=== 404ops AI Agent Connector ===
Contributors: spwhite
Tags: ai agents, mcp, rest api, access control, audit log
Requires at least: 7.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 0.4.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Give an AI agent deep remote access to your site, with a lever for every capability, an approval queue, an audit log and a kill switch.

== Description ==

404ops AI Agent Connector lets an AI agent work on your WordPress site from outside it, over REST or the Model Context Protocol (MCP), while you keep your hand on every control. **Nothing is on by default**: not the connector, not a single capability, not a key.

Every capability is a **lever** with three states: **Off** (the agent cannot do it or even see the tool), **Ask** (the request waits in the approval queue, with a preview, until you approve or deny it) and **On** (the agent may do it at once, as the WordPress user its key acts as, never beyond what that user can do).

**What you control**

* **A master switch and a kill switch on every screen.** The kill switch turns the connector and every lever off, revokes every key and denies every waiting request, in one click.
* **Keys, one per agent.** Shown once and stored only as a hash. Each key acts as a WordPress user you choose, may touch only the post types you tick, may use each lever only up to its own ceiling (never above the site-wide lever), and can expire.
* **HTTPS required** for keys, except from this machine or where wp-config.php says otherwise.
* **An approval queue.** Approving a request runs every check again at that moment, so an approved request can still be refused, with the reason shown.
* **An audit log** of every request and every administrator action, refusals included, kept for 30 days by default, with a choice of 1 to 3,650 days.
* **A rate limit** per key, and a cap on how many requests one key may leave waiting.
* **Secrets never leave the site.** wp-config constants, salts, database credentials and anything that looks like an API key or token are masked in everything an agent receives.

**What an agent can do (free):** read the site (info, Site Health, plugins, themes, users without emails, reviewed non-secret options, menus); read and write content (create, update with revisions, registered custom fields, trash and restore, never a permanent delete); categories and tags (never deleted); media (list, update text fields, sideload an image from a public HTTPS address); comments (list, moderate, reply); and the status of its own waiting requests. The FAQ lists every tool.

Configuration and system tools (options and menus, widgets, plugins, users, files, the database and more) are for the Pro add-on, behind a Danger zone. Nothing free is moved behind the licence later.

== External services ==

This plugin makes no requests to any outside service on activation, in the background or when an agent connects: agents connect to your site, never the other way round. Nothing is sent to 404ops or to anyone else, and it carries no telemetry.

There is one exception, and it is off until you turn it on. When you set the "Add and edit media" lever (`media.upload`) to Ask or On, an agent can call the `media_sideload` tool to have your site download one image from an `https://` address the agent names, to add it to your media library. Your site sends an ordinary HTTPS GET request to that address, and nothing else: no data about your site, your users or the agent. The address is chosen by the agent, so it may be any public web server; the terms and privacy policy that apply are those of whoever runs it. Your site refuses addresses on private, loopback or reserved networks (checked again at every redirect), anything that is not HTTPS on port 443, files over 10 MB and files that are not images. In Ask mode nothing is fetched until you approve the request.

The optional Pro add-on contacts the 404ops licence service to check your licence key, and can send alert messages to one HTTPS address you choose; its own readme describes both. Without it, nothing else is ever sent.

== Installation ==

1. Upload the plugin directory to `/wp-content/plugins/`, or install it from the Plugins screen.
2. Activate it. Nothing is on: open 404ops, then AI Agent Connector.
3. Turn the connector on, choose the levers an agent may use, and create a key.
4. Give the key to your agent as a bearer token, with the MCP endpoint or the REST base shown on the Overview tab.

Your site must be served over HTTPS for a remote agent to connect.

== Frequently Asked Questions ==

= Does this plugin make external requests? =

Only if you turn on the media lever and an agent asks your site to fetch an image from a public HTTPS address. See External services above.

= Can an agent do anything the moment I install it? =

No. A fresh install answers every request with "the connector is switched off". After you turn it on, every lever is still off, and there are no keys until you create one.

= Can a key do more than I allowed? =

No. A call is allowed only up to the lower of the lever's site-wide setting and the key's own ceiling for that lever, only as the WordPress user the key acts as, and only on the post types ticked for that key. Choose an editor, not an administrator, for an agent that only needs to write content.

= How are keys stored? =

Only a SHA-256 hash of the secret half is stored. The key itself is shown once, when you create it, and cannot be recovered; create a new one if it is lost.

= What does the kill switch do? =

It turns the connector off, sets every lever to Off, revokes every key, disarms the Danger zone and denies every waiting request, and records who did it. It does not undo content an agent already changed. Turning the connector on again gives you an empty, all-off connector with no keys.

= Can an agent delete content, install plugins or edit files? =

An agent can move posts and comments to the trash and back, if you allow it; it can never delete anything permanently, in any release. If your site has turned its trash off, the trash tools refuse rather than delete. Plugin, user and file tools are in the Pro add-on, behind a Danger zone you must arm, and its optional PHP console additionally needs a setting in wp-config.php that a stolen admin session cannot make.

= Does it work alongside 404ops Agent Gate? =

Yes. They are separate plugins with their own routes, tables and settings, tested together on one site. Agent Gate is the deliberately narrow doorway; this plugin is the deep one.

= What does the audit log keep, and can I export or erase it? =

Each row holds the key's public prefix, the user it ran as, the tool, the outcome, the network address and the time, kept for 30 days by default (choose 1 to 3,650 days in Settings). Tools, Export Personal Data lists a user's keys and rows; Tools, Erase Personal Data removes the stored addresses and keeps the rows, which are your security record. The Privacy Policy Guide gains a suggested paragraph.

= Which tools can an agent use with the free plugin? =

Every tool is behind its lever, the key's ceiling and the WordPress user the key acts as. Lists are paged (at most 100 items a page).

* **Read the site:** `site_info` (name, addresses, versions, counts), `site_health` (the Site Health status WordPress last recorded, versions, HTTPS, debug and cache settings, pending updates), `plugin_list`, `theme_list`, `user_list` (display names and roles; never email addresses, logins or password hashes), `option_list` and `option_get` (a reviewed list of WordPress's own non-secret settings, without the admin email), `menu_list` and `menu_get`.
* **Read content:** `post_types_list`, `post_list` (by type and status, with search), `post_search`, `post_get` (raw content, terms, featured image, registered custom fields), `post_revisions`, `post_meta_get`.
* **Write content:** `post_create`, `post_update` (only the fields sent; a revision is kept), `post_meta_set` (custom fields that a plugin or theme registered, only), `post_trash` and `post_restore` (never a permanent delete).
* **Categories and tags:** `taxonomy_list`, `term_list`, `term_get`, `term_create`, `term_update`, `post_set_terms`. Terms are never deleted.
* **Media:** `media_list`, `media_get`, `media_update` (title, alt text, caption, description) and `media_sideload`, which fetches a JPEG, PNG, GIF or WebP image of up to 10 MB from a public `https://` address.
* **Comments:** `comment_list` and `comment_get` (never a commenter's email or IP address), `comment_set_status` (approve, hold, spam, trash) and `comment_reply`, as the key's user.
* **Its own requests:** `approval_status`, to read what became of a request that waited for your approval.

In Ask mode, a change waits in the approval queue with a before-and-after view of each field it would change, and nothing happens until you approve it.

= How does an agent connect? =

REST routes under `/wp-json/agent-connector/v1/`: `GET /tools`, `POST /tools/{name}`, `GET /whoami`; and an MCP endpoint at `/wp-json/agent-connector/v1/mcp` (Streamable HTTP, JSON responses; protocol revisions 2025-06-18, 2025-11-25 and 2026-07-28). Present a key as `Authorization: Bearer <key>`. A key in a URL is never accepted. Both doors use the same tools and the same checks.

= Where can I get help? =

Visit https://supportminer.404ops.com to open a support request.

== Screenshots ==

1. Overview: the master switch, the kill switch, the setup steps and the connection details. Nothing is on after install.
2. Levers: every capability, each Off, Ask or On, with its edition and availability.
3. Keys: create a key per agent, choose the user it acts as and the post types it may touch.
4. Audit log: every request and administrator action, refusals included.
5. Approval queue: requests made under an Ask lever wait here until you approve or deny them.

== Changelog ==

= 0.4.5 =
* Changed: audit retention from 1 to 3,650 days is available in Free. The 30-day default stays the same, and removing Pro no longer shortens the selected period.
* Changed: the existing rate range up to 10,000 requests per minute is also selectable in Free, with the same 60/minute default. Pro still adds separate per-key policies.

= 0.4.4 =
* Test tooling: wait for WordPress login focus before filling credentials. Runtime features are unchanged.

= 0.4.3 =
* Added: five bundled draft language catalogs with checked WordPress translation loading.
* Improved: development test-session tooling and catalog packaging checks.

= 0.4.2 =
* Changed: internal clean-up only. Database queries bind the plugin's table names as identifiers, and error-message escaping notes are documented. No behaviour change.

= 0.4.1 =
* Updated the licence client (0.3.5): Pro keeps working after a licence expires.

= 0.4.0 =
* New: the audit log and keys are in WordPress's personal-data tools. Export lists a user's keys and audit rows; Erase removes the stored addresses and keeps the rows. A suggested privacy policy paragraph names your saved retention and the one optional outbound request.
* New: on a network, a deleted site's connector tables are removed with it, and network deactivation clears the daily event on every site.

= 0.3.1 =
* Readme: the description fits the wordpress.org parser limit, with the full tool list and connection details moved to the FAQ; real listing screenshots, icon and banners replace the scaffold placeholders. No code change.

= 0.3.0 =
* New: the seams the Pro add-on's tiers use, each one only able to refuse or observe: a mode cap that can lower a tool's mode (never raise it), and notices when a tool runs and when an audit row is written.
* New: a lever for running and unscheduling scheduled events (Pro).
* Changed: the Danger zone card says the Danger-zone tools come with the Pro add-on.

== Upgrade Notice ==

= 0.4.4 =
Retains bundled draft translations; repairs browser login verification without changing runtime features.

= 0.4.3 =
Includes bundled draft translations and checked catalog packaging. Human linguistic review is separate.

= 0.4.0 =
Adds WordPress personal-data export and erase for the audit log, and multisite clean-up. Nothing new is on: every lever stays off until you turn it on.

= 0.3.1 =
Readme and listing update. No code change.

= 0.3.0 =
Adds the hooks the Pro tiers use. Nothing new is on: every lever stays off until you turn it on.

= 0.2.0 =
Adds every free read and content tool. All new levers are off until you turn them on.

= 0.1.0 =
First release.
