Title: ModelGain Agent Readiness Audit Author: upaccn Published: October 18, 2026 Last modified: October 18, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/modelgain-agent-readiness-audit.svg) # ModelGain Agent Readiness Audit By [upaccn](https://profiles.wordpress.org/upaccn/) [Download](https://downloads.wordpress.org/plugin/modelgain-agent-readiness-audit.0.1.0.zip) * [Details](https://wordpress.org/plugins/modelgain-agent-readiness-audit/#description) * [Reviews](https://wordpress.org/plugins/modelgain-agent-readiness-audit/#reviews) * [Installation](https://wordpress.org/plugins/modelgain-agent-readiness-audit/#installation) * [Development](https://wordpress.org/plugins/modelgain-agent-readiness-audit/#developers) [Support](https://wordpress.org/support/plugin/modelgain-agent-readiness-audit/) ## Description ModelGain Agent Readiness Audit is a local, read-only diagnostic layer for WordPress sites that need to be inspected or operated by AI agents. It answers five practical questions: * Discoverability: can machine clients reach and discover the public site? * Readability: does the server-rendered page expose useful, machine-readable structure? * Actionability: are structured WordPress capabilities available and described? * Safety & Governance: do exposed capabilities have clear permission and side-effect boundaries? * Observability: do structured actions expose enough result information to operate safely? The plugin produces evidence-based findings instead of automatically changing the site. Every finding has a stable ID, domain, maturity, severity, status, evidence, explanation, remediation guidance, reference, and affected surface. #### Audit profiles Choose the profile that matches the intended agent: * Read: the agent only needs to discover and understand public content. * Act: the agent also needs to perform bounded structured actions. * Manage: the agent may participate in administrative or operational workflows. Rules that do not apply to the selected profile are marked Not Applicable and do not reduce the profile score. The plugin itself supports WordPress 6.6 and newer. The native WordPress Abilities API was added in WordPress 6.9, so applicable Act/Manage findings correctly report that capability as unavailable on older WordPress versions rather than pretending the API exists. #### Scores and confidence The readiness score is separate from evidence confidence. * Pass, Warning, and Fail findings contribute to scoring. * Unknown means the audit did not have enough evidence to make a safe claim. Unknown findings are excluded from the readiness-score denominator and reduce confidence instead. * Not Applicable findings are excluded from scoring. * Experimental rules are informational and do not affect the score. * A proven Critical safety failure can cap the overall readiness score. This prevents a network limitation or missing evidence from being misreported as a site defect. #### Local and read-only by design The audit does not: * modify posts, pages, users, settings, themes, or other plugins; * submit forms or execute discovered third-party abilities; * crawl arbitrary third-party URLs; * send WordPress credentials, cookies, Authorization headers, form data, or customer data with audit probes; * call an AI API or remote SaaS service; * send telemetry. Network probes are limited to the site’s own exact origin. Redirect following is disabled and response size and timeout are bounded. #### WordPress Abilities API and MCP On WordPress versions that provide the Abilities API, the audit inspects registered ability metadata and samples anonymous permission behavior only when WordPress can normalize and validate a default/no-input sample first. If a valid sample cannot be established, the result is Unknown rather than guessed. It does not execute third- party abilities. When the official WordPress MCP Adapter is present, the audit reports locally observable integration evidence. The plugin does not install or operate an MCP server. The plugin also registers three private, manage_options-gated abilities for its own audit/report workflow on compatible WordPress versions. They are not exposed publicly to MCP. #### Experimental signals The audit can report supplemental llms.txt and WebMCP signals, but does not treat either as a mandatory web or WordPress standard. Their absence does not create a scored readiness defect. #### Reports and automation The latest full report and up to five compact historical summaries are stored locally in WordPress options. You can: * review the report at Tools > Agent Readiness; * compare the current audit with the previous audit for the same profile; * export JSON; * export Markdown; * export a deterministic remediation prompt generated from the report data; * use WP-CLI for repeatable audits. WP-CLI examples: ``` wp modelgain agent-readiness audit --profile=read --format=table wp modelgain agent-readiness audit --profile=act --format=json wp modelgain agent-readiness audit --profile=manage --format=markdown ``` Site Health shows a summary of the latest stored report. Opening Site Health does not trigger a new network audit. ### Developer Hooks The core exposes extension points for policy packs, reporting, and future commercial add-ons without requiring a fork: * `modelgain_agent_readiness_http_args` adjusts bounded same-origin request settings. Core GET-method, credential, body, redirect, no-streaming, TLS-verification, timeout, response-size, and origin protections are reapplied after this filter. * `modelgain_agent_readiness_facts` extends collected evidence before rule evaluation. * `modelgain_agent_readiness_findings` extends or deliberately replaces evaluated findings. * `modelgain_agent_readiness_score_cap` adjusts the policy/safety score cap. * `modelgain_agent_readiness_report` filters the final report before local persistence. * `modelgain_agent_readiness_history_limit` adjusts compact local history retention, bounded by the core. * `modelgain_agent_readiness_audit_completed` fires after a report has been stored. Extensions are responsible for preserving stable finding IDs, evidence semantics, least-privilege behavior, and the core privacy boundary. ### Privacy ModelGain Agent Readiness Audit does not send telemetry or data to a ModelGain service. The audit can make bounded HTTP GET requests to the same origin configured as the site’s WordPress home URL. These requests do not include WordPress authentication cookies, Authorization headers, URL-embedded credentials, request bodies, or customer data. The plugin does not follow redirects. For abilities explicitly marked public, the audit may invoke their permission callback under an anonymous WordPress user context after a default/no-input sample has passed the ability’s own input normalization and validation. Permission callbacks are inspected only; third-party execute callbacks are never run. ## Installation 1. Install and activate ModelGain Agent Readiness Audit. 2. Open Tools > Agent Readiness. 3. Select Read, Act, or Manage. 4. Run the audit and review the evidence before changing production configuration. ## FAQ ### Does this plugin automatically make my site “AI-ready”? No. It is a diagnostic product. It identifies evidence, uncertainty, and remediation steps without changing the site. ### Does it send my site data to an AI provider or SaaS service? No. There are no AI API calls, remote SaaS calls, licensing calls, or telemetry in version 0.1.0. ### Why can a finding be Unknown instead of Fail? Unknown means the plugin could not establish sufficient evidence. For example, a WordPress host may prevent the site from making a loopback request to its own public origin. Treating that condition as a definite content or crawler failure would be misleading. ### Does the audit follow redirects or inspect external URLs? No. Audit HTTP requests are restricted to the exact WordPress home origin and redirect following is disabled. Same-origin sitemap locations can be discovered from robots. txt; cross-origin sitemap locations are not followed. ### Does the plugin execute registered abilities to test them? No. Third-party abilities are inventoried and their public permission behavior can be checked, but their execute callbacks are not run. ### Is llms.txt required for AI agents? No. This plugin treats llms.txt as an experimental supplemental signal and does not penalize a site for not having it. ### Is WebMCP required? No. WebMCP is treated as an experimental signal and is non-scoring. ### What data is stored? The plugin stores the latest full report and up to five compact historical summaries in local WordPress options. Uninstalling the plugin removes those options. ### Does Site Health run the audit automatically? No. Site Health reads the latest stored result only. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ModelGain Agent Readiness Audit” is open source software. The following people have contributed to this plugin. Contributors * [ upaccn ](https://profiles.wordpress.org/upaccn/) [Translate “ModelGain Agent Readiness Audit” into your language.](https://translate.wordpress.org/projects/wp-plugins/modelgain-agent-readiness-audit) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/modelgain-agent-readiness-audit/), check out the [SVN repository](https://plugins.svn.wordpress.org/modelgain-agent-readiness-audit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/modelgain-agent-readiness-audit/) by [RSS](https://plugins.trac.wordpress.org/log/modelgain-agent-readiness-audit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.1.0 * Added versioned Agent Readiness ruleset 2026.10 with Read, Act, and Manage profiles. * Added Discoverability, Readability, Actionability, Safety & Governance, and Observability evidence domains. * Added readiness scoring, separate confidence scoring, and Critical safety caps. * Added bounded same-origin HTTP probes and deterministic HTML analysis. * Added WordPress Abilities API inventory, permission evidence, and conservative side-effect classification. * Added official MCP Adapter detection without installing or operating an MCP server. * Added local report history, previous-run comparison, JSON and Markdown exports, and remediation prompt export. * Added Tools > Agent Readiness admin UI and Site Health summary. * Added WP-CLI audit command and private administrator-only WordPress abilities on compatible WordPress versions. * Added complete uninstall cleanup for plugin-owned report data. ## Meta * Version **0.1.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [abilities-api](https://wordpress.org/plugins/tags/abilities-api/)[ai agents](https://wordpress.org/plugins/tags/ai-agents/) [developer-tools](https://wordpress.org/plugins/tags/developer-tools/)[mcp](https://wordpress.org/plugins/tags/mcp/) [site health](https://wordpress.org/plugins/tags/site-health/) * [Advanced View](https://wordpress.org/plugins/modelgain-agent-readiness-audit/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/modelgain-agent-readiness-audit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/modelgain-agent-readiness-audit/reviews/) ## Contributors * [ upaccn ](https://profiles.wordpress.org/upaccn/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/modelgain-agent-readiness-audit/)