What the POM AI MCP server does not expose

Knowing the boundaries is as useful as knowing the tools. Some of these are deliberate refusals; others are simply outside the server's scope.

It is not an AI service

No tool here calls a language model, generates text or images, or consumes POM AI credits. The intelligence is entirely in the client you connect.

POM AI's own generation tools — writing, translation, images — are separate and live in the WordPress administration. They are not exposed over MCP.

It does not expose secrets

Option and meta tools deny secret-like keys, so they cannot be used to read credentials out of the database. The POM AI license key, the MCP API key and OAuth tokens are not readable through any tool.

Logs redact sensitive values before writing and truncate long ones.

It is site-scoped, never network-wide

The server belongs to one site. There is no tool that enumerates a multisite network, reaches another site's content, or changes network settings. Each site has its own endpoint, credentials, settings and logs.

It does not manage WordPress itself

No installing, activating, updating or deleting plugins and themes. No user creation, role editing or password changes. No file editing. No database queries. No cron or scheduling control. No core updates.

An assistant that needs those things needs a human with an administrator login, not this server.

It does not bypass WordPress

Every operation runs as a real user through ordinary WordPress functions. Capabilities apply exactly as they would in the admin, and any plugin hooking those operations still runs.

That is a deliberate design choice: it means MCP cannot do something the acting user could not do by hand, and it means your existing customisations are not circumvented.

Media fetching is constrained

Remote media downloads block private and reserved network addresses, refuse redirects, cap response size and accept only safe raster image types.

So a tool cannot be pointed at an internal address to probe your network, and cannot pull arbitrary file types into the media library.

Optional groups are absent, not broken

POM Theme, WooCommerce and POM Cache tools exist only when those products are active. On a site without WooCommerce, the catalogue tools are not registered at all — a client asking for one gets pom_ai_mcp_unknown_tool.

Check the status endpoint to see what was detected.

There is no undo

Site writes require a preview and user approval. Exact reviews authorize listed operations once. An explicitly approved network work session permits supported future writes on one destination for its selected groups and duration; deletion tools and composite plans retain exact reviews. An approval_required result has not applied the change. Approved execution can change live content immediately; it does not provide automatic rollback. See Review and approve writes.

No streaming or long-running jobs

The server returns a result for each request. Bounded term batches can process up to 50 changes; larger tasks need several reviewed batches. Authoring journals track dependent steps, and facet indexing advances through bounded native batches. A disconnected write must be inspected before retrying.

Rate limits are not a safety mechanism

Reads are capped per client per minute and writes at a lower ceiling. This bounds how fast a session can act; it does not prevent a determined sequence of harmful changes. Treat it as a speed bump.

It cannot judge intent

The server checks scopes, capabilities, gates, schemas and the applicable exact-operation approval or temporary work session. It cannot tell whether a change is a good idea, whether a price is right, whether copy is accurate or whether deleting something was intended.

That judgement is yours, expressed through which gates you open, which user approves, whether you work on staging, and how you brief the assistant.

Not designed for untrusted callers

Every call authenticates and the surface is deliberately narrow, but this is not a public API. Do not expose it to clients you would not give a WordPress login to, and keep the allowed-origins list empty unless a specific browser client needs it.

Where the detail lives

MCP boundaries covers the per-tool limits and the operations that are deliberately absent. For what is available, see the capability map.