With and without the agent
Capability by capability: what Panelbot does with the limited panel credential alone, what needs full server access through the agent, and what is agent only.
The honest comparison
Panelbot connects to your servers over the panel API with a limited credential, and for most hosts that is the entire setup. Some hosting work genuinely cannot be done that way, and rather than let you discover that during a customer conversation, here is the whole list up front.
The table below is generated from the same catalog your dashboard reads when it shows a connected server’s capabilities, so the two cannot drift apart. When we add or move a capability, this page changes with it.
None of this is a plan feature. Every plan connects servers the same way and runs the same operations; plans differ on how many conversations are included each month. See Compare Panelbot plans.
What the three access levels mean
Limited credential. Works as soon as your server is connected, with nothing installed on the machine. This is the restricted credential the connector mints on your server, or one you created yourself in WHM or DirectAdmin. A reseller credential is enough for it. If you never do anything else, this is what your customers get.
Needs full access (agent). These jobs require root on the server. Panelbot does not take root from your billing portal, so they are switched off until you decide otherwise. Approving the agent install turns them on, and the agent is how we do root: a fixed list of exact commands in a sudoers file on your own machine, every run recorded. On cPanel there is one other way: a root WHM API token you paste yourself also runs root-only work through the WHM Terminal, without an agent. What the agent can and cannot do is the full disclosure on that, including what it still cannot do afterwards.
Agent only. A short list of things no credential can provide at all, because they are not something a control panel API exposes: live streaming metrics from the machine itself, and answering at all when the panel is the thing that is broken. If your panel is down, an agent is the only component still able to tell you anything.
Capability by capability
| Capability | Panel | Access needed | Also requires |
|---|---|---|---|
| List and search hosting accounts | cPanel and DirectAdmin | Limited credential | DirectAdmin command CMD_API_SHOW_ALL_USERS on the key |
| Read an account’s summary | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Read disk and bandwidth usage | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Read DNS zones and records | cPanel and DirectAdmin | Limited credential | DirectAdmin command CMD_API_DNS_ADMIN on the key |
| Fix DNS records for a customer’s domain | cPanel and DirectAdmin | Limited credential | DirectAdmin command CMD_API_DNS_ADMIN on the key |
| Check mailboxes, forwarders and DKIM | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Check a customer’s databases | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Suspend or unsuspend an account | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Reset a customer’s panel password | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Change a customer’s package | cPanel and DirectAdmin | Limited credential | Nothing extra |
| Open a one-time cPanel login link | cPanel only | Limited credential | Nothing extra |
| Unblock a customer’s IP address in CSF | cPanel only | Limited credential | CSF |
| Unblock a customer’s IP address in Imunify360 | cPanel only | Limited credential | Imunify360 |
| Read raw server logs | cPanel and DirectAdmin | Needs full access (agent) | Nothing extra |
| Manage the CSF firewall and LFD as root | cPanel and DirectAdmin | Needs full access (agent) | CSF |
| Read and manage cPHulk brute-force blocks | cPanel only | Needs full access (agent) | Nothing extra |
| Restart services when a hung service is diagnosed | cPanel and DirectAdmin | Needs full access (agent) | Nothing extra |
| Run diagnostics as root through the WHM Terminal | cPanel only | Needs full access (agent) | Nothing extra |
| Manage WordPress sites through WP Toolkit | cPanel only | Needs full access (agent) | WP Toolkit |
| Trigger JetBackup restores | cPanel only | Needs full access (agent) | JetBackup 5 |
| Read Imunify360 scans and infected files | cPanel only | Needs full access (agent) | Imunify360 |
| List installed Softaculous applications | cPanel only | Needs full access (agent) | Softaculous |
| Read and change per-account PHP with CloudLinux Selector | cPanel only | Needs full access (agent) | CloudLinux |
| Stream real-time server metrics | cPanel and DirectAdmin | Agent only | Nothing extra |
| Diagnose when the panel API is itself down | cPanel and DirectAdmin | Agent only | Nothing extra |
The Also requires column names what a row needs beyond the connection itself. That is either a third-party product installed on the server, which Panelbot detects when it connects (a row for something you do not run is greyed out on your dashboard rather than promised), or, on DirectAdmin, a specific API command the login key has to be allowed to call. The DirectAdmin key the connector mints is restricted to reseller-level commands on purpose, so a row naming an admin-only command such as CMD_API_SHOW_ALL_USERS or CMD_API_DNS_ADMIN works only with a key you created yourself with that command allowed. Rows marked Nothing extra need only the panel itself.
The two IP-unblock rows need the agent today, whatever the table says. Unblocking a customer’s IP in CSF or Imunify360 without the agent is not available today; IP unblocks run through the optional agent, with a limited credential and with a root WHM token alike. Your server’s capability list may show the two IP-unblock rows as available when the upstream host has granted the CSF or Imunify360 reseller plugin; Panelbot does not unblock through that grant today, so treat those two rows as agent-only until this page says otherwise.
Panel matters because cPanel and DirectAdmin do not expose the same things. A row marked cPanel only is not missing on DirectAdmin out of neglect; the equivalent does not exist there, or it exists in a form the assistant reaches differently.
Reading this as a decision
If everything your customers write in about is covered by the first group, connect over the panel credential and stop there. That is the common case, and it is why the agent is optional rather than a step in setup.
Approve the agent when you can point at a row in the second group and say your customers hit it. Servers that go down, firewall blocks that need root, mail logs you cannot read without it: those are the ones that turn “we will get a human to look” into “here is what happened”. Everything else about Panelbot behaves exactly as it did before, including the approval rules and the ownership checks.
And if you would rather not, that is a supported answer, not a degraded one. Panelbot works within what you granted, tells the customer plainly when something is outside it, and hands the conversation to your team. See Permission tiers explained for the three ways to connect side by side, and Install the optional server agent when you want the install and uninstall steps.
Related
- What the agent can and cannot do for the full disclosure on the agent.
- Permission tiers explained for how Panelbot connects and how actions are graded by impact.
- Install the optional server agent for the install, update, and removal steps.
- Connect a cPanel or DirectAdmin server for the agentless connection most hosts use.
- Compare Panelbot plans for what does and does not change with your plan.