to be risky: "Add a small plugin that removes the WordPress version from the page head, activate it, and check the error log." The agent writes it under plugins/, the file is parsed before it lands, activation is fatal-safe, and the whole change sits in the undo journal.

Read the full 1.6.5 changelog on WordPress.org.

Cowboy MCP 1.6.4: the WordPress Abilities API bridge

2026-08-27T00:00:00Z

Cowboy MCP 1.6.4 connects the plugin to WordPress's Abilities API in both directions. Every tool your settings allow is now registered as a cowboy-mcp/* ability, so WP-CLI, the core REST endpoint, the official MCP Adapter, and WordPress's own AI tooling can call Cowboy's tools — with safe mode, dry run, the audit log, and per-change undo applied to every caller. And the abilities other plugins register — WooCommerce's order and product abilities, core's read abilities — show up as tools your agent can discover and run through the same endpoint.

What this means for you

Until now Cowboy MCP was a self-contained toolset: complete if you connect an MCP client, invisible to everything else in the WordPress AI ecosystem. WordPress 6.9 introduced the Abilities API as the standard way for plugins to expose capabilities, and a growing set of consumers — wp ability run, the /wp-abilities/v1 REST route, the MCP Adapter that plugins such as Rank Math already bundle, the AI plugin's abilities explorer — can call anything registered there. With 1.6.4 those consumers get Cowboy's tools with the guardrails attached, and your MCP agent gets whatever the rest of your plugins register. The bridge needs WordPress 6.9 or newer; on older versions it stays inert and nothing else changes.

What's new

Cowboy tools as abilities. Every tool your settings allow is registered as cowboy-mcp/<tool-name> — the code-execution tools only when Power mode is on. Whoever calls, whether WP-CLI, REST, or the MCP Adapter, goes through Cowboy's own dispatch: safe mode confirmation, dry run, audit log, undo journal.
Other plugins' abilities as tools. Abilities with a public exposure flag appear in a new abilities category, discoverable through cowboy_discover and callable through cowboy_run; read-only abilities honour read-only credentials. They run their own permission checks and are not undoable.
Two switches. Settings → Cowboy MCP gains "Expose tools as abilities" and "Use abilities from other plugins", both on by default.
Connection Doctor reports the bridge: how many tools are registered and withheld, how many inbound abilities are visible, and whether an MCP Adapter is present.
A welcome notice after activation that points a fresh install to the Connection tab, and a one-time feedback prompt once the plugin has done real work on your site — a thumbs-up leads to the WordPress.org review form, a thumbs-down to a support topic. Dismissible, snoozes, never nags.
Fixes: custom key scopes accept Abilities API names; wp_update_option and wp_list_changes declare the value types they accept.

Try it

From WP-CLI on any WordPress 6.9+ site with the plugin active:

wp ability run cowboy-mcp/wp-site-info --user=admin

From your MCP client, with WooCommerce installed: "Which abilities does WooCommerce register on this site? Add a note to order 1042 saying the parcel shipped today."

Read the full 1.6.4 changelog on WordPress.org.

Cowboy MCP 1.6.3: local development, first-class

2026-08-20T00:00:00Z

Cowboy MCP 1.6.3 is about the site on your laptop. A local WordPress install — Local, Studio, MAMP, DevKinsta, or anything on localhost — now works just as well with your AI agent as a live one: Claude Code, Cursor, Codex, and Gemini CLI connect with an API key exactly as they do in production, Claude Desktop connects through a small local bridge, and the plugin's own tooling knows which is which. The release is also tested against WordPress 7.1.

What this means for you

Until now the Connection tab and Connection Doctor assumed a public HTTPS site, so on a local install you got a fail for "hostname not publicly reachable" and a Claude Desktop setup that could not work without a tunnel. This release makes local development a first-class story: the plugin recognises a local site, tells you per client what works locally and what genuinely needs a public URL, and hands you the right config for each — with no tunnel exposing your dev site while you work.

What's new

Local sites recognised. The Connection tab detects local hostnames and private addresses and shows, per client, what works locally ("Works locally" for terminal agents and Claude Desktop) and what needs a public URL (claude.ai and ChatGPT, because they connect from the vendor's servers).
Claude Desktop on a local site. A ready-to-copy config that bridges Claude Desktop to your local site through mcp-remote, with the key step defaulting to a read-only scope so the safe path is the easy one.
Connection Doctor understands local. Plain HTTP on a local site now passes with local context, and the public-hostname check becomes a warning with fix steps for both local and public setups instead of a failure. The OAuth prerequisite check keeps its hard fail, because the desktop connector really does need a public HTTPS address.
Self-signed certificate help. On loopback hosts the snippets offer a plain-http variant, with a clear warning against disabling TLS verification globally.
WordPress 7.1. Tested with 7.1: the endpoint, handshake, tool catalog, and tool calls all verified on the current release.

Try it

claude mcp add --transport http my-local-site http://mysite.local/wp-json/cowboy-mcp/v1/endpoint --header "Authorization: Bearer YOUR_API_KEY"

Then: "List every page that is still a draft and tell me which ones have no featured image."

Read the full 1.6.3 changelog on WordPress.org.

Cowboy MCP 1.6.2: Gutenberg block editing and scoped keys

2026-08-06T00:00:00Z

Cowboy MCP 1.6.2 teaches your agent the block editor: it can read any post or page as a block tree and make surgical edits — change a heading, move a section, swap a pattern — instead of resending the whole document. It also adds per-credential tool scoping, so each API key or connection gets exactly the access you intend and nothing more. The toolset grows from 153 to 168, and every new write is journaled and undoable like the rest of the plugin.

What this means for you

Until now, asking an agent to tweak one section of a Gutenberg page meant it had to rewrite the page's entire content — slow, token-hungry, and easy to get subtly wrong. This release gives it an editor's hands: it sees the page the way the block editor does and touches only the blocks you asked about. And with scoped keys, you can finally hand a content agent a key that can write posts but can never touch files, users, or the database.

What's new

Gutenberg block editing. Read any post or page as a block tree, then apply batched surgical edits — update, insert, delete, move, replace — addressed by block path. Conflicting edits in one batch are rejected up front, so a bad request changes nothing.
Patterns, templates, and global styles. List, create, update, and delete block patterns (synced or unsynced). On block themes, the agent can also edit site editor templates and template parts — editing a theme template creates an override you can undo back to the theme's original — and update global styles like colors, typography, and spacing.
Per-credential tool scoping. Give each API key or OAuth connection full access, read-only access, or a hand-picked list of tools. Existing credentials keep full access until you change them, and a credential can never widen its own scope — the scope settings are write-protected from the API, even in Power mode.
A hardened WP-CLI safety gate. The command blocklist now tokenizes commands the way the shell parses them, closing quoting and flag-injection bypasses, and SQL passed through WP-CLI is scanned with MySQL versioned comments unwrapped. Commands that cannot be safely parsed are rejected outright.

Try it

Move the testimonials section above the pricing table on the homepage, and make the hero heading say "Ship faster".

Read the full 1.6.2 changelog on WordPress.org.

Cowboy MCP 1.6.1: SEO by chat, users, menus, and safer media

2026-07-26T00:00:00Z

Cowboy MCP 1.6.1 rounds out the core toolset — your agent can now manage users, navigation menus, and the media library — and adds the headline feature: real SEO work on Yoast SEO or Rank Math sites through one unified set of tools. The toolset grows from 137 to 153, and everything new is journaled and undoable like the rest of the plugin.

What this means for you

"Fix my SEO" is one of the most common jobs people hand an AI agent, and until now Cowboy MCP could only tell the agent which SEO plugin was installed. This release gives it hands: it can read and write every post's SEO meta and audit the whole site for problems — using the same tools whether you run Yoast SEO or Rank Math.

What's new

SEO meta management (Yoast SEO & Rank Math). Read and update a post's SEO title, meta description, focus keyword, noindex/nofollow, canonical URL, and Facebook/X social overrides. One vocabulary regardless of which SEO plugin you run — the adapter handles the storage differences, and template variables like %%category%% pass through intact.
Site-wide SEO audits. Scan posts and pages for missing or badly sized meta descriptions, missing focus keywords, over-long titles, and published posts accidentally left noindexed — paginated so it works on big sites.
User management with hard rails. List, create, update, and delete users, including role changes. Granting an administrator-level role, setting a password, or changing a privileged user's email requires Power mode — and an agent can never change its own credentials or remove the last administrator.
Navigation menus. Create and rename classic menus, assign theme locations, and set the whole menu tree in one call.
A safer media library. List attachments — including a missing-alt-text filter, handy for accessibility and image-SEO passes — edit titles, captions, and alt text, and delete attachments knowing the files are moved aside rather than destroyed, so the deletion can be undone from the Activity tab.

SEO changes are journaled like everything else, and on Yoast sites the indexable cache refreshes automatically, so edits show up on the live site immediately.

Try it

Audit my site's SEO and fix the five worst meta descriptions.

Read the full 1.6.1 changelog on WordPress.org.

Cowboy MCP 1.6.0: safe plugin and theme updates by AI agents

2026-07-21T00:00:00Z

Cowboy MCP 1.6.0 lets your AI agent install, update, and delete WordPress plugins and themes — with an automatic file backup, a database checkpoint, and a post-update health check that rolls back automatically if the site breaks. Updates finally get the same safety net as everything else: journaled, undoable, and confirmed before anything destructive runs.

What this means for you

Keeping plugins and themes current is the single most important thing you can do for a WordPress site's security — and also the scariest, because a bad update can take the whole site down. This release removes the fear. Your agent can do the updating for you, and every step is reversible.

What's new

Install, update, and delete plugins and themes. New tools let an agent pull plugins and themes straight from WordPress.org and manage them in place — no WP-CLI and no shell access, just pure PHP.
A real safety net on every update. Before touching anything, the plugin takes a file backup and a database checkpoint. After updating it runs a health check, and if the site is broken it restores the previous version automatically.
Updates show up where you look. Listing your plugins and themes now reports which ones have updates available, so you can see what's outdated at a glance.
Auto-checkpoint, on by default. A new "Auto-checkpoint before plugin & theme updates" setting means a restore point is always waiting, even if you forget to ask for one.
PHP 8.0 and 8.1 fix. A return-type syntax issue that could cause a fatal error on PHP older than 8.2 is resolved.

Because every install, update, and delete is journaled, wp_undo_change can roll any plugin or theme back to the exact version it was before.

Try it

Update all plugins — back up first.

Read the full 1.6.0 changelog on WordPress.org.

Cowboy MCP 1.5.3: Connection Doctor, a one-click self-test

2026-07-20T00:00:00Z

If your AI agent can't reach your WordPress site, Cowboy MCP 1.5.3 tells you exactly why. The new Connection Doctor runs a one-click self-test from the Connection tab and names the likely culprit, instead of leaving you to guess.

What this means for you

Connection problems are the most frustrating part of setting up any MCP server: the agent just says "can't connect," and you're left wondering whether it's your host, a security plugin, or a typo. Connection Doctor turns that dead end into a checklist. It tests the four things that actually break connections — HTTPS, whether your site is publicly reachable, whether the REST API is available, and whether OAuth discovery works — and reports what passed and what didn't.

When something fails, it doesn't just say "error." It names the likely blocker — Cloudflare, ModSecurity, Basic Auth, or a caching plugin — so you know where to look. And it hands you a copy-pasteable report you can drop straight into a support thread instead of describing the problem from memory.

You can run it three ways: from the Connection tab in wp-admin, as the wp_connection_doctor tool so your agent can diagnose itself, or from the command line.

Try it

wp cowboy-mcp doctor

Read the full 1.5.3 changelog on WordPress.org.

Cowboy MCP 1.5.0: undo for everything your AI agent does

2026-07-08T00:00:00Z

Cowboy MCP 1.5.0 gives every change your AI agent makes an undo button. A new per-change undo journal records what the agent did — posts, options, terms, files, users, media, WooCommerce, and more — and you can roll any of it back from wp-admin.

What this means for you

Handing site work to an AI agent is far easier when you know you can take it back. Before this release, a wrong edit meant restoring from a backup. Now there's a proper undo layer built for the way agents actually work.

A per-change undo journal. The new Activity tab logs every change an agent makes, so you can review it and reverse individual changes one at a time. Conflict detection warns you if something else changed in the meantime.
Database checkpoints. Take a one-click snapshot of your database and restore the whole site to it later. A checkpoint is also taken automatically before any mutating WP-CLI command.
Batch undo. Reverse every change from a single batched request together, in one step.
Six rollback tools for agents. Your agent can list changes, undo a change, and create, list, restore, or delete checkpoints — so it can clean up after itself when you ask.

Your MCP API keys and the plugin's own settings are never touched by an undo or a checkpoint restore, so rolling back can't lock you out of your own site.

Try it

Undo the last five changes you made to the pricing page.

Read the full 1.5.0 changelog on WordPress.org.

Cowboy MCP 1.4.0: on WordPress.org, with one-click sign-in

2026-07-03T00:00:00Z

Cowboy MCP 1.4.0 is the WordPress.org launch: the plugin is now in the official directory, so you can install and update it straight from your dashboard. It also adds one-click sign-in for the Claude desktop and web apps, so you can connect an AI agent to your site without ever opening a terminal.

What this means for you

Being on WordPress.org matters for two reasons. First, installing is now as simple as any other plugin — search, click Install, click Activate — and updates arrive through the normal Plugins screen. Second, the directory review raised the bar on safety: the database tools were changed to use fixed, safe queries instead of free-form SQL, closing off a whole category of risk.

The bigger day-to-day change is one-click sign-in. Instead of generating an API key and pasting an endpoint URL, you enable the Desktop Connector and approve a browser sign-in — the same kind of flow you already use to log into other apps. It's the difference between a five-minute setup and a thirty-second one.

This release also retired the old self-hosted auto-updater, since updates now come through WordPress.org.

A quick follow-up, 1.4.1, built on this with a redesigned connection page: you pick your app — claude.ai, Claude Desktop, ChatGPT, Claude Code, Codex, Cursor, and more — from a sidebar and follow steps tailored to it, including one-click sign-in from ChatGPT.

Try it

Draft a welcome post and publish it to my site.

Read the full 1.4.0 changelog on WordPress.org.