404ops AI Agent Connector

404ops AI Agent Connector lets an AI agent work on your WordPress site from outside it, over REST or the Model Context Protocol (MCP), while you keep your hand on every control. Nothing is on by default: not the connector, not a single capability, not a key.

Free and Pro include draft translations in German, Spanish, French, Japanese and Brazilian Portuguese.

A lever for every capability

Every capability is a lever with three states:

• Off. The agent cannot do it, and cannot even see the tool.
• Ask. The agent may request it. The request waits in the approval queue, with a preview of what it would do, until you approve or deny it.
• On. The agent may do it at once, as the WordPress user its key acts as, and never beyond what that user can do.

What you control

• A master switch and a kill switch on every screen. The kill switch turns the connector and every lever off, revokes every key and denies every waiting request, in one click.
• One key per agent. A key is shown once and stored only as a hash. Each key acts as a WordPress user you choose, may touch only the post types you tick, may use each lever only up to its own ceiling (never above the site-wide lever), and can expire.
• HTTPS required for keys, except from the server itself or where wp-config.php says otherwise.
• An approval queue. Approving a request runs every check again at that moment, so an approved request can still be refused, with the reason shown.
• An audit log of every request and every administrator action, refusals included, kept for up to 30 days.
• A rate limit per key, and a cap on how many requests one key may leave waiting.
• Secrets stay on the site. wp-config constants, salts, database credentials and anything that looks like an API key or token are masked in everything an agent receives.

Free

The framework and these tools are in the free plugin, and nothing free is moved behind the licence later:

• Read the site: site information, the Site Health summary, plugins, themes, users (display names and roles, never email addresses), a reviewed list of non-secret options, and menus.
• Read and write content: list, search and read posts of any type; create and update them (a revision is kept), set registered custom fields, and move posts to the trash and back. Nothing is ever deleted permanently.
• Categories and tags: list, read, create and update terms, and assign them to posts. Terms are never deleted.
• Media: list and read items, update titles, alt text, captions and descriptions, and add an image from a public HTTPS address (JPEG, PNG, GIF or WebP, up to 10 MB).
• Comments: list and read (never a commenter's email or IP address), approve, hold, mark as spam or trash, and reply.
• Its own requests: an agent can read what became of a request that waited for your approval.

What Pro adds

Pro is a separate add-on that needs the free plugin. Each tool is behind its own lever, the key's ceiling and the acting user's own WordPress capabilities.

A licence covers updates and support. If it expires or is not renewed, the installed version keeps working and Pro features remain active, but updates and support stop. Pro features switch off only when the site has no valid activation, or after the licence is refunded or revoked. While Pro is off, the free plugin keeps working; saved settings, rules and webhook address are kept and apply again when Pro is active. Pro audit retention can extend to a year, but while Pro is off the daily cleanup deletes audit rows older than 30 days. The saved retention setting is remembered. The change journal stays stored while Pro is off, but is hidden, records nothing and cannot undo until Pro is active again.

• Site configuration. Change a reviewed allowlist of options (secret options can never be written or read out), menus, block widgets, saved patterns, site-editor templates and permalinks, and list, run or unschedule scheduled events.
• A Danger zone for system tools. Install and update plugins and themes from WordPress.org by slug, create users and change roles, read and write files inside wp-content behind a path jail, run a read-only database query, run maintenance commands, manage the network sites of a multisite, and manage WooCommerce products and orders. An optional PHP console needs a setting in wp-config.php that a stolen admin session cannot make, and every run of it is approved by a person.
• Arming windows and per-run approval. The Danger zone is armed for a fixed window and disarms itself. By default every Danger-zone call waits for an administrator, even when its lever is On.
• Key policies. Per-key IP allowlists and rate limits, and presets (Read-only analyst, Editor, Maintainer, Full admin).
• A change journal with undo for content, options and files.
• Longer audit retention (up to a year) and a spreadsheet-safe CSV export.
• Alert webhooks. A signed JSON POST to an HTTPS address you choose when a request is waiting, a key is used from a new address, the Danger zone is armed, a Danger-zone tool runs, a request is refused or the kill switch is pulled.

Pro can refuse or observe; it can never grant. It cannot turn a lever on, add a key or skip a check the free plugin makes.

Private by design

The free plugin makes no requests to any outside service on activation, in the background or when an agent connects: agents connect to your site, never the other way round. It carries no telemetry. The one exception is off until you turn it on: with the media lever set to Ask or On, an agent can have your site fetch one image from a public HTTPS address. Pro contacts the 404ops licence service to check your licence key, and sends alerts only if you set up a webhook.

Connecting an agent

REST routes live under /wp-json/agent-connector/v1/ and an MCP endpoint at /wp-json/agent-connector/v1/mcp. Present a key as Authorization: Bearer <key>; a key in a URL is never accepted. Both doors use the same tools and the same checks. It works alongside 404ops Agent Gate: Agent Gate is the deliberately narrow doorway, and this plugin is the deep one.

Free version

The free version is available on WordPress.org once it is listed there.