Fixes the UpdraftPlus and All-in-One WP Migration tools being offered on sites without those plugins installed - they appeared in the tool picker and in what a new MCP server starts with, unlike every other per-plugin toolset. The tools themselves were never broken and still work exactly as before when their plugin is active. If a server already has one of them and the plugin is not installed, "Reset to Type Defaults" clears it. No other changes.<\/p>","0.0.36":"
No breaking changes - every addition here is optional and defaults to what the plugin did before. Worth updating for three things. Listing posts, pages or custom post type items no longer forces the whole post body down the wire: pass fields: "summary" for titles, dates, slugs and a content size instead, measured 36x smaller on ten real posts. The block outline reported the wrong total when truncated - asking for 3 blocks of a 40-block post said "total: 3" - which is now the true match count with a separate "returned" alongside. And Site Health results can be read as plain text with format: "text" rather than WordPress core's own markup. Also adds a check that every ability declares whether it reads, destroys or can be repeated, since an AI client treats a missing flag as "not destructive".<\/p>","0.0.35":"
BREAKING - the BREAKING - abilities now require administrator rights unless a rule says otherwise. If anyone below administrator drives this site through an AI client, they lose access on update until an administrator grants it: set a rule on the individual ability under User Access, or move the site-wide floor with the Bumps the Routes the access-control library-missing warning through the new shared AcrossAI notice hub ( Adds a blue promotional callout on the ability edit form (MCP Exposure section) that advertises the sibling AcrossAI MCP Manager plugin when it is not installed \/ active. The callout links to the AcrossAI Add-ons page for install and to acrossai.co\/mcp-manager\/ for more info. Fully suppressed when the AcrossAI MCP Manager plugin is active. Also bumps the New third-party integration framework (Feature 060) with Advanced Custom Fields as the first concrete integration \u2014 flip one toggle on the new "Acf" tab of the Ability Library page to enable ACF's AI abilities without editing code. Also new: extensibility surface so other AcrossAI plugins can add their own cards to an integration's tab, filterable capability check for the toggle (via BREAKING \u2014 every ability slug has been renamed. Namespace shortens from UI-only release. Replaces the Custom Abilities Bulk Actions dropdown (Publish \/ Unpublish \/ Delete) with Site Access, MCP Exposure, User Access, and Overrides operations that match the per-row edit drawer. Row-level checkbox now works on every ability regardless of Source. Reuses existing REST endpoints; no new database tables, no new endpoints, no PHP changes, no dependency changes, no permission changes. Also fixes a bug that stored composer User Access rule keys with the ability slug's wp.org assets only. Refreshes the banner artwork and renames both banner files from Docs + wp.org assets only. Adds Adds a third ability to the Core tab \u2014 Adds two WordPress-core-scoped abilities under a new "Core" tab in the Ability Library \u2014 Bugfix release. Adds eight new abilities: six under FileManager for zip-based backup \/ restore workflows ( IMPORTANT: this release removes the Freemius integration entirely<\/strong> \u2014 the plugin no longer sends any data to Freemius and no longer offers a Connect \/ Login \/ Buy affordance on the Add-ons page. If you previously connected a Freemius account tied to this plugin, that connection is now inert; stale Adds Library page bulk Enable All \/ Disable All buttons scoped to the active tab, URL-synced tabs ( IMPORTANT: this release absorbs the companion Dependency-only release: refreshes the bundled IMPORTANT for add-on developers: Library display fields Fixes the 0.0.2 activation error on WordPress.org installs \u2014 the release ZIP now includes the Composer autoloader. No functional or user-facing changes vs 0.0.2. If you hit the "Composer autoloader is missing" error on 0.0.2, delete the plugin folder and reinstall 0.0.3.<\/p>","0.0.2":" IMPORTANT: (1) This release does NOT migrate Access Control rules from previous versions. If you had configured any Access Control rules on abilities, audit and reconfigure them after upgrading. Pre-existing rules remain in the database (in the orphaned Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon.svg":{"filename":"icon.svg","revision":3595583,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3614045,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3614045,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.24","0.0.25","0.0.26","0.0.27","0.0.29","0.0.3","0.0.30","0.0.31","0.0.32","0.0.33","0.0.34","0.0.35","0.0.36","0.0.37","0.0.38","0.0.39","0.0.4","0.0.40","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3614043,"resolution":"1","location":"assets","locale":"","width":3268,"height":1874},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3614043,"resolution":"2","location":"assets","locale":"","width":3268,"height":1874},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3614043,"resolution":"3","location":"assets","locale":"","width":3268,"height":1874},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3614043,"resolution":"4","location":"assets","locale":"","width":3268,"height":1874},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3614043,"resolution":"5","location":"assets","locale":"","width":3268,"height":1874},"screenshot-6.png":{"filename":"screenshot-6.png","revision":3614043,"resolution":"6","location":"assets","locale":"","width":3268,"height":1874}},"screenshots":{"1":"The Abilities Manager admin page \u2014 searchable, sortable ability table.","2":"The edit drawer \u2014 tri-state override controls for each ability field.","3":"Bulk actions toolbar for allow\/disallow\/reset across multiple abilities.","4":"The Ability Library page \u2014 enable\/disable add-on ability groups.","5":"The Add-ons page \u2014 browse free companion plugins.","6":"Settings \u2014 Display (abilities-per-page) and Upload Media Abilities (allowed-MIME list + Add file types)."}},"plugin_section":[],"plugin_tags":[251511,148285,216196,229563,242115],"plugin_category":[],"plugin_contributors":[140910],"plugin_business_model":[],"class_list":["post-311005","plugin","type-plugin","status-publish","hentry","plugin_tags-abilities","plugin_tags-ai-assistant","plugin_tags-chatgpt","plugin_tags-claude","plugin_tags-mcp","plugin_contributors-raftaar1191","plugin_committers-raftaar1191"],"banners":{"banner":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/banner-772x250.png?rev=3614045","banner_2x":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/banner-1544x500.png?rev=3614045","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/icon.svg?rev=3595583","icon":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/icon.svg?rev=3595583","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-1.png?rev=3614043","caption":"The Abilities Manager admin page \u2014 searchable, sortable ability table."},{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-2.png?rev=3614043","caption":"The edit drawer \u2014 tri-state override controls for each ability field."},{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-3.png?rev=3614043","caption":"Bulk actions toolbar for allow\/disallow\/reset across multiple abilities."},{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-4.png?rev=3614043","caption":"The Ability Library page \u2014 enable\/disable add-on ability groups."},{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-5.png?rev=3614043","caption":"The Add-ons page \u2014 browse free companion plugins."},{"src":"https:\/\/ps.w.org\/acrossai-abilities-manager\/assets\/screenshot-6.png?rev=3614043","caption":"Settings \u2014 Display (abilities-per-page) and Upload Media Abilities (allowed-MIME list + Add file types)."}],"raw_content":"\n AcrossAI Abilities Manager gives your WordPress site 357 ready-made abilities, and gives you control over every one of them.<\/strong><\/p>\n\n An ability<\/em> is a self-describing operation that WordPress 6.9's Abilities API lets a plugin register \u2014 something an AI assistant, a REST client or another plugin can discover and call. WordPress ships the API; almost nothing ships abilities. This plugin does: 357 on any site, with no configuration<\/strong>, rising to over 800<\/strong> as it detects the plugins you already run.<\/p>\n\n It is free, GPL, and works on its own. Pair it with an MCP server and your site becomes something Claude, ChatGPT, Cursor or any MCP-capable assistant can operate.<\/p>\n\n An AI client is handed its tool list once, at connect time, and pays for it out of the model's context window on every conversation. Exposing 357 separate tools would flood it \u2014 most assistants degrade past a few dozen.<\/p>\n\n So your MCP server groups them into toolsets<\/strong>, and a toolset is a single tool<\/strong> answering three actions: Nineteen integrations ship with the plugin, each with its own page under https:\/\/acrossai.co\/integrations\/ \u2014 and each registers only when that plugin is active<\/strong>, so nothing appears for software you do not have, and each becomes one more dispatcher tool rather than a pile of loose ones.<\/p>\n\n The two backup integrations are deliberate exceptions: they register whether or not their plugin is installed, so \"is this site backed up?\"<\/em> can be answered \"no, there is no backup plugin here\"<\/strong> rather than having no tool to answer it.<\/p>\n\n Third-party developers can register a toolset of their own through a filter, without touching this plugin.<\/p>\n\nbackups\/*<\/code> abilities added in 0.0.34 are replaced by updraftplus\/*<\/code> and all-in-one\/*<\/code>. Anything holding a backups\/<\/code> slug needs updating; there are no aliases. The backup abilities are now two tabs, one per plugin, matching how every other integration works: each offers only what its plugin can actually do rather than advertising everything and reporting absence when you try to use it. Also fixes restoring, which never worked outside the admin screens in 0.0.34 - it checked the filesystem using a function WordPress only loads inside wp-admin, so every restore request failed on that line before checking anything. If you rely on restoring from UpdraftPlus through this plugin, this release is the one that makes it work. Nothing else changes; existing abilities, overrides and access rules are unaffected.<\/p>","0.0.34":"acrossai_default_ability_capability<\/code> filter. This closes a real hole - measured on one site, three installed abilities had no permission check at all, two were open to any logged-in subscriber, and one that writes content was open at contributor level. Otherwise additive: 19 new tabs and around 400 new abilities, including WooCommerce, backups, Yoast SEO, LiteSpeed Cache and Contact Form 7. Existing abilities, overrides and access rules are unaffected.<\/p>","0.0.21":"wpboilerplate\/wpb-access-control<\/code> composer dependency from ^2.0.0<\/code> to ^3.1.0<\/code> \u2014 two library releases in one hop. v3.0.0 removed two plugin-dependent providers (BuddyBossProfileTypeProvider<\/code>, MemberPressMembershipProvider<\/code>) that were extracted into a separate add-on (acrossai\/user-access-pro<\/code>); this plugin uses only the core AccessControlManager<\/code> + RuleTable<\/code> classes, so no consumer code change is required. v3.1.0 adds a new "Any logged-in user" option to the Access Control dropdown (backed by a new authenticated<\/code> sentinel rule type), and renames "Everyone (no restriction)" \u2192 "Public (no login required)" for clarity. Existing rules unaffected. Safe upgrade from 0.0.20.<\/p>","0.0.20":"acrossai_notices<\/code> filter shipped by acrossai-co\/main-menu<\/code> 0.0.30). Instead of a raw wp-admin banner on every screen, the notice now appears on the new AcrossAI \u2192 Notices submenu (with a count bubble on the menu label) and as a single top-of-page summary banner ("AcrossAI has N notifications for your attention \u2014 View notices \u2192") whose dismissal persists per user until the notice set changes. The fail-open semantics and message copy are unchanged. No breaking changes; existing abilities unaffected. Safe upgrade from 0.0.19.<\/p>","0.0.19":"acrossai-co\/main-menu<\/code> composer dependency from 0.0.27 to 0.0.29 \u2014 0.0.28 refreshes the Add-ons page baseline catalogue (AcrossAI Abilities Manager + AcrossAI MCP Manager + AI Connectors) with shared brand icon, contain<\/code>-fitted icon boxes, fixed 3-column grid layout, and a new optional learn_more_url<\/code> field; 0.0.29 reworks the card action states so active add-ons render a non-clickable "\u25cf Running" pill (deactivation stays in Plugins \u2192 Installed Plugins) and installed non-wp.org add-ons now show an in-page Activate button instead of always linking out. No breaking changes; existing abilities unaffected. Safe upgrade from 0.0.18.<\/p>","0.0.18":"acrossai_integration_toggle_capability<\/code>), and audit action (acrossai_integration_toggle_denied<\/code>). Fixes a sparse-storage bug that could silently strip the integration ON state. Bumps the acrossai-co\/main-menu<\/code> composer dependency from 0.0.23 to 0.0.27 to land two WordPress.org plugin directory guideline #8 fixes: the Consultations submenu now uses an external-link CTA instead of an embedded Calendly iframe, and the Add-ons page install action is now WordPress.org-only (non-wp.org cards render as external "Get add-on \u2197" links opening the vendor's site in a new tab). No breaking changes; existing abilities unaffected. Safe upgrade from 0.0.17.<\/p>","0.0.17":"acrossai-abilities-manager\/<\/code> to acrossai\/<\/code>; suffixes flip to verb-first form (e.g. site-title-get<\/code> \u2192 get-site-title<\/code>, theme-activate<\/code> \u2192 activate-theme<\/code>). External callers (custom code, saved MCP client configs, ACL entries created outside the plugin's UI, scripts calling \/wp-json\/wp-abilities\/v1\/abilities\/acrossai-abilities-manager\/\/run<\/code>) must update their slug references to \/wp-json\/wp-abilities\/v1\/abilities\/acrossai\/\/run<\/code>. No backwards-compatibility aliases; no automatic data migration \u2014 clear pre-existing overrides + ACL rules keyed on old slugs from the admin UI and re-add them under the new names. Also new: 7 Recovery Mode abilities (detect recovery, list paused plugins\/themes, unpause, exit URL, fatal-error log filter) and core\/reinstall-wp-core<\/code>. 162 PHP class files renamed to match slugs (internal-only; PSR-4 autoload picks up automatically). PHP 8.1+ \/ WP 6.9+ floor unchanged.<\/p>","0.0.15":"\/<\/code> character stripped when applied via the (new) bulk path. Safe upgrade.<\/p>","0.0.14":"banner{width}x{height}.png<\/code> to the WP.org-canonical banner-{width}x{height}.png<\/code> (the 0.0.13 filenames were not being auto-detected by the plugin directory). No plugin code touched; no REST, DB, or capability changes. Safe upgrade.<\/p>","0.0.13":"specs\/054-ability-gap-audit\/<\/code> (a reference audit of abilities that external AI-tool inventories expect but the plugin does not yet expose) and commits the previously-untracked .wordpress-org<\/code> banner (1544\u00d7500 + 772\u00d7250) and a sixth screenshot covering the Settings page. No functional changes; no REST, DB, or capability changes; no code touched under includes\/<\/code> or src\/<\/code>. Safe upgrade.\nAdds 31 new abilities across 10 domains (187 \u2192 218). Two new categories join the Ability Library: Admin Menu (5 abilities) and Content Search (11 abilities). Introduces two option-backed data stores: a lifecycle event log for plugin\/theme activate\/deactivate\/update timestamps, and an internal-link suggestion queue capped at 500 entries. Zero new REST endpoints, zero new capability requirements beyond the operation-specific caps already enforced by WP core (moderate_comments, upload_files, edit_others_posts). Zero external HTTP; zero new database tables. No breaking changes to existing abilities. Safe upgrade.<\/p>","0.0.12":"wp-core-rollback<\/code> \u2014 that rolls back WordPress core to an earlier version via WP core's Core_Upgrader::upgrade()<\/code>, the same class the dashboard uses for forward updates. Requires both manage_options<\/code> and update_core<\/code>; honours DISALLOW_FILE_MODS<\/code>; refuses when the target version isn't strictly older than the currently-installed version. Introduces the plugin's first outbound HTTP request (to api.wordpress.org\/core\/version-check\/1.7\/<\/code>), rate-bounded to at most one request per day per locale per site via a site-transient cache. No breaking changes; no database, REST, or capability changes to existing abilities. Safe upgrade.<\/p>","0.0.11":"wp-core-update-check<\/code> (report availability) and wp-core-update<\/code> (apply via Core_Upgrader<\/code>). The update ability requires both manage_options<\/code> and update_core<\/code>; honours DISALLOW_FILE_MODS<\/code>; multisite-guarded. Also changes backup filenames from backup-{type}-{slug}-{random}.zip<\/code> to {slug}-{unix-timestamp}-{ms}.zip<\/code> \u2014 human-readable and time-sortable, but predictable (directory listing remains disabled on the backups dir). Existing backups continue to work; the filename change only affects new backups. No breaking changes; no database, REST, or capability changes to existing abilities. Safe upgrade.<\/p>","0.0.10":"Create_Zip_Backup<\/code> with include_hidden=false<\/code> was silently descending into hidden directories and archiving their contents in 0.0.9 (only the top-level .git\/<\/code> etc. entry was skipped, not the files beneath it). Fixed to check every segment of each entry's relative path. Regenerate any include_hidden=false<\/code> archives created on 0.0.9 if their source tree contained hidden directories. No breaking changes; no database, REST, or capability changes. Safe upgrade.<\/p>","0.0.9":"zip-create<\/code>, zip-upload<\/code>, zip-extract<\/code>, zip-download<\/code>, zip-list<\/code>, zip-delete<\/code>) plus plugin-update<\/code> and theme-update<\/code> that finally let AI clients apply pending WordPress core updates through the Abilities API. All new abilities enforce manage_options<\/code>; mutating abilities additionally honour DISALLOW_FILE_MODS<\/code>. Zip extraction rejects zip-slip archives (any entry containing ..<\/code>, an absolute path, a backslash, or a null byte). Zip uploads are validated for the PK<\/code> magic signature before finalization. A new wp-content\/uploads\/acrossai-backups\/<\/code> directory is created on first use, hardened with an .htaccess<\/code> that blocks PHP execution but permits .zip<\/code> downloads (required so the URLs returned by zip-create<\/code> remain reachable). No breaking changes to existing abilities, REST endpoints, capability requirements, or database schema. Safe upgrade.<\/p>","0.0.8":"fs_*<\/code> or freemius_*<\/code> rows in wp_options<\/code> are safe to delete manually. Also: the Add-ons page now shows only free WordPress.org companion plugins (and no longer lists this plugin itself); the Library page compacts its title + bulk-action buttons onto one horizontal row; and acrossai-co\/main-menu<\/code> bumps 0.0.14 \u2192 0.0.23<\/code>. No breaking changes to REST endpoints, capability requirements, or database schema. Safe upgrade.<\/p>","0.0.7":"?tab=<\/code>) for deep-linkable views, and a readonly ability preview on disabled cards. No breaking changes; no database schema changes; no new REST endpoints; no new capability requirements. mode<\/code> and per-slug selections are preserved through disable \/ enable cycles. Safe upgrade.<\/p>","0.0.6":"acrossai-core-abilities<\/code> plugin \u2014 deactivate and uninstall that plugin after upgrading to avoid duplicate ability registrations. BREAKING for downstream integrators: 17 category slugs rebranded acrossai-core-abilities-<\/code> \u2192 acrossai-abilities-manager-<\/code> and 176 ability slugs acrossai-core-abilities\/<\/code> \u2192 acrossai\/<\/code>; update any MCP\/REST\/WP-CLI callers that referenced the legacy slugs. Ability payload shapes and permission callbacks unchanged. Also promotes Themes \/ Blocks \/ Plugins \/ Users \/ Database \/ Cron \/ Cache \/ File Manager to their own Library page tabs, bumps acrossai-co\/main-menu<\/code> to 0.0.14<\/code>, and rotates Freemius credentials.<\/p>","0.0.5":"acrossai-co\/main-menu<\/code> package to 0.0.11<\/code>. No functional changes to this plugin. Safe upgrade.<\/p>","0.0.4":"sub_group<\/code>, sub_group_label<\/code>, and tab_group<\/code> must now be nested under $args['meta']['acrossai']<\/code> when calling wp_register_ability()<\/code>. The old top-level shape is silently dropped \u2014 cards will render without their sub-group heading or custom tab placement until you migrate. End users and site administrators are not affected; no data migration, no DB or REST changes. Also swaps the WordPress.org plugin icon to an SVG and drops the directory banners.<\/p>","0.0.3":"{prefix}wpb_access_control<\/code> table) but are no longer applied. (2) Ability execution logging has been removed \u2014 the Logs admin page is gone; ability-execution denials are no longer recorded by this plugin. Install a compatible logging plugin if you need this signal.<\/p>","0.0.1":"What Your Site Can Do, Out of the Box<\/h4>\n\n
\n
A Dozen Tools, Not 357<\/h4>\n\n
discover<\/code> to list what it holds, info<\/code> to read one ability's parameters, and execute<\/code> to run it \u2014 the same three everywhere. AcrossAI MCP Manager provides that layer; this plugin provides the abilities.<\/p>\n\nPlugins You Already Run Get Their Own Toolset<\/h4>\n\n
\n
More Integrations With AcrossAI Pro<\/h4>\n\n