Check what a new connection can reach before you give it work

You have just connected an agent, or you have a handful of sites each with its own agent user, and you want to know what each one can actually do before you hand it real work. The role names do not tell you much on their own, and finding out by letting it fail halfway through a job is the slow way.

This prompt runs a short, fixed set of reads and reports the result. It touches nothing, and it works from the connection you are testing, so what it reports is what that connection can do.

I am about to give you work on this site and I want to know what this
connection can reach first. Read only: change nothing.

Start by confirming which site you are connected to, with its name and URL. If
you are connected to more than one site, run everything below for each one in
turn and label every result with the site name.

Then try each of these once, with the smallest request that proves the point,
and tell me whether it worked, was refused, or was not in your tool list at all:

1. Count the posts by status.
2. List one draft post.
3. List one comment waiting in moderation.
4. List the installed plugins.
5. List the navigation menus.
6. Read the site settings.

If a tool is not in your list, do not look for another way around it. Say it is
missing and move on.

Report a short table with one row per check: what I asked, what happened, and
one line on what that suggests about how far this connection reaches. Mark
which parts are inference. End with whether this connection looks right for
[reading and drafting content], and what I should check in WordPress if
something I expected is missing.

Why this is safe to run

All seven abilities are reads, and each is asked for the smallest amount of data that answers the question: one draft, one comment, counts instead of lists where counts will do. Nothing here writes, publishes or deletes, and the prompt tells the agent to stop at a missing tool instead of finding a route around it.

The useful part is in how the results read. The six reads sit at different levels of access, from ordinary reading up to managing options, so a connection that clears the first three and fails the last three is telling you where its role stops. Some tools may simply be absent from the agent’s list, which is not the same as a refusal, and the agent cannot say why. Open the Abilities tab to see whether you switched the ability off, check for a role or connection allowlist that narrows it, and check the connected user’s role if neither explains it.

Already connected? Skip the paste. Ask your agent for the “what can this connection reach” recipe, or just ask it to test what it can see on the site, and it runs the same reads against your own install.