AcrossAI Abilities Manager gives your WordPress site 357 ready-made abilities, and gives you control over every one of them.

An ability is a self-describing operation that WordPress 6.9’s Abilities API lets a plugin register — something an AI assistant, a REST client or another plugin can discover and call. WordPress ships the API; almost nothing ships abilities. This plugin does: 357 on any site, with no configuration, rising to over 800 as it detects the plugins you run.

It is free, GPL, and works on its own. Pair it with an MCP server and your site becomes something Claude, ChatGPT, Cursor or any MCP-capable assistant can operate.

What Your Site Can Do, Out of the Box

Content — posts, pages and any custom post type with meta and revisions; comments; media, categories and tags; generating an image from a prompt straight into the Media Library (when an AI connector is configured); and semantic search that proposes, reviews and applies internal links.
Blocks — edit a page’s block tree without rewriting the page, build from patterns, generate sections and landing pages, and audit copy and design.
Appearance — theme.json and global styles, site-editor templates and parts, menus, widget areas, fonts, and site title, logo and icon.
Users — create and edit users, reset passwords, create roles, and grant or revoke individual capabilities.
Configuration — any option including values nested inside serialised arrays, permalinks, and which admin screen a setting lives on.
Database — schema and table sizes, index health, bloated autoloaded options, EXPLAIN on a slow query, table optimisation, and serialisation-safe search-and-replace.
Files — browse, read, write and delete inside an administrator-defined allowlist; zip backups; wp-config constants; the debug log.
Cron — every scheduled task, the overdue ones, running one on demand, and whether WP-Cron is firing at all.
Updates — plugins, themes and core; rollback; and verification against official checksums.
Diagnostics — Site Health, maintenance mode, recent fatal errors, and un-pausing what WordPress auto-disabled.
Cache — transients, object cache and rewrite rules.

A Dozen Tools, Not 357

An AI client is handed its tool list once, at connect time, and pays for it out of the context window on every conversation. Exposing 357 separate tools would flood it — most assistants degrade past a few dozen.

So your MCP server groups them into toolsets, and a toolset is a single tool answering three actions: discover to list what it holds, info to read one ability’s parameters, and execute to run it — the same three everywhere. AcrossAI MCP Manager provides that layer; this plugin provides the abilities.

Plugins You Already Run Get Their Own Toolset

Twenty-one integrations ship with the plugin, each with its own page in the integrations directory — and each registers only when that plugin is active, so nothing appears for software you do not have, and each becomes one more dispatcher tool rather than a pile of loose ones. They are listed on the plugin’s own Integrations screen (under AcrossAI), where a single switch turns any one’s abilities on or off.

Elementor (89 abilities) — pages, templates, kits, widgets, form submissions and cache; a subset needs Elementor Pro.
Yoast SEO (64) — titles and meta, indexing, breadcrumbs, schema and social defaults.
Rank Math (61) — SEO, redirections, schema, analytics and settings.
LiteSpeed Cache (61) — purge by target, and tune TTLs, exclusions and vary rules.
WooCommerce (34) — catalogue, prices, stock, orders, customers and store health.
Contact Form 7 (25) — forms, fields, mail templates, tag validation and messages.
WPCode (24) — snippets, their insertion points and conditional logic.
CookieYes (22) — cookies, consent categories, the banner and Consent Mode.
The Events Calendar (18) — create, reschedule and trash events; venues and organizers.
Event Tickets (16) — tickets, capacity, check-ins, orders and sales.
Advanced Custom Fields (16) — field groups, plus post types and taxonomies registered through ACF.
Site Kit by Google (14) — Search Console, Analytics 4, PageSpeed Insights and AdSense.
Loco Translate (14) — what is untranslated, and writing translations.
All-in-One WP Migration (9) — what archives exist, how recent, and exporting or removing them.
UpdraftPlus (8) — when a backup last ran, whether it worked, and its contents.
Redirection (8) — create, list, update and delete redirects; the 404 error log that shows which URLs need one; redirect groups; and Redirection’s settings.
WP Mail SMTP (4) — how the site sends mail, and a real test send.
Classic Editor (4) — the effective editor per post type, and whether users may choose.
Query Monitor (4) — profile a URL’s slow and duplicated queries, outbound HTTP calls and PHP errors; the PHP, MySQL and WordPress environment; object-cache status; and turning Query Monitor on or off.
Akismet — spam figures and checking a comment, from Akismet itself.
WPForms — read forms and stats, create forms, change settings; writes behind an admin switch, off by default.

The two backup integrations are deliberate exceptions: they register whether or not their plugin is installed, so “is this site backed up?” can be answered “no, there is no backup plugin here” rather than having no tool to answer it.

Third-party developers can register a toolset of their own through a filter, without touching this plugin.

More Integrations With AcrossAI Pro

The paid AcrossAI Pro add-on contributes 276 further abilities through the same toolset mechanism, again only when the host plugin is active:

MailerPress (89 abilities) (Pro) — campaigns, contacts, lists, tags, templates, workflows and settings.
LearnDash (74) (Pro) — courses, lessons, quizzes, enrolment, progress, groups and reporting.
BuddyBoss (60) (Pro) — members, groups, activity, forums, messages, media, connections and moderation.
MailerPress Pro (28) (Pro) — segments, custom fields, webhooks, embed keys and email templates.
GeoDirectory (25) (Pro) — listings, locations, fields, pricing packages and directory pages.

Everything else on this page is free.

Nothing Is Wide Open

Every ability runs WordPress’s own capability check for the calling user, so reaching one through this plugin grants nobody anything they could not already do. On top of that:

Roughly half the catalogue is annotated read-only and only about 13% is flagged destructive, so a look-but-don’t-touch surface is a matter of filtering, not trust.
Higher-risk operations require an explicit confirmation flag before they run.
Search-and-replace is a dry run unless you say otherwise, and skips post GUIDs unless asked.
File access is confined to an administrator-defined path allowlist — an empty write-allowlist means “deny all writes” — with a dangerous-extension blocklist and a maximum write size on top.
Secrets are redacted — database credentials and authentication salts are stripped out of file and debug-log reads.
Database abilities never accept a raw table name; they work from a fixed allowlist of core tables.
Any ability can be disallowed site-wide, and one you turn off is unregistered outright rather than merely hidden.

Full Control Over Every Ability

Browse all abilities — a searchable, sortable, paginated table listing every registered ability with slug, provider, source and current status.
Toggle allow/disallow — enable or disable any ability site-wide with a single click, saved instantly without a page reload.
Edit ability metadata — override readonly, destructive, idempotent, show_in_rest, show_in_mcp, mcp_type and mcp_servers per ability with a tri-state Yes / No / Inherit control, and reset any of it to registry defaults in one click.
Bulk actions — allow, disallow or reset up to 50 abilities at once.
Integrations — a dedicated screen listing every integration on the site, each with a single on/off switch that withdraws this plugin’s abilities for it. Each row shows how many abilities it contributes.
Ability Library — enable or disable add-on ability groups from a dedicated page, with All/Specific mode per group.
Add-ons page — browse companion plugins from wp-admin; WordPress.org-hosted ones install and activate in place.

Overrides live in their own table. The ability registry is never modified — only fields that differ from registry defaults are stored, so removing the plugin leaves it exactly as found.

Reproduce a Plugin Conflict Without Breaking the Site

Debugging Conflict Testing toggles any plugin’s effective active state without ever writing to wp_options.active_plugins — reproduce a conflict for one browser session, then restore the site exactly by clearing a single JSON file.

Seven abilities expose the same thing to REST and AI clients, so an assistant can bisect a conflict for you. Each activation is guarded by a core-style sandbox probe, so a fatal-erroring plugin cannot take the site down — the override is refused instead.

Works With or Without an MCP Server

Abilities are the capability layer, not the connection. Every one is registered through WordPress 6.9’s own Abilities API with show_in_rest, so it is reachable over REST and callable by any plugin the moment you activate this one. Nothing is proprietary or bound to a particular transport, so anything that reads the Abilities API can expose these abilities — there is no lock-in:

AcrossAI MCP Manager — the free MCP server this plugin is built alongside, turning the toolsets into MCP tools with per-server curation and access control.
MCP Adapter — exposes registered abilities as MCP tools; when active, this plugin also lists its servers in the ability edit panel.
Any other consumer — another MCP server, a REST client, or a plugin calling the Abilities API directly. These are ordinary WordPress abilities, not a private format.

Requirements

WordPress 6.9 or later — the Abilities API arrived in 6.9, and this plugin registers nothing without it
PHP 8.1 or later
No other plugin is required

Where To Read More

The plugin — the plugin home page.
Every ability, searchable — one page per ability, rather than a list in a readme.
Integrations — the full integrations directory.
Use cases — real jobs done through an AI assistant, start to finish.
Full changelog — the complete history, including releases trimmed from the Changelog here for length.

External Services

Two external connections, each triggered only by a logged-in administrator, and neither sends your site content, user data or ability data. Disclosed per the WordPress.org plugin directory guidelines:

AcrossAI (acrossai.co) — on the AcrossAI Integrations screen the plugin fetches the list of supported integrations once (a cached GET to https://acrossai.co/wp-json/acrossai/v1/integrations), so the list stays current between releases. No site, user or ability data is sent, and if acrossai.co cannot be reached the screen falls back to a copy bundled with the plugin. AcrossAI admin screens also show images hosted on acrossai.co and link to acrossai.co (the Consultations page links to https://acrossai.co/consultations/); those are contacted by the browser, not the server.
Terms: https://acrossai.co/terms/ · Privacy: https://acrossai.co/privacy-policy/

Google (fonts.googleapis.com, youtube-nocookie.com) — AcrossAI admin screens use Google Fonts, and the optional setup wizard embeds short YouTube walkthrough videos via YouTube’s privacy-enhanced host. Two wizard screens preload a muted clip (so YouTube is contacted when they render); the rest load only when you press play, and every embed is paired with a plain link. No tracking cookies unless a video plays.
Terms: https://policies.google.com/terms · Privacy: https://policies.google.com/privacy

Privacy Policy

This plugin does not itself collect, store, or transmit any personal data.

A few admin-only actions can cause an external service to receive data — all described in the External Services section above, and triggered only by an authenticated administrator:

Opening AcrossAI Integrations fetches the supported-integrations list from acrossai.co (no site, user or ability data is sent).
AcrossAI admin screens load Google Fonts and images hosted on acrossai.co, which receive standard browser metadata only. The Consultations page’s button opens acrossai.co/consultations/ in a new tab.
The optional setup wizard embeds YouTube walkthroughs; YouTube is contacted when a preloaded clip renders or when you press play, and every embed is paired with a plain link.

No data is sent to any external server without an administrator action, and the plugin loads no external script into wp-admin.

AcrossAI Abilities Manager – WordPress Abilities for Claude, ChatGPT & Any AI Agent

About this plugin