{"id":387912,"date":"2026-10-18T07:08:21","date_gmt":"2026-10-18T07:08:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/modelgain-agent-readiness-audit\/"},"modified":"2026-10-18T07:08:12","modified_gmt":"2026-10-18T07:08:12","slug":"modelgain-agent-readiness-audit","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/modelgain-agent-readiness-audit\/","author":23559745,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.1.0","stable_tag":"0.1.0","tested":"7.1.3","requires":"6.6","requires_php":"7.4","requires_plugins":null,"header_name":"ModelGain Agent Readiness Audit","header_author":"ModelGain","header_description":"Audit whether a WordPress site is discoverable, understandable, and safely operable by AI agents, with evidence for every finding.","assets_banners_color":"","last_updated":"2026-10-18 07:08:12","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":80,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1.0":{"tag":"0.1.0","author":"upaccn","date":"2026-10-18 07:08:12","revision":3752650}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[256265,246305,4932,242115,151481],"plugin_category":[],"plugin_contributors":[284600],"plugin_business_model":[],"class_list":["post-387912","plugin","type-plugin","status-publish","hentry","plugin_tags-abilities-api","plugin_tags-ai-agents","plugin_tags-developer-tools","plugin_tags-mcp","plugin_tags-site-health","plugin_contributors-upaccn","plugin_committers-upaccn"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/modelgain-agent-readiness-audit.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>ModelGain Agent Readiness Audit is a local, read-only diagnostic layer for WordPress sites that need to be inspected or operated by AI agents.<\/p>\n\n<p>It answers five practical questions:<\/p>\n\n<ul>\n<li>Discoverability: can machine clients reach and discover the public site?<\/li>\n<li>Readability: does the server-rendered page expose useful, machine-readable structure?<\/li>\n<li>Actionability: are structured WordPress capabilities available and described?<\/li>\n<li>Safety &amp; Governance: do exposed capabilities have clear permission and side-effect boundaries?<\/li>\n<li>Observability: do structured actions expose enough result information to operate safely?<\/li>\n<\/ul>\n\n<p>The plugin produces evidence-based findings instead of automatically changing the site. Every finding has a stable ID, domain, maturity, severity, status, evidence, explanation, remediation guidance, reference, and affected surface.<\/p>\n\n<h4>Audit profiles<\/h4>\n\n<p>Choose the profile that matches the intended agent:<\/p>\n\n<ul>\n<li>Read: the agent only needs to discover and understand public content.<\/li>\n<li>Act: the agent also needs to perform bounded structured actions.<\/li>\n<li>Manage: the agent may participate in administrative or operational workflows.<\/li>\n<\/ul>\n\n<p>Rules that do not apply to the selected profile are marked Not Applicable and do not reduce the profile score.<\/p>\n\n<p>The plugin itself supports WordPress 6.6 and newer. The native WordPress Abilities API was added in WordPress 6.9, so applicable Act\/Manage findings correctly report that capability as unavailable on older WordPress versions rather than pretending the API exists.<\/p>\n\n<h4>Scores and confidence<\/h4>\n\n<p>The readiness score is separate from evidence confidence.<\/p>\n\n<ul>\n<li>Pass, Warning, and Fail findings contribute to scoring.<\/li>\n<li>Unknown means the audit did not have enough evidence to make a safe claim. Unknown findings are excluded from the readiness-score denominator and reduce confidence instead.<\/li>\n<li>Not Applicable findings are excluded from scoring.<\/li>\n<li>Experimental rules are informational and do not affect the score.<\/li>\n<li>A proven Critical safety failure can cap the overall readiness score.<\/li>\n<\/ul>\n\n<p>This prevents a network limitation or missing evidence from being misreported as a site defect.<\/p>\n\n<h4>Local and read-only by design<\/h4>\n\n<p>The audit does not:<\/p>\n\n<ul>\n<li>modify posts, pages, users, settings, themes, or other plugins;<\/li>\n<li>submit forms or execute discovered third-party abilities;<\/li>\n<li>crawl arbitrary third-party URLs;<\/li>\n<li>send WordPress credentials, cookies, Authorization headers, form data, or customer data with audit probes;<\/li>\n<li>call an AI API or remote SaaS service;<\/li>\n<li>send telemetry.<\/li>\n<\/ul>\n\n<p>Network probes are limited to the site's own exact origin. Redirect following is disabled and response size and timeout are bounded.<\/p>\n\n<h4>WordPress Abilities API and MCP<\/h4>\n\n<p>On WordPress versions that provide the Abilities API, the audit inspects registered ability metadata and samples anonymous permission behavior only when WordPress can normalize and validate a default\/no-input sample first. If a valid sample cannot be established, the result is Unknown rather than guessed. It does not execute third-party abilities.<\/p>\n\n<p>When the official WordPress MCP Adapter is present, the audit reports locally observable integration evidence. The plugin does not install or operate an MCP server.<\/p>\n\n<p>The plugin also registers three private, manage_options-gated abilities for its own audit\/report workflow on compatible WordPress versions. They are not exposed publicly to MCP.<\/p>\n\n<h4>Experimental signals<\/h4>\n\n<p>The audit can report supplemental llms.txt and WebMCP signals, but does not treat either as a mandatory web or WordPress standard. Their absence does not create a scored readiness defect.<\/p>\n\n<h4>Reports and automation<\/h4>\n\n<p>The latest full report and up to five compact historical summaries are stored locally in WordPress options.<\/p>\n\n<p>You can:<\/p>\n\n<ul>\n<li>review the report at Tools &gt; Agent Readiness;<\/li>\n<li>compare the current audit with the previous audit for the same profile;<\/li>\n<li>export JSON;<\/li>\n<li>export Markdown;<\/li>\n<li>export a deterministic remediation prompt generated from the report data;<\/li>\n<li>use WP-CLI for repeatable audits.<\/li>\n<\/ul>\n\n<p>WP-CLI examples:<\/p>\n\n<pre><code>wp modelgain agent-readiness audit --profile=read --format=table\nwp modelgain agent-readiness audit --profile=act --format=json\nwp modelgain agent-readiness audit --profile=manage --format=markdown\n<\/code><\/pre>\n\n<p>Site Health shows a summary of the latest stored report. Opening Site Health does not trigger a new network audit.<\/p>\n\n<h3>Developer Hooks<\/h3>\n\n<p>The core exposes extension points for policy packs, reporting, and future commercial add-ons without requiring a fork:<\/p>\n\n<ul>\n<li><code>modelgain_agent_readiness_http_args<\/code> adjusts bounded same-origin request settings. Core GET-method, credential, body, redirect, no-streaming, TLS-verification, timeout, response-size, and origin protections are reapplied after this filter.<\/li>\n<li><code>modelgain_agent_readiness_facts<\/code> extends collected evidence before rule evaluation.<\/li>\n<li><code>modelgain_agent_readiness_findings<\/code> extends or deliberately replaces evaluated findings.<\/li>\n<li><code>modelgain_agent_readiness_score_cap<\/code> adjusts the policy\/safety score cap.<\/li>\n<li><code>modelgain_agent_readiness_report<\/code> filters the final report before local persistence.<\/li>\n<li><code>modelgain_agent_readiness_history_limit<\/code> adjusts compact local history retention, bounded by the core.<\/li>\n<li><code>modelgain_agent_readiness_audit_completed<\/code> fires after a report has been stored.<\/li>\n<\/ul>\n\n<p>Extensions are responsible for preserving stable finding IDs, evidence semantics, least-privilege behavior, and the core privacy boundary.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>ModelGain Agent Readiness Audit does not send telemetry or data to a ModelGain service.<\/p>\n\n<p>The audit can make bounded HTTP GET requests to the same origin configured as the site's WordPress home URL. These requests do not include WordPress authentication cookies, Authorization headers, URL-embedded credentials, request bodies, or customer data. The plugin does not follow redirects.<\/p>\n\n<p>For abilities explicitly marked public, the audit may invoke their permission callback under an anonymous WordPress user context after a default\/no-input sample has passed the ability's own input normalization and validation. Permission callbacks are inspected only; third-party execute callbacks are never run.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate ModelGain Agent Readiness Audit.<\/li>\n<li>Open Tools &gt; Agent Readiness.<\/li>\n<li>Select Read, Act, or Manage.<\/li>\n<li>Run the audit and review the evidence before changing production configuration.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20plugin%20automatically%20make%20my%20site%20%22ai-ready%22%3F\"><h3>Does this plugin automatically make my site \"AI-ready\"?<\/h3><\/dt>\n<dd><p>No. It is a diagnostic product. It identifies evidence, uncertainty, and remediation steps without changing the site.<\/p><\/dd>\n<dt id=\"does%20it%20send%20my%20site%20data%20to%20an%20ai%20provider%20or%20saas%20service%3F\"><h3>Does it send my site data to an AI provider or SaaS service?<\/h3><\/dt>\n<dd><p>No. There are no AI API calls, remote SaaS calls, licensing calls, or telemetry in version 0.1.0.<\/p><\/dd>\n<dt id=\"why%20can%20a%20finding%20be%20unknown%20instead%20of%20fail%3F\"><h3>Why can a finding be Unknown instead of Fail?<\/h3><\/dt>\n<dd><p>Unknown means the plugin could not establish sufficient evidence. For example, a WordPress host may prevent the site from making a loopback request to its own public origin. Treating that condition as a definite content or crawler failure would be misleading.<\/p><\/dd>\n<dt id=\"does%20the%20audit%20follow%20redirects%20or%20inspect%20external%20urls%3F\"><h3>Does the audit follow redirects or inspect external URLs?<\/h3><\/dt>\n<dd><p>No. Audit HTTP requests are restricted to the exact WordPress home origin and redirect following is disabled. Same-origin sitemap locations can be discovered from robots.txt; cross-origin sitemap locations are not followed.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20execute%20registered%20abilities%20to%20test%20them%3F\"><h3>Does the plugin execute registered abilities to test them?<\/h3><\/dt>\n<dd><p>No. Third-party abilities are inventoried and their public permission behavior can be checked, but their execute callbacks are not run.<\/p><\/dd>\n<dt id=\"is%20llms.txt%20required%20for%20ai%20agents%3F\"><h3>Is llms.txt required for AI agents?<\/h3><\/dt>\n<dd><p>No. This plugin treats llms.txt as an experimental supplemental signal and does not penalize a site for not having it.<\/p><\/dd>\n<dt id=\"is%20webmcp%20required%3F\"><h3>Is WebMCP required?<\/h3><\/dt>\n<dd><p>No. WebMCP is treated as an experimental signal and is non-scoring.<\/p><\/dd>\n<dt id=\"what%20data%20is%20stored%3F\"><h3>What data is stored?<\/h3><\/dt>\n<dd><p>The plugin stores the latest full report and up to five compact historical summaries in local WordPress options. Uninstalling the plugin removes those options.<\/p><\/dd>\n<dt id=\"does%20site%20health%20run%20the%20audit%20automatically%3F\"><h3>Does Site Health run the audit automatically?<\/h3><\/dt>\n<dd><p>No. Site Health reads the latest stored result only.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Added versioned Agent Readiness ruleset 2026.10 with Read, Act, and Manage profiles.<\/li>\n<li>Added Discoverability, Readability, Actionability, Safety &amp; Governance, and Observability evidence domains.<\/li>\n<li>Added readiness scoring, separate confidence scoring, and Critical safety caps.<\/li>\n<li>Added bounded same-origin HTTP probes and deterministic HTML analysis.<\/li>\n<li>Added WordPress Abilities API inventory, permission evidence, and conservative side-effect classification.<\/li>\n<li>Added official MCP Adapter detection without installing or operating an MCP server.<\/li>\n<li>Added local report history, previous-run comparison, JSON and Markdown exports, and remediation prompt export.<\/li>\n<li>Added Tools &gt; Agent Readiness admin UI and Site Health summary.<\/li>\n<li>Added WP-CLI audit command and private administrator-only WordPress abilities on compatible WordPress versions.<\/li>\n<li>Added complete uninstall cleanup for plugin-owned report data.<\/li>\n<\/ul>","raw_excerpt":"Audit whether a WordPress site is discoverable, understandable, and safely operable by AI agents, with evidence for every finding.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/387912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=387912"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/upaccn"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=387912"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=387912"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=387912"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=387912"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=387912"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=387912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}