An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitiesSureCookie abilities, governed through the Bridge
Once enabled, an agent can read and manage SureCookie's consent logs, cookie categories and definitions, known-vendor service catalog, script-blocking rules, site scanner, diagnostics, content lookups, and plugin settings.
- Abilities
- 99 destructive
- Active installs
- 50K+
- Rating
- 96% (16 ratings)
- Version
- 1.5.1
- Requires
- WP 6.7+, PHP 7.4+
- Last updated
- 2026-09-21 8:14am GMT
View SureCookie on WordPress.org
What has to be true first
SureCookie must be installed and active, with its own enable_mcp setting turned on, on WordPress 6.9 or newer. Every ability checks the plugin's SURECOOKIE_CAPABILITY constant, which is fixed to manage_options, so only an administrator-level connected user can use any of them.
- SureCookie's own 'enable_mcp' admin setting must be turned on (defaults to off); no abilities register at all while it is off.
- A code-level 'surecookie_ability_enabled' filter can additionally suppress individual abilities even when enable_mcp is on, though there is no admin UI for that.
A note on the count below
easymcpai lists 5 abilities, but the full source (inc/integrations/wordpress/abilities/*.php, registered from inc/integrations/wordpress/init.php) shows 9 static, literally-named abilities. None declare 'readonly'/'destructive' keys; Base::get_annotations() is abstract and every concrete subclass instead documents 'priority'/'readOnlyHint'/'destructiveHint'/'idempotentHint'/'openWorldHint', the MCP tool-annotation names, not the Abilities API's own annotation keys, so per the Bridge's fail-safe rule all 9 read as destructive risk even though several are read-only in practice.
The 9 SureCookie abilities
Grouped by what each one can change. Every one starts off until you enable it.
Destructive 9
- Destructive
Consent logs
Queries recorded consent log entries with pagination, action-type, country, and search filters.
- Destructive
Cookie categories
Lists, creates, updates, or deletes the cookie categories cookies are organized under.
- Destructive
Known services catalog
Lists, installs, or uninstalls known third-party vendor cookie declarations from SureCookie's service catalog.
- Destructive
Site cookie scanner
Starts, checks status of, cancels, or reads quota and logs for a site cookie scan.
- Destructive
Script blocking
Manages which scanned scripts and iframes are blocked before consent, and the rules and Google Consent Mode exemptions controlling that.
- Destructive
Site health diagnostics
Reports connection, scan quota, cron, and feature status, and flags other active cookie-consent plugins that may conflict.
- Destructive
Cookie management
Lists, creates, updates, deletes, or bulk-recategorizes scanned and custom cookie definitions.
- Destructive
Content lookup
Looks up post and navigation-menu IDs by title or ID for use in other SureCookie abilities and settings.
- Destructive
Manage settings
Reads or updates SureCookie's plugin settings, such as banner appearance, logging, and compliance law.
No abilities match that search.
How to switch these on
Four steps from two active plugins to a governed connection.
Install SureCookie and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. SureCookie registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from SureCookie starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does SureCookie work with the Bridge?
Conditionally. SureCookie registers 9 real abilities over its cookie consent, scanner, and settings features through a shared base class with a real permission check, but nothing registers until the plugin's own 'enable_mcp' setting is turned on (off by default), and every ability's own annotations use MCP tool-hint key names instead of the Abilities API's readonly/destructive keys, so the Bridge's fail-safe rule treats all of them as destructive.
What has to be true for SureCookie's abilities to register?
SureCookie's own 'enable_mcp' admin setting must be turned on (defaults to off); no abilities register at all while it is off.. A code-level 'surecookie_ability_enabled' filter can additionally suppress individual abilities even when enable_mcp is on, though there is no admin UI for that..
Does SureCookie need anything special to work with the Bridge?
SureCookie must be installed and active, with its own enable_mcp setting turned on, on WordPress 6.9 or newer. Every ability checks the plugin's SURECOOKIE_CAPABILITY constant, which is fixed to manage_options, so only an administrator-level connected user can use any of them.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from SureCookie's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, Brainstorm Force or SureCookie. Back to the full directory.
Bridge SureCookie, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.