ModelGain Agent Readiness Audit

ModelGain Agent Readiness Audit is a local, read-only diagnostic layer for WordPress sites that need to be inspected or operated by AI agents.

It answers five practical questions:

• Discoverability: can machine clients reach and discover the public site?

• Readability: does the server-rendered page expose useful, machine-readable structure?

• Actionability: are structured WordPress capabilities available and described?

• Safety & Governance: do exposed capabilities have clear permission and side-effect boundaries?

• Observability: do structured actions expose enough result information to operate safely?

The plugin produces evidence-based findings instead of automatically changing the site. Every finding has a stable ID, domain, maturity, severity, status, evidence, explanation, remediation guidance, reference, and affected surface.

Audit profiles

Choose the profile that matches the intended agent:

• Read: the agent only needs to discover and understand public content.

• Act: the agent also needs to perform bounded structured actions.

• Manage: the agent may participate in administrative or operational workflows.

Rules that do not apply to the selected profile are marked Not Applicable and do not reduce the profile score.

6 and newer. 9, so applicable Act/Manage findings correctly report that capability as unavailable on older WordPress versions rather than pretending the API exists.

Scores and confidence

The readiness score is separate from evidence confidence.

• Pass, Warning, and Fail findings contribute to scoring.

• Unknown means the audit did not have enough evidence to make a safe claim. Unknown findings are excluded from the readiness-score denominator and reduce confidence instead.

• Not Applicable findings are excluded from scoring.

• Experimental rules are informational and do not affect the score.

• A proven Critical safety failure can cap the overall readiness score.

This prevents a network limitation or missing evidence from being misreported as a site defect.

Local and read-only by design

The audit does not:

• modify posts, pages, users, settings, themes, or other plugins;

• submit forms or execute discovered third-party abilities;

• crawl arbitrary third-party URLs;

• send WordPress credentials, cookies, Authorization headers, form data, or customer data with audit probes;

• call an AI API or remote SaaS service;

• send telemetry.

Network probes are limited to the site’s own exact origin. Redirect following is disabled and response size and timeout are bounded.

WordPress Abilities API and MCP

On WordPress versions that provide the Abilities API, the audit inspects registered ability metadata and samples anonymous permission behavior only when WordPress can normalize and validate a default/no-input sample first. If a valid sample cannot be established, the result is Unknown rather than guessed. It does not execute third-party abilities.

When the official WordPress MCP Adapter is present, the audit reports locally observable integration evidence. The plugin does not install or operate an MCP server.

The plugin also registers three private, manage_options-gated abilities for its own audit/report workflow on compatible WordPress versions. They are not exposed publicly to MCP.

Experimental signals

txt and WebMCP signals, but does not treat either as a mandatory web or WordPress standard. Their absence does not create a scored readiness defect.

Reports and automation

The latest full report and up to five compact historical summaries are stored locally in WordPress options.

You can:

• review the report at Tools > Agent Readiness;

• compare the current audit with the previous audit for the same profile;

• export JSON;

• export Markdown;

• export a deterministic remediation prompt generated from the report data;

• use WP-CLI for repeatable audits.

WP-CLI examples:

wp modelgain agent-readiness audit --profile=read --format=table wp modelgain agent-readiness audit --profile=act --format=json wp modelgain agent-readiness audit --profile=manage --format=markdown

Site Health shows a summary of the latest stored report. Opening Site Health does not trigger a new network audit.

Developer Hooks

The core exposes extension points for policy packs, reporting, and future commercial add-ons without requiring a fork:

• modelgain_agent_readiness_http_args adjusts bounded same-origin request settings. Core GET-method, credential, body, redirect, no-streaming, TLS-verification, timeout, response-size, and origin protections are reapplied after this filter.

• modelgain_agent_readiness_facts extends collected evidence before rule evaluation.

• modelgain_agent_readiness_findings extends or deliberately replaces evaluated findings.

• modelgain_agent_readiness_score_cap adjusts the policy/safety score cap.

• modelgain_agent_readiness_report filters the final report before local persistence.

• modelgain_agent_readiness_history_limit adjusts compact local history retention, bounded by the core.

• modelgain_agent_readiness_audit_completed fires after a report has been stored.

Extensions are responsible for preserving stable finding IDs, evidence semantics, least-privilege behavior, and the core privacy boundary.

Privacy

ModelGain Agent Readiness Audit does not send telemetry or data to a ModelGain service.

The audit can make bounded HTTP GET requests to the same origin configured as the site’s WordPress home URL. These requests do not include WordPress authentication cookies, Authorization headers, URL-embedded credentials, request bodies, or customer data. The plugin does not follow redirects.

For abilities explicitly marked public, the audit may invoke their permission callback under an anonymous WordPress user context after a default/no-input sample has passed the ability’s own input normalization and validation. Permission callbacks are inspected only; third-party execute callbacks are never run.