An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitiesSecurity Ninja abilities, governed through the Bridge
An AI agent can pull Security Ninja's latest test pass/warning/fail counts, its seven day attack activity trend versus the prior week, and the most recent full Security Advisor report, all read-only.
- Abilities
- 33 read
- Active installs
- 7K+
- Rating
- 94% (100 ratings)
- Version
- 5.303
- Requires
- WP 4.7+, PHP 7.4+
- Last updated
- 2026-09-08 4:00pm GMT
View Security Ninja on WordPress.org
What has to be true first
Security Ninja needs to be installed and active on WordPress 6.9 or later, with its AI Security Advisor abilities toggle left on (it defaults to on). All three abilities check for manage_options, so only an administrator-level connected user can call them.
- a site-side toggle ("abilities_exposed" in the wf_sn_ai_advisor option, on by default) must be left on, otherwise both the category and the abilities skip registration entirely
The 3 Security Ninja abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 3
- Read
Get test summary
Returns passed, warning and failed counts from the latest Security Tests run.
- Read
Get attack activity
Returns seven day and prior seven day attack activity totals.
- Read
Get latest AI security report
Returns the most recent stored full Security Advisor report.
How to switch these on
Four steps from two active plugins to a governed connection.
Install Security Ninja and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. Security Ninja registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from Security Ninja starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does Security Ninja work with the Bridge?
Yes. The AI Security Advisor module registers three read-only abilities with wp_register_ability under the security-ninja namespace, all switchable individually once the operator turns on the Bridge for them.
What has to be true for Security Ninja's abilities to register?
a site-side toggle ("abilities_exposed" in the wf_sn_ai_advisor option, on by default) must be left on, otherwise both the category and the abilities skip registration entirely.
Does Security Ninja need anything special to work with the Bridge?
Security Ninja needs to be installed and active on WordPress 6.9 or later, with its AI Security Advisor abilities toggle left on (it defaults to on). All three abilities check for manage_options, so only an administrator-level connected user can call them.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from Security Ninja's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, cleverplugins or Security Ninja. Back to the full directory.
Bridge Security Ninja, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.