An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitiesWP OAuth Server (Login with WordPress) abilities, governed through the Bridge
An agent can manage the OAuth 2.0 server configuration: create an OAuth application/client, set its callback and custom login URLs, turn JWT signing, debug logging, and the state parameter on or off, read the configured scopes, and fetch the discovery and JWKS endpoint URLs. It can also send a support request to miniOrange on the site's behalf.
- Abilities
- 133 read10 destructive
- Active installs
- 1K+
- Rating
- 98% (41 ratings)
- Version
- 6.4.0
- Requires
- WP 5.6+, PHP 7.2+
- Last updated
- 2026-09-18 6:26am GMT
View WP OAuth Server (Login with WordPress) on WordPress.org
What has to be true first
WordPress 6.9 or later needs to be running alongside WP OAuth Server with its Abilities API toggle switched on in the plugin's own settings. Every ability checks manage_options, so only an administrator-level connected user can call any of them.
- The plugin's own "Abilities API" setting must be turned on (checked via Miniorange_Oauth_20_Server_Abilities_Api_Settings::is_enabled())
The 13 WP OAuth Server (Login with WordPress) abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 3
- Read
Get Scope
Reads the OAuth scopes currently configured on the server.
- Read
Get Discovery Endpoint
Reads the OpenID Connect discovery endpoint URL.
- Read
Get JWKS Endpoint
Reads the JSON Web Key Set endpoint URL used for verifying JWTs.
Destructive 10
- Destructive
Create Application
Registers a new OAuth 2.0 client application on the server.
- Destructive
Update Callback URL
Changes the redirect (callback) URL for an existing OAuth client.
- Destructive
Update Custom Login URL
Sets a custom login page URL used during the OAuth authorization flow.
- Destructive
Enable JWT Support
Turns on JWT-signed access tokens for the OAuth server.
- Destructive
Disable JWT Support
Turns off JWT-signed access tokens for the OAuth server.
- Destructive
Enable Debug Logs
Turns on the plugin's debug log file.
- Destructive
Disable Debug Logs
Turns off the plugin's debug log file.
- Destructive
Enable State Parameter
Turns on OAuth state-parameter enforcement (CSRF protection).
- Destructive
Disable State Parameter
Turns off OAuth state-parameter enforcement.
- Destructive
Send Support Request
Submits a support ticket to miniOrange on the site's behalf.
No abilities match that search.
How to switch these on
Four steps from two active plugins to a governed connection.
Install WP OAuth Server (Login with WordPress) and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. WP OAuth Server (Login with WordPress) registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from WP OAuth Server (Login with WordPress) starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does WP OAuth Server (Login with WordPress) work with the Bridge?
Conditionally. The plugin only registers its 12 abilities when its own Abilities API setting is switched on, so the site operator must enable that before the Bridge can discover or expose any of them.
What has to be true for WP OAuth Server (Login with WordPress)'s abilities to register?
The plugin's own "Abilities API" setting must be turned on (checked via Miniorange_Oauth_20_Server_Abilities_Api_Settings::is_enabled()).
Does WP OAuth Server (Login with WordPress) need anything special to work with the Bridge?
WordPress 6.9 or later needs to be running alongside WP OAuth Server with its Abilities API toggle switched on in the plugin's own settings. Every ability checks manage_options, so only an administrator-level connected user can call any of them.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from WP OAuth Server (Login with WordPress)'s own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, miniOrange or WP OAuth Server (Login with WordPress). Back to the full directory.
Bridge WP OAuth Server (Login with WordPress), keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.