Security and Control

Agent MCP Suite is built around a simple principle: AI agents should only do what you explicitly allow, and every action should be visible.

Authentication

Agents connect with Bearer API keys created inside WordPress.

Permissions

Scope each agent to read, write, media, users, settings, themes, plugins, or admin access.

Approval

Require review before sensitive actions touch production content or settings.

Recommended Defaults

Start with read-only access.
Use separate keys per agent and workflow.
Require approval for publish, delete, users, settings, themes, and plugins.
Review audit logs regularly.
Rotate and revoke unused keys.