AcrossAI Abilities Manager – WordPress Abilities for Claude, ChatGPT & Any AI Agent

A Dozen Tools, Not 357

An AI client is handed its tool list once, at connect time, and pays for it out of the context window on every conversation. Exposing 357 separate tools would flood it — most assistants degrade past a few dozen.

So your MCP server groups them into toolsets , and a toolset is a single tool answering three actions: discover to list what it holds, info to read one ability’s parameters, and execute to run it — the same three everywhere. AcrossAI MCP Manager provides that layer; this plugin provides the abilities.

Plugins You Already Run Get Their Own Toolset

Twenty-one integrations ship with the plugin, each with its own page in the integrations directory — and each registers only when that plugin is active , so nothing appears for software you do not have, and each becomes one more dispatcher tool rather than a pile of loose ones. They are listed on the plugin’s own Integrations screen (under AcrossAI), where a single switch turns any one’s abilities on or off.

• Elementor (89 abilities) — pages, templates, kits, widgets, form submissions and cache; a subset needs Elementor Pro.
• Yoast SEO (64) — titles and meta, indexing, breadcrumbs, schema and social defaults.
• Rank Math (61) — SEO, redirections, schema, analytics and settings.
• LiteSpeed Cache (61) — purge by target, and tune TTLs, exclusions and vary rules.
• WooCommerce (34) — catalogue, prices, stock, orders, customers and store health.
• Contact Form 7 (25) — forms, fields, mail templates, tag validation and messages.
• WPCode (24) — snippets, their insertion points and conditional logic.
• CookieYes (22) — cookies, consent categories, the banner and Consent Mode.
• The Events Calendar (18) — create, reschedule and trash events; venues and organizers.
• Event Tickets (16) — tickets, capacity, check-ins, orders and sales.
• Advanced Custom Fields (16) — field groups, plus post types and taxonomies registered through ACF.
• Site Kit by Google (14) — Search Console, Analytics 4, PageSpeed Insights and AdSense.
• Loco Translate (14) — what is untranslated, and writing translations.
• All-in-One WP Migration (9) — what archives exist, how recent, and exporting or removing them.
• UpdraftPlus (8) — when a backup last ran, whether it worked, and its contents.
• Redirection (8) — create, list, update and delete redirects; the 404 error log that shows which URLs need one; redirect groups; and Redirection’s settings.
• WP Mail SMTP (4) — how the site sends mail, and a real test send.
• Classic Editor (4) — the effective editor per post type, and whether users may choose.
• Query Monitor (4) — profile a URL’s slow and duplicated queries, outbound HTTP calls and PHP errors; the PHP, MySQL and WordPress environment; object-cache status; and turning Query Monitor on or off.
• Akismet — spam figures and checking a comment, from Akismet itself.
• WPForms — read forms and stats, create forms, change settings; writes behind an admin switch, off by default.

The two backup integrations are deliberate exceptions: they register whether or not their plugin is installed, so “is this site backed up?” can be answered “no, there is no backup plugin here” rather than having no tool to answer it.

Third-party developers can register a toolset of their own through a filter, without touching this plugin.

More Integrations With AcrossAI Pro

The paid AcrossAI Pro add-on contributes 276 further abilities through the same toolset mechanism, again only when the host plugin is active:

• MailerPress (89 abilities) (Pro) — campaigns, contacts, lists, tags, templates, workflows and settings.
• LearnDash (74) (Pro) — courses, lessons, quizzes, enrolment, progress, groups and reporting.
• BuddyBoss (60) (Pro) — members, groups, activity, forums, messages, media, connections and moderation.
• MailerPress Pro (28) (Pro) — segments, custom fields, webhooks, embed keys and email templates.
• GeoDirectory (25) (Pro) — listings, locations, fields, pricing packages and directory pages.

Everything else on this page is free.

Nothing Is Wide Open

Every ability runs WordPress’s own capability check for the calling user, so reaching one through this plugin grants nobody anything they could not already do. On top of that:

• Roughly half the catalogue is annotated read-only and only about 13% is flagged destructive , so a look-but-don’t-touch surface is a matter of filtering, not trust.
• Higher-risk operations require an explicit confirmation flag before they run.
• Search-and-replace is a dry run unless you say otherwise, and skips post GUIDs unless asked.
• File access is confined to an administrator-defined path allowlist — an empty write-allowlist means “deny all writes” — with a dangerous-extension blocklist and a maximum write size on top.
• Secrets are redacted — database credentials and authentication salts are stripped out of file and debug-log reads.
• Database abilities never accept a raw table name; they work from a fixed allowlist of core tables.
• Any ability can be disallowed site-wide , and one you turn off is unregistered outright rather than merely hidden.

Full Control Over Every Ability

• Browse all abilities — a searchable, sortable, paginated table listing every registered ability with slug, provider, source and current status.
• Toggle allow/disallow — enable or disable any ability site-wide with a single click, saved instantly without a page reload.
• Edit ability metadata — override readonly , destructive , idempotent , show_in_rest , show_in_mcp , mcp_type and mcp_servers per ability with a tri-state Yes / No / Inherit control, and reset any of it to registry defaults in one click.
• Bulk actions — allow, disallow or reset up to 50 abilities at once.
• Integrations — a dedicated screen listing every integration on the site, each with a single on/off switch that withdraws this plugin’s abilities for it. Each row shows how many abilities it contributes.
• Ability Library — enable or disable add-on ability groups from a dedicated page, with All/Specific mode per group.
• Add-ons page — browse companion plugins from wp-admin; WordPress.org-hosted ones install and activate in place.

Overrides live in their own table. The ability registry is never modified — only fields that differ from registry defaults are stored, so removing the plugin leaves it exactly as found.

Reproduce a Plugin Conflict Without Breaking the Site

Debugging → Conflict Testing toggles any plugin’s effective active state without ever writing to wp_options.active_plugins — reproduce a conflict for one browser session, then restore the site exactly by clearing a single JSON file.

Seven abilities expose the same thing to REST and AI clients, so an assistant can bisect a conflict for you. Each activation is guarded by a core-style sandbox probe, so a fatal-erroring plugin cannot take the site down — the override is refused instead.

Works With or Without an MCP Server

Abilities are the capability layer, not the connection. Every one is registered through WordPress 6.9’s own Abilities API with show_in_rest , so it is reachable over REST and callable by any plugin the moment you activate this one. Nothing is proprietary or bound to a particular transport, so anything that reads the Abilities API can expose these abilities — there is no lock-in:

• AcrossAI MCP Manager — the free MCP server this plugin is built alongside, turning the toolsets into MCP tools with per-server curation and access control.
• MCP Adapter — exposes registered abilities as MCP tools; when active, this plugin also lists its servers in the ability edit panel.
• Any other consumer — another MCP server, a REST client, or a plugin calling the Abilities API directly. These are ordinary WordPress abilities, not a private format.

Requirements

• WordPress 6.9 or later — the Abilities API arrived in 6.9, and this plugin registers nothing without it
• PHP 8.1 or later
• No other plugin is required

Where To Read More

• The plugin — the plugin home page .
• Every