內容簡介
AcrossAI Abilities Manager 為您的 WordPress 網站提供 357 種現成的功能，並讓您能夠全面控制這些功能。這個外掛利用 WordPress 6.9 的 Abilities API，讓 AI 助手或其他外掛能夠輕鬆發現並調用這些功能，無需任何配置。
【主要功能】
• 提供 357 種現成的功能
• 支援內容管理，包括文章、頁面及自訂文章類型
• 用戶管理，創建、編輯用戶及角色
• 配置選項，包括序列化數組內的值
• 數據庫優化，檢查索引健康及慢查詢
• 支援定時任務管理及更新管理
外掛標籤
開發者團隊
② 後台搜尋「AcrossAI Abilities Manager – WordPress Abilities for Claude, ChatGPT & Any AI Agent」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
AcrossAI Abilities Manager gives your WordPress site 357 ready-made abilities, and gives you control over every one of them.
An ability is a self-describing operation that WordPress 6.9’s Abilities API lets a plugin register — something an AI assistant, a REST client or another plugin can discover and call. WordPress ships the API; almost nothing ships abilities. This plugin does: 357 on any site, with no configuration, rising to over 800 as it detects the plugins you already run.
It is free, GPL, and works on its own. Pair it with an MCP server and your site becomes something Claude, ChatGPT, Cursor or any MCP-capable assistant can operate.
What Your Site Can Do, Out of the Box
Content — posts, pages and any custom post type with meta and revisions; comments; media, categories and tags; and semantic search that proposes, reviews and applies internal links.
Blocks — edit a page’s block tree without rewriting the page, build from patterns, generate sections and landing pages, and audit copy and design.
Appearance — theme.json and global styles, site-editor templates and parts, menus, widget areas, fonts, and site title, logo and icon.
Users — create and edit users, reset passwords, create roles, and grant or revoke individual capabilities.
Configuration — any option including values nested inside serialised arrays, permalinks, and which admin screen a setting lives on.
Database — schema and table sizes, index health, bloated autoloaded options, EXPLAIN on a slow query, table optimisation, and serialisation-safe search-and-replace.
Files — browse, read, write and delete inside an administrator-defined allowlist; zip backups; wp-config constants; the debug log.
Cron — every scheduled task, the overdue ones, running one on demand, and whether WP-Cron is firing at all.
Updates — plugins, themes and core; rollback; and verification against official checksums.
Diagnostics — Site Health, maintenance mode, recent fatal errors, and un-pausing what WordPress auto-disabled.
Cache — transients, object cache and rewrite rules.
A Dozen Tools, Not 357
An AI client is handed its tool list once, at connect time, and pays for it out of the model’s context window on every conversation. Exposing 357 separate tools would flood it — most assistants degrade past a few dozen.
So your MCP server groups them into toolsets, and a toolset is a single tool answering three actions: discover to list what it holds, info to read one ability’s parameters, and execute to run it — the same three everywhere. AcrossAI MCP Manager provides that layer; this plugin provides the abilities.
Plugins You Already Run Get Their Own Toolset
Nineteen integrations ship with the plugin, each with its own page under https://acrossai.co/integrations/ — and each registers only when that plugin is active, so nothing appears for software you do not have, and each becomes one more dispatcher tool rather than a pile of loose ones.
Elementor (89 abilities) — pages, templates, kits, global widgets, form submissions and its cache. A Pro subset needs Elementor Pro.
Yoast SEO (64) — titles and meta, indexing, breadcrumbs, the knowledge graph, social defaults and schema.
Rank Math (61) — on-page and site-wide SEO, redirections, schema, analytics and settings.
LiteSpeed Cache (61) — purge by target, URL, post or taxonomy, and tune TTLs, exclusions and vary rules.
WooCommerce (34) — catalogue, prices, stock, orders, customers and store health.
Contact Form 7 (25) — forms, fields, both mail templates, tag validation and messages.
WPCode (24) — snippets of every type, where each is inserted, and its conditional logic.
CookieYes (22) — declared cookies, consent categories, the banner, its languages and Google Consent Mode.
The Events Calendar (18) — find, create, reschedule and trash events; manage venues and organizers.
Event Tickets (16) — tickets, real capacity including shared pools, check-ins, orders and sales.
Advanced Custom Fields (16) — field groups, and post types and taxonomies registered through ACF.
Site Kit by Google (14) — Search Console analytics, Analytics 4 reports, PageSpeed Insights and AdSense, plus what is actually connected.
Loco Translate (14) — what can be translated, what is untranslated, and writing translations.
All-in-One WP Migration (9) — what archives exist, how recent they are, and exporting or removing them.
UpdraftPlus (8) — when a backup last ran, whether it worked, and what each set contains.
WP Mail SMTP (4) — how the site sends mail, whether it can, and a real test send.
Classic Editor (4) — the effective editor per post type, which layer decided it, and whether users may choose.
Akismet — spam figures and checking a comment. These abilities come from Akismet itself.
WPForms — read forms and statistics, create forms, change settings. Writes sit behind an admin switch, off by default.
The two backup integrations are deliberate exceptions: they register whether or not their plugin is installed, so “is this site backed up?” can be answered “no, there is no backup plugin here” rather than having no tool to answer it.
Third-party developers can register a toolset of their own through a filter, without touching this plugin.
More Integrations With AcrossAI Pro
The paid AcrossAI Pro add-on contributes 276 further abilities through the same toolset mechanism, again only when the host plugin is active:
MailerPress (89 abilities) (Pro) — campaigns, contacts, lists, tags, templates, workflows and settings.
LearnDash (74) (Pro) — courses, lessons, quizzes, enrolment, progress, groups and reporting, plus the Certificates, Notifications and WooCommerce add-ons.
BuddyBoss (60) (Pro) — members, groups, activity, forums, messages, media, connections and moderation.
MailerPress Pro (28) (Pro) — segments, custom fields, webhooks, embed keys and email templates.
GeoDirectory (25) (Pro) — listings, locations, fields, pricing packages and directory pages.
Everything else on this page is free.
Nothing Is Wide Open
Every ability runs WordPress’s own capability check for the calling user, so reaching one through this plugin grants nobody anything they could not already do. On top of that:
Roughly half the catalogue is annotated read-only and only about 13% is flagged destructive, so a look-but-don’t-touch surface is a matter of filtering, not trust.
Higher-risk operations require an explicit confirmation flag before they run.
Search-and-replace is a dry run unless you say otherwise, and skips post GUIDs unless asked.
File access is confined to an administrator-defined path allowlist — an empty write-allowlist means “deny all writes” — with a dangerous-extension blocklist and a maximum write size on top.
Secrets are redacted — database credentials and authentication salts are stripped out of file and debug-log reads.
Database abilities never accept a raw table name; they work from a fixed allowlist of core tables.
Any ability can be disallowed site-wide, and one you turn off is unregistered outright rather than merely hidden.
Full Control Over Every Ability
Browse all abilities — a searchable, sortable, paginated table listing every registered ability with slug, provider, source and current status.
Toggle allow/disallow — enable or disable any ability site-wide with a single click, saved instantly without a page reload.
Edit ability metadata — override readonly, destructive, idempotent, show_in_rest, show_in_mcp, mcp_type and mcp_servers per ability with a tri-state Yes / No / Inherit control, and reset any of it to registry defaults in one click.
Bulk actions — allow, disallow or reset up to 50 abilities at once.
Ability Library — enable or disable add-on ability groups from a dedicated page, with All/Specific mode per group.
Add-ons page — browse companion plugins from wp-admin; WordPress.org-hosted ones install and activate in place.
Overrides live in their own table. The ability registry is never modified — only fields that differ from registry defaults are stored, so removing the plugin leaves it exactly as found.
Reproduce a Plugin Conflict Without Breaking the Site
Debugging → Conflict Testing toggles any plugin’s effective active state without ever writing to wp_options.active_plugins — reproduce a conflict for one browser session, then restore the site exactly by clearing a single JSON file.
Seven abilities expose the same thing to a REST client or an AI assistant, so an assistant can bisect a conflict for you. Every activation is guarded by a WordPress-core-style sandbox probe, so a fatal-erroring plugin cannot leave the site where every page load dies — the override is refused instead.
Works With or Without an MCP Server
Abilities are the capability layer, not the connection. Every one is registered through WordPress 6.9’s own Abilities API with show_in_rest, so it is reachable over the REST API and callable by any plugin the moment you activate this one. Nothing here is proprietary, and nothing is bound to a particular transport.
That means anything which reads the Abilities API can expose these abilities — there is no lock-in:
AcrossAI MCP Manager — the free MCP server this plugin is built alongside. Turns the toolsets into MCP tools with per-server curation and access control.
MCP Adapter — the WordPress MCP Adapter exposes registered abilities as MCP tools. When it is active, this plugin also lists its servers in the ability edit panel.
Any other consumer — another MCP server, a REST client, or a plugin calling the Abilities API directly. Abilities registered here are ordinary WordPress abilities, not a private format.
Requirements
WordPress 6.9 or later — the Abilities API arrived in 6.9, and this plugin registers nothing without it
PHP 8.1 or later
No other plugin is required
Where To Read More
The plugin — https://acrossai.co/abilities-manager/
Every ability, searchable — https://acrossai.co/abilities/ — one page per ability, rather than a list in a readme.
Integrations — https://acrossai.co/integrations/
Use cases — https://acrossai.co/use-cases/ — real jobs done through an AI assistant, start to finish.
Full changelog — https://acrossai.co/changelog/acrossai-abilities-manager/ — including releases trimmed from the Changelog here for length.
External Services
This plugin’s own code makes no external HTTP requests. Each connection below is triggered by a specific admin-only action, and is disclosed per the WordPress.org plugin directory guidelines. In every case the plugin sends no site content, user data or ability data.
1. Calendly (calendly.com) — a third-party scheduling service.
When: never on render. The Consultations page loads no Calendly script, iframe, cookie or asset; Calendly is reached only if an administrator clicks “Book a Consultation”, opening the booking page in a new tab.
Data: only the browser’s standard metadata (IP, User-Agent, referrer) on that click. Anything typed into Calendly’s own form is processed by Calendly; this plugin never intercepts or stores it.
Note: that page also references Google Fonts (fonts.googleapis.com), its only external asset.
Terms: https://calendly.com/pages/terms · Privacy: https://calendly.com/pages/privacy
2. WordPress.org plugin directory (api.wordpress.org, downloads.wordpress.org) — installs free companion plugins from the Add-ons page.
When: only when an administrator with install_plugins clicks Install on a card sourced from WordPress.org, always through core’s own plugins_api() and Plugin_Upgrader. Add-ons hosted elsewhere render as plain links; nothing is requested from those vendors.
Data: core’s standard plugin-API payload — site URL, WordPress version, PHP version, locale.
Terms: https://wordpress.org/about/terms/ · Privacy: https://wordpress.org/about/privacy/
3. WordPress.org core version-check (api.wordpress.org/core/version-check/1.7/)
When: only when an administrator invokes the core/rollback-wp-core ability and the local cache has expired — at most once per day, per locale, per site.
Data: core’s standard version-check payload. Same terms and privacy policy as service 2.
4. YouTube walkthrough videos (youtube-nocookie.com, youtube.com) — short recordings embedded in the setup wizard, via YouTube’s privacy-enhanced host.
When: only on the wizard’s own screens, gated on the quick-connect parameter and loaded nowhere else in wp-admin. Two screens autoplay, so YouTube is contacted on render; the rest show a local placeholder and embed only when play is pressed.
Data: the browser’s standard metadata plus a Referer limited to the site’s origin, because a strict-origin-when-cross-origin policy keeps the wp-admin path private. No tracking cookies unless playback begins.
Avoiding it: every embed is paired with a plain link, and the wizard is optional — every screen offers Exit setup.
Terms: https://www.youtube.com/t/terms · Privacy: https://policies.google.com/privacy
5. GitHub (github.com) — the wizard links to MCP Adapter’s latest release, which is distributed there rather than on WordPress.org.
When: never on render; only if an administrator clicks the link. The plugin makes no request to GitHub and downloads nothing.
Data: standard browser metadata only, as with any external link.
Terms: https://docs.github.com/site-policy/github-terms/github-terms-of-service · Privacy: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Privacy Policy
This plugin does not itself collect, store, or transmit any user data to any third party.
Several admin-only actions can cause external services to receive data — all are described in the External Services section above and are triggered only by an authenticated administrator:
The AcrossAI → Consultations admin page displays a static call-to-action button. Merely loading the Consultations page sends no data to Calendly — no Calendly script, iframe, or asset is loaded inside wp-admin. If the administrator clicks the CTA button, their browser opens calendly.com/acrossai/using-ai-in-wordpress in a new tab, at which point standard browser metadata (IP, User-Agent, referrer) is sent to Calendly and Calendly’s own privacy policy applies. If they then book a consultation on Calendly’s site, information they enter into Calendly’s form (name, email, meeting details) is transmitted to Calendly.
Installing a WordPress.org-hosted add-on from the AcrossAI → Add-ons page contacts the WordPress.org plugin directory via WordPress core’s own plugins_api() and Plugin_Upgrader (api.wordpress.org + downloads.wordpress.org). Add-ons distributed elsewhere (e.g. GitHub, Freemius) are rendered as external “Get add-on ↗” links that open the vendor’s site in a new browser tab — the plugin itself does not download or install those add-ons, so no request is sent to the vendor’s servers from wp-admin. If the administrator clicks the external link, their browser navigates directly to the vendor and standard browser metadata (IP, User-Agent, referrer) is sent to the vendor as with any external hyperlink.
Invoking the core/rollback-wp-core ability contacts the WordPress.org core version-check API (a WordPress-core-hosted service) via the standard WordPress update API.
No data is sent to any external server without an explicit administrator action.
