AcrossAI Abilities Manager gives site administrators full visibility and control over every ability registered via the WordPress Abilities API (wp_get_ability()).

Features:

Browse all abilities — a searchable, sortable, paginated table listing every registered ability with slug, provider, source, and current status.
Toggle allow/disallow — enable or disable any ability site-wide with a single click. Changes are saved instantly without a page reload.
Edit ability metadata — override readonly, destructive, idempotent, show_in_rest, show_in_mcp, mcp_type, and mcp_servers fields per ability using a tri-state system (Yes / No / Inherit from registry).
Reset overrides — restore any ability back to its registry defaults with one click.
Bulk actions — allow, disallow, or reset up to 50 abilities at once.
Ability Library — enable or disable add-on ability groups from a dedicated Library page, with All/Specific mode controls per group.
Add-ons page — browse companion plugins from the WordPress admin. WordPress.org-hosted add-ons install / activate / deactivate in place; add-ons distributed elsewhere link out to the vendor’s site so you can install them via Plugins Add New Upload Plugin.
MCP server list — view all registered MCP servers when the MCP Adapter plugin is active.

All overrides are stored in a dedicated database table. The WordPress ability registry is never modified — only the fields that differ from registry defaults are persisted.

Security:

All endpoints require manage_options capability.
All state-changing requests are protected by WordPress nonce verification.
All input is sanitized; all output is escaped.

Third-party integrations (optional):

MCP Adapter plugin — if active, the plugin displays a list of registered MCP servers inside the ability edit panel. No data is sent to any external service. The MCP Adapter plugin communicates only with your own WordPress installation.

This plugin’s own code makes no external HTTP requests. One admin-only surface can contact an external service on your behalf: the AcrossAI Add-ons page installs WordPress.org-hosted companion plugins directly through WordPress core’s own plugin installer (api.wordpress.org + downloads.wordpress.org). Add-ons registered with any other source (e.g. GitHub, Freemius) are shown as external “Get add-on ” links that open the vendor’s site in a new browser tab — the plugin does not download or install them itself. The AcrossAI Consultations submenu renders a static call-to-action button that opens calendly.com in a new browser tab only after the administrator clicks it — no third-party asset is loaded inside wp-admin. Full disclosure — including what data is transmitted to each service and links to their terms + privacy policies — is in the External Services section below.

External Services

This plugin connects to the following external services on your behalf. Each connection is triggered by a specific admin-only action and is disclosed here per the WordPress.org plugin directory guidelines.

1. Calendly external link (calendly.com)

What it is: Calendly is a third-party scheduling service. The AcrossAI Consultations submenu displays a static call-to-action button that links out to a Calendly booking page for AcrossAI consultations (“Using AI in WordPress”).

When it is contacted: Never on page render. The Consultations submenu at /wp-admin/admin.php?page=acrossai-consultations is a self-contained wp-admin page — it does not load any Calendly script, iframe, cookie, or asset. Calendly is only contacted if the administrator explicitly clicks the “Book a Consultation” button, at which point their browser navigates directly to https://calendly.com/acrossai/using-ai-in-wordpress in a new tab (target="_blank" rel="noopener noreferrer"). This is identical to clicking any external hyperlink from an admin page.

What is loaded on the Consultations page: Nothing from Calendly. The page renders self-contained HTML + CSS. The only external asset referenced by the page is Google Fonts (Space Grotesk + IBM Plex Sans via fonts.googleapis.com) — permitted under the “third-party CDNs beyond fonts” carve-out in the WordPress plugin guidelines.

What data is transmitted to Calendly: Nothing by this plugin. If the administrator clicks the CTA button, their browser navigates directly to Calendly and sends standard browser metadata (IP address, User-Agent, referrer) to Calendly as with any external link. If the administrator then chooses to book a consultation on Calendly’s own site, any information they enter into Calendly’s booking form (name, email address, meeting preferences, etc.) is transmitted to and processed by Calendly. This plugin does not intercept, store, or forward that data.

Terms of service: https://calendly.com/pages/terms
Privacy policy: https://calendly.com/pages/privacy

2. WordPress.org plugin directory (api.wordpress.org and downloads.wordpress.org)

What it is: The Add-ons page (/wp-admin/admin.php?page=acrossai-addons) uses the WordPress.org plugin directory to install free companion plugins directly from wp-admin.

When it is contacted: Only when an authenticated administrator (install_plugins capability) clicks the “Install” button on a card whose source is wordpress.org. Contact happens through WordPress core’s own plugins_api() and Plugin_Upgrader — this plugin does not issue direct HTTP requests. Add-ons registered with any other source (e.g. github, freemius) are rendered as external “Get add-on ” links that open the vendor’s site in a new browser tab; the plugin does NOT download or install those add-ons itself, so no request is made to the vendor’s servers from wp-admin.

What data is transmitted: The WordPress core plugin API request payload (site URL, WP version, PHP version, locale) as per WordPress core’s standard update check protocol.

Terms of service: https://wordpress.org/about/terms/
Privacy policy: https://wordpress.org/about/privacy/

3. WordPress.org core version-check API (api.wordpress.org/core/version-check/1.7/)

Called only when an administrator invokes the acrossai/rollback-wp-core ability (registered under the Core category) and the local core-version cache has expired. Rate-bounded to at most one request per day per locale per site via a site-transient cache. This is a WordPress-core-hosted API — no data beyond the standard WordPress core version-check request payload is transmitted. Same wp.org terms + privacy policy as service #2 above.

Privacy Policy

This plugin does not itself collect, store, or transmit any user data to any third party.

Several admin-only actions can cause external services to receive data — all are described in the External Services section above and are triggered only by an authenticated administrator:

The AcrossAI Consultations admin page displays a static call-to-action button. Merely loading the Consultations page sends no data to Calendly — no Calendly script, iframe, or asset is loaded inside wp-admin. If the administrator clicks the CTA button, their browser opens calendly.com/acrossai/using-ai-in-wordpress in a new tab, at which point standard browser metadata (IP, User-Agent, referrer) is sent to Calendly and Calendly’s own privacy policy applies. If they then book a consultation on Calendly’s site, information they enter into Calendly’s form (name, email, meeting details) is transmitted to Calendly.
Installing a WordPress.org-hosted add-on from the AcrossAI Add-ons page contacts the WordPress.org plugin directory via WordPress core’s own plugins_api() and Plugin_Upgrader (api.wordpress.org + downloads.wordpress.org). Add-ons distributed elsewhere (e.g. GitHub, Freemius) are rendered as external “Get add-on ” links that open the vendor’s site in a new browser tab — the plugin itself does not download or install those add-ons, so no request is sent to the vendor’s servers from wp-admin. If the administrator clicks the external link, their browser navigates directly to the vendor and standard browser metadata (IP, User-Agent, referrer) is sent to the vendor as with any external hyperlink.
Invoking the acrossai/rollback-wp-core ability contacts the WordPress.org core version-check API (a WordPress-core-hosted service) via the standard WordPress update API.

No data is sent to any external server without an explicit administrator action.