Your AI app does not talk to your site directly. It talks to flitagent.com, which relays each tool call to the site and the answer back.
- Your AI app connects to
https://mcp.flitagent.com/and logs in with your flitagent.com account (OAuth 2.1 with PKCE). It holds a flitagent.com token, not a password for your site. - flitagent.com checks the token, your account’s limits and which of your sites the call names, then sends the call to the site, signed with flitagent.com’s key.
- The site checks the request headers that start with
FlitAgent-: its own connection ID, a timestamp within 5 minutes, a one-time nonce and an Ed25519 signature that also covers the AI app’s name. It verifies the signature with flitagent.com’s public keys, which it fetches itself. A request that fails any check is refused. - The site checks Access for AI tools: while it is Read only, write tools are refused.
- The tool runs as the administrator who connected the site, with that user’s WordPress permissions.
- A change is not written yet: it waits in FlitAgent → Approvals for an administrator in a logged-in wp-admin session, unless the site’s auto-approve policy allows it. Every write gets a receipt.
- The answer goes back through flitagent.com to the app. flitagent.com passes it through without storing it and records one usage entry, with no arguments and no results.
What flitagent.com cannot do
- Log in to your site: it holds no password or token for it.
- Approve a change: approvals happen only in wp-admin.
- Change what AI tools may do on a site: once you approve the site, Access for AI tools changes only in its wp-admin.
- Run code of its choice: every action is a named tool in the plugin, with a schema, a required capability and a risk class.
A request signed with flitagent.com’s key can make any tool call an AI app could. The site’s Access for AI tools, approvals and auto-approve limit what that call does.
Disconnect the site in FlitAgent → Connect and it refuses every request at once: Disconnect and uninstall.