ModelGain Agent Readiness Audit

This prevents a network limitation or missing evidence from being misreported as a site defect.

Local and read-only by design

The audit does not:

• modify posts, pages, users, settings, themes, or other plugins;
• submit forms or execute discovered third-party abilities;
• crawl arbitrary third-party URLs;
• send WordPress credentials, cookies, Authorization headers, form data, or customer data with audit probes;
• call an AI API or remote SaaS service;
• send telemetry.

Network probes are limited to the site’s own exact origin. Redirect following is disabled and response size and timeout are bounded.

WordPress Abilities API and MCP

On WordPress versions that provide the Abilities API, the audit inspects registered ability metadata and samples anonymous permission behavior only when WordPress can normalize and validate a default/no-input sample first. If a valid sample cannot be established, the result is Unknown rather than guessed. It does not execute third-party abilities.

When the official WordPress MCP Adapter is present, the audit reports locally observable integration evidence. The plugin does not install or operate an MCP server.

The plugin also registers three private, manage_options-gated abilities for its own audit/report workflow on compatible WordPress versions. They are not exposed publicly to MCP.

Experimental signals

The audit can report supplemental llms.txt and WebMCP signals, but does not treat either as a mandatory web or WordPress standard. Their absence does not create a scored readiness defect.

Reports and automation

The latest full report and up to five compact historical summaries are stored locally in WordPress options.

You can:

• review the report at Tools > Agent Readiness;
• compare the current audit with the previous audit for the same profile;
• export JSON;
• export Markdown;
• export a deterministic remediation prompt generated from the report data;
• use WP-CLI for repeatable audits.

WP-CLI examples:

wp modelgain agent-readiness audit --profile=read --format=table wp modelgain agent-readiness audit --profile=act --format=json wp modelgain agent-readiness audit --profile=manage --format=markdown

Site Health shows a summary of the latest stored report. Opening Site Health does not trigger a new network audit.

Developer Hooks

The core exposes extension points for policy packs, reporting, and future commercial add-ons without requiring a fork:

• modelgain_agent_readiness_http_args adjusts bounded same-origin request settings. Core GET-method, credential, body, redirect, no-streaming, TLS-verification, timeout, response-size, and origin protections are reapplied after this filter.
• modelgain_agent_readiness_facts extends collected evidence before rule evaluation.
• modelgain_agent_readiness_findings extends or deliberately replaces evaluated findings.
• modelgain_agent_readiness_score_cap adjusts the policy/safety score cap.
• modelgain_agent_readiness_report filters the final report before local persistence.
• modelgain_agent_readiness_history_limit adjusts compact local history retention, bounded by the core.
• modelgain_agent_readiness_audit_completed fires after a report has been stored.

Extensions are responsible for preserving stable finding IDs, evidence semantics, least-privilege behavior, and the core privacy boundary.

Privacy

ModelGain Agent Readiness Audit does not send telemetry or data to a ModelGain service.

The audit can make bounded HTTP GET requests to the same origin configured as the site’s WordPress home URL. These requests do not include WordPress authentication cookies, Authorization headers, URL-embedded credentials, request bodies, or customer data. The plugin does not follow redirects.

For abilities explicitly marked public, the audit may invoke their permission callback under an anonymous WordPress user context after a default/no-input sample has passed the ability’s own input normalization and validation. Permission callbacks are inspected only; third-party execute callbacks are never run.