Built so a mistake, or a bad prompt, has a small blast radius.

In the plugin

Enforced in core, not in one client

Agent Warden wraps each ability’s permission and execute callbacks through the Abilities API, so the same checks apply to the MCP server, the REST API, WP-CLI, and direct PHP calls.

Deny by default

A new agent can do nothing until its policy allows it. Abilities installed later stay denied. Unknown policy keys are refused rather than ignored.

Tokens shown once

Agent tokens are stored hashed and never shown again. Each can be limited by expiry, IP allowlist, client type, and schedule, and revoked at once.

Your own checks still run

Every plugin’s permission_callback runs as usual, even when a policy allows an ability. The agent only holds the capabilities its policy grants for that call.

Sealed approvals

A held request’s input is sealed when it is made, so what a person approves is exactly what runs. Emailed decision links work once, for one approver.

Automatic pause

An agent that keeps hitting refusals or tries blocked actions is paused automatically, and the Agents screen says why.

In the agency hub

Sites call the hub; the hub never calls sites

The hub has no way to reach into a site, run code on it, or read its database. Instructions go through the site’s own checks, as the administrator who connected it.

Every message signed

Each site creates its own Ed25519 key pair. Requests and answers are signed, timestamped, carry a single-use nonce, and are bound to the request they answer.

Pairing without a shared secret on the wire

The pairing code travels in the link’s fragment, which browsers never send to servers, and the hub stores only its SHA-256. Both sides show the same fingerprint.

Counts, not content

Sites send versions, agent names and statuses, waiting approvals, and daily counts. Posts, orders, customers, and agent input are never sent.

Accounts

Passwords are hashed with scrypt. Session and invitation tokens are stored only as hashes. Every action checks the member’s role in one permissions table.

Browser protections

Pages that hold approve, deny, and connect buttons cannot be framed by other sites, and send strict transport, content-type, and referrer headers.

Hub security and data, in detail