An agent can list and audit the site's custom code snippets, detect snippet errors, read WPCode's error log, and search its snippet library, all without the raw snippet code ever being exposed.
5 read
View abilitiesSecure Custom Fields abilities, governed through the Bridge
An agent can list, read, create, update, duplicate, export, import, trash, and restore SCF field groups, individual fields, custom post types, taxonomies, and options pages, and, once the site turns on AI Access, list and register field groups, post types, and taxonomies under a second acf/* ability set plus create, read, update, and delete records of any post type or taxonomy the site opts in.
- Abilities
- 5418 read31 write5 destructive
- Active installs
- 100K+
- Rating
- 96% (65 ratings)
- Version
- 6.9.5
- Requires
- WP 6.2+, PHP 7.4+
- Last updated
- 2026-08-20 11:45pm GMT
View Secure Custom Fields on WordPress.org
What has to be true first
Needs WordPress 6.9 or newer with Secure Custom Fields active. Every scf/* and acf/* ability checks the capability set in acf_get_setting('capability'), which defaults to manage_options but can be changed by the site.
- A second, separate ability set under the acf/* namespace only registers when the plugin's own 'AI Access' setting (enable_acf_ai) is turned on in SCF's settings screen.
- Within that acf/* set, the per-custom-post-type and per-custom-taxonomy abilities (list/create/view/update/delete for each type) only appear for a post type or taxonomy that also has its own 'Allow AI Access' toggle checked and is marked active; their ids are built from the post type or taxonomy's own slug, so they vary per site.
- The acf/register-field-group ability and the field groups it exposes through acf/field-groups likewise require that field group's own 'Allow AI Access' setting to be on.
This count can change
The 48 scf/* abilities (4 entities x 10 actions, plus 8 field actions) are always registered with fixed ids. A separate, opt-in acf/* set adds 6 always-fixed ids listed here, plus 4-5 more ids per custom post type and per custom taxonomy that has its own 'Allow AI Access' toggle on; those per-type ids are generated from the site's own registered post type and taxonomy slugs and are not enumerable in advance, so they are excluded from this list and the record is marked dynamic.
The 54 Secure Custom Fields abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 18
- Read
List field groups
Lists field groups.
- Read
Get field group
Returns one field group by its key.
- Read
Export field group
Exports a field group definition as PHP or JSON.
- Read
List post types
Lists post types.
- Read
Get post type
Returns one post type by its key.
- Read
Export post type
Exports a post type definition as PHP or JSON.
- Read
List taxonomies
Lists taxonomies.
- Read
Get taxonomy
Returns one taxonomy by its key.
- Read
Export taxonomy
Exports a taxonomy definition as PHP or JSON.
- Read
List UI options pages
Lists UI options pages.
- Read
Get UI options page
Returns one UI options page by its key.
- Read
Export UI options page
Exports a UI options page definition as PHP or JSON.
- Read
List fields
Lists SCF field definitions.
- Read
Get field
Returns one SCF field definition by key.
- Read
Export field
Exports an SCF field definition.
- Read
List SCF field groups
Returns SCF field groups that have AI access allowed.
- Read
List SCF custom post types
Returns SCF-registered custom post types.
- Read
List SCF custom taxonomies
Returns SCF-registered custom taxonomies.
Write 31
- Write
Create field group
Creates a new field group.
- Write
Update field group
Updates an existing field group.
- Write
Duplicate field group
Duplicates an existing field group.
- Write
Import field group
Imports a field group definition.
- Write
Trash field group
Moves a field group to the trash.
- Write
Untrash field group
Restores a field group from the trash.
- Write
Create post type
Creates a new post type.
- Write
Update post type
Updates an existing post type.
- Write
Duplicate post type
Duplicates an existing post type.
- Write
Import post type
Imports a post type definition.
- Write
Trash post type
Moves a post type to the trash.
- Write
Untrash post type
Restores a post type from the trash.
- Write
Create taxonomy
Creates a new taxonomy.
- Write
Update taxonomy
Updates an existing taxonomy.
- Write
Duplicate taxonomy
Duplicates an existing taxonomy.
- Write
Import taxonomy
Imports a taxonomy definition.
- Write
Trash taxonomy
Moves a taxonomy to the trash.
- Write
Untrash taxonomy
Restores a taxonomy from the trash.
- Write
Create UI options page
Creates a new UI options page.
- Write
Update UI options page
Updates an existing UI options page.
- Write
Duplicate UI options page
Duplicates an existing UI options page.
- Write
Import UI options page
Imports a UI options page definition.
- Write
Trash UI options page
Moves a UI options page to the trash.
- Write
Untrash UI options page
Restores a UI options page from the trash.
- Write
Create field
Creates a new SCF field definition.
- Write
Update field
Updates an existing SCF field definition.
- Write
Duplicate field
Duplicates an existing SCF field definition.
- Write
Import field
Imports an SCF field definition.
- Write
Register SCF field group
Registers a new SCF field group schema with field definitions.
- Write
Register custom post type
Registers a new WordPress post type definition, such as Book or Event.
- Write
Register custom taxonomy
Registers a new WordPress taxonomy definition, such as Genre or Color.
Destructive 5
- Destructive
Delete field group
Permanently deletes a field group.
- Destructive
Delete post type
Permanently deletes a post type.
- Destructive
Delete taxonomy
Permanently deletes a taxonomy.
- Destructive
Delete UI options page
Permanently deletes a UI options page.
- Destructive
Delete field
Permanently deletes an SCF field definition.
No abilities match that search.
How to switch these on
Four steps from two active plugins to a governed connection.
Install Secure Custom Fields and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. Secure Custom Fields registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from Secure Custom Fields starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does Secure Custom Fields work with the Bridge?
Yes. Secure Custom Fields always registers a full, explicitly annotated scf/* ability set for field groups, fields, post types, taxonomies, and UI options pages once WordPress 6.9's Abilities API is present, so the Bridge can classify and expose each one without any plugin-side setting.
What has to be true for Secure Custom Fields's abilities to register?
A second, separate ability set under the acf/* namespace only registers when the plugin's own 'AI Access' setting (enable_acf_ai) is turned on in SCF's settings screen.. Within that acf/* set, the per-custom-post-type and per-custom-taxonomy abilities (list/create/view/update/delete for each type) only appear for a post type or taxonomy that also has its own 'Allow AI Access' toggle checked and is marked active; their ids are built from the post type or taxonomy's own slug, so they vary per site.. The acf/register-field-group ability and the field groups it exposes through acf/field-groups likewise require that field group's own 'Allow AI Access' setting to be on..
Does Secure Custom Fields need anything special to work with the Bridge?
Needs WordPress 6.9 or newer with Secure Custom Fields active. Every scf/* and acf/* ability checks the capability set in acf_get_setting('capability'), which defaults to manage_options but can be changed by the site.
More Developer plugins
An agent can look up the expected value format for a field type, then read, write, or delete a specific custom field's value on a post, term, user, comment, or settings page.
2 read1 write1 destructive
View abilitiesAn agent can list every registered WordPress REST route with its supported HTTP methods, and dispatch a test request against a chosen route (with an optional execution trace of hooks, SQL and HTTP calls) to see what it returns.
1 read1 write
View abilitiesVerified from Secure Custom Fields's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, WordPress.org or Secure Custom Fields. Back to the full directory.
Bridge Secure Custom Fields, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.