4 reads
Inventory, users, scheduled jobs and the database.
- Read the plugin, theme and core inventory
- Read users and roles
- Read scheduled jobs
- Read the database
Protuno reaches each site through a plugin and an application password that you can revoke from your own wp-admin.
No install needed for the audit. We suggest connecting a staging copy of your site first, before your live site.
Reads can run on their own. Writes ask you first by default.
4 reads
Inventory, users, scheduled jobs and the database.
3 writes
Apply an update, turn a plugin on or off, and write a setting. Every write needs the site set to Execute and asks first.
Showing 7 of 7 capabilities
Read the plugin, theme and core inventorywordpress.inventory.read
Reads which plugins, themes and which WordPress version are installed and active, with their version numbers.
Needs: Agent Connector for WP or Universal Abilities
Read users and roleswordpress.users.read
Reads user accounts and roles, used for checks like who holds admin access.
Needs: Administrator application password
Read scheduled jobswordpress.cron.read
Reads the site's scheduled jobs and when each one is due.
Needs: Connector plugin on the site
Read the databasewordpress.database.read
Reads from the site's database, for checks the other reads do not cover.
Needs: Connector plugin on the site
Apply an updatewordpress.updates.apply
Runs a plugin, theme or core update on a site set to Execute.
Undo: Plugin Safe Update restores the previous plugin folder if the site stops working.
Needs: Site mode: Execute, and a verified backup first
Turn a plugin on or offwordpress.plugins.toggle
Activates or deactivates a plugin on a site set to Execute.
Undo: Turn the plugin back on or off.
Needs: Site mode: Execute
Write a settingwordpress.settings.write
Changes a site setting on a site set to Execute.
Undo: Not reversible by Protuno. Take a backup first if you want a way back.
Needs: Site mode: Execute
The Protuno plugin creates the password but grants nothing itself. What an agent can do comes from the connector plugin on your site: Agent Connector for WP by default, or Angie or Novamira if you already run one. The rows below are what Protuno uses.
Reads what is installed and active, and each version, through the WordPress Abilities API the connector registers.
ReadsReads user and role data for checks like admin provenance.
ReadsReads the site's scheduled jobs and when each one is due.
ReadsReads from the site's database, for checks the other reads do not cover.
ReadsApplies WordPress core, plugin and theme updates. Plugin Safe Update saves each plugin folder before updating and restores it if the site breaks.
Ask firstTurns a plugin on or off when the site is set to Execute.
Ask firstChanges a site setting when the site is set to Execute.
Ask first18 playbooks read the WordPress connector today. The Connectors screen in your workspace lists which 18.
How it connects: the Protuno plugin and a connector plugin on your site, plus a WordPress application password. You connect each site on its own.
You need WordPress 6.9 or later, PHP 7.4 or later, HTTPS, an administrator account and application passwords switched on. If your site has no connector plugin yet, Agent Connector for WP needs WordPress 7.0 and PHP 8.1.
you see: The plugin zip download in your Protuno dashboard.
Choose the zip, press Install Now, then Activate.
you see: The Protuno setup screen opens by itself after activation, with three steps across the top: Welcome, Abilities, Connect.
If none exists, press Install & Enable MCP to install Agent Connector for WP and its Universal Abilities companion pack. If one exists but is off, press Enable The Abilities. If one is already running, press Continue.
you see: A card naming the connector and what it exposes, with a plain statement that Universal Abilities reaches WP-CLI, PHP and files. It shows before you press anything.
Copy both. You will not see the password again.
you see: Two values with Copy buttons. Pressing Add Site to Protuno opens your dashboard with the site filled in.
Choose whether this site is live, which starts Read only, or staging, which starts Execute.
you see: The site listed as Waiting until Protuno's first read, then Live, with its mode and connector shown.
Staging We suggest connecting a staging copy of your site first, before your live site.
This matches what the wp-admin screen already told you.
you see: Protuno Is Connected on the WordPress side. On the Protuno side, the site's connector, mode and last-read time.
Connecting a site is part of onboarding on any plan. WordPress connects per site, not per workspace. It is the one connector that playbooks actually read today: 18 of them, as of the 13 October 2026 product check.
Protuno does not publish one for its own MCP calls. The underlying WordPress REST API and Abilities API have no documented global rate limit. Your host's own server limits apply, as they would to any REST traffic.
It cannot force delete a post, delete a WordPress user, or drop or empty a database table. Those are refused before they reach your site, on every plan. Its application password also works only with the MCP server you chose on the Abilities screen.
A site can run more than one MCP server, but Protuno uses exactly one, chosen on the Abilities screen. Its password is refused on every other MCP route on the site. The connection screen shows Live, Waiting or Disconnected, and the time Protuno last read the site.
If the status stays on Waiting after you paste the credentials, see Protuno's Stuck on Waiting troubleshooting. If the heading says An MCP Server Is Already Running, that server is not one of the three Protuno supports: Agent Connector for WP, Angie and Novamira. Switch to a supported one, or turn the unknown server off.
There are three ways. Press Disconnect on the Protuno screen in wp-admin, press Disconnect in the Protuno dashboard, or revoke 'Protuno - AI Super Agent' under Users, Profile, Application Passwords in wp-admin (no Protuno login needed). Deleting the plugin does not revoke the password, so disconnect first.
Capability names and default settings (on its own or ask first) are Protuno's own, and they can change as the product develops. Playbook plan, schedule and date come from Protuno's agent pages. Protuno last confirmed this connector's build status on 13 Oct 2026. Vendor limits and permissions on this page follow the vendor's public documentation as reviewed on 13 Oct 2026. The vendor's own page is the final word.
The free audit looks at the site from the outside. Connect tools afterwards, one capability at a time.
We suggest connecting a staging copy of your site first, before your live site.
That does not look like a web address. Try yourdomain.com
85 Site ChecksNo Credit Card100% Free