An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitiesJWT Authentication for WP REST APIs abilities, governed through the Bridge
An agent can inspect which REST API authentication method is active, look up JWT endpoints and error codes, read API access analytics, and switch the active authentication method or lock down specific REST routes.
- Abilities
- 106 read4 write
- Active installs
- 10K+
- Rating
- 88% (74 ratings)
- Version
- 4.9.0
- Requires
- WP 3.0.1+, PHP 5.6+
- Last updated
- 2026-09-28 4:04am GMT
View JWT Authentication for WP REST APIs on WordPress.org
What has to be true first
The plugin and WordPress 6.9 or later must both be active for these abilities to appear in the registry. Every one of them checks manage_options, so only an administrator level user, or an agent connected as one, can call any of them.
The 10 JWT Authentication for WP REST APIs abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 6
- Read
Get Configured Auth Methods
Returns the authentication method currently active on the site.
- Read
Get Auth Method Definitions
Lists every authentication method the plugin can configure and its properties.
- Read
Get API Access Analytics
Returns counts of total, open, authorized, and blocked REST API access.
- Read
Get Free vs Pro Features
Explains the free and premium feature tiers and their differences.
- Read
Get JWT Auth Endpoints
Returns the JWT token and token validation endpoint URLs with example requests.
- Read
Get Auth Error Codes
Returns troubleshooting explanations for Basic and JWT authentication error codes.
Write 4
- Write
Submit Support Query
Sends a support request to miniOrange using the logged-in user's email address.
- Write
Submit Trial Request
Raises a premium plan demo or trial request using the logged-in user's email address.
- Write
Update REST API Protection
Protects or unprotects REST API route prefixes so they do or do not require authentication.
- Write
Configure Authentication Method
Switches the site's active authentication method to Basic Auth or JWT Auth.
No abilities match that search.
How to switch these on
Four steps from two active plugins to a governed connection.
Install JWT Authentication for WP REST APIs and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. JWT Authentication for WP REST APIs registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from JWT Authentication for WP REST APIs starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does JWT Authentication for WP REST APIs work with the Bridge?
Yes. It registers 10 abilities under the mo-api-auth namespace with real annotations and a single permission callback, so the Bridge can list and switch on each one.
Do JWT Authentication for WP REST APIs's abilities register automatically?
Yes, unconditionally, once JWT Authentication for WP REST APIs is active. Nothing else has to be configured for the Bridge to discover them.
Does JWT Authentication for WP REST APIs need anything special to work with the Bridge?
The plugin and WordPress 6.9 or later must both be active for these abilities to appear in the registry. Every one of them checks manage_options, so only an administrator level user, or an agent connected as one, can call any of them.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from JWT Authentication for WP REST APIs's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, miniOrange or JWT Authentication for WP REST APIs. Back to the full directory.
Bridge JWT Authentication for WP REST APIs, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.