FAQ
Does it work with my MCP plugin?#
It gates every call that goes through the Abilities API, whichever MCP plugin sends it, including the MCP Adapter and its STDIO server. Tools an MCP plugin registers outside the Abilities API are not gated. Everything Ability Gate can gate is on Agent Control > Risk.
What can’t be undone?#
Anything outside the database: emails sent, outgoing HTTP calls such as webhooks or payment captures, uploaded files, cron events and plugin or theme changes. They are listed on the request screen as not undone. Writes that could not be recorded exactly make the snapshot partial. See Rollback.
Will it slow my site?#
Visitors and logged-in editors are not affected; only agent calls are checked. A gated call adds a policy check and a few database writes for the audit trail, plus a few small reads for the snapshot when it writes.
Does it send data anywhere?#
No. Everything stays in your database. The only outbound connections are licence and update checks to technoleet.dev. There is no telemetry.
Do I need Ability Auditor?#
No. If it is active, its findings raise the risk score of the abilities it flags. Ability Gate only reads its stored audit.
What happens when an agent is held?#
The call does not run, and the agent gets a 409 error with a request id. You approve or reject it in Agent Control > Approvals. Approving runs it immediately, and the agent collects the result once by repeating the call or asking ability-gate/get-request.
Does it work on multisite?#
Yes, per site. Each site has its own agents, rules, queue, snapshots, audit trail and settings.
Do my editors need approval for their own changes?#
No. People logged in to wp-admin are not gated unless you set Scope to “All REST callers”, which also gates REST calls from logged-in browser sessions.
What happens if Ability Gate itself hits an error?#
For agent writes it fails closed: the call is refused with a message to check Agent Control > Activity, and the error is logged. Everything else (people, cron, your own code) keeps working.