Connect your websites to one AI agent

Use one account MCP connection to work on several websites with Claude Code, Codex or another compatible agent. Each website keeps its own WordPress user, permissions and settings. Websites can run on separate servers or be individual sites in a WordPress multisite network.

This guide is for a POM AI Unlimited account owner who can obtain WordPress authorization on each website. MCP is the connection through which your agent discovers and uses website tools. The authoring skill supplies instructions; installing it does not grant access.

Before you start

• Have an active POM AI Unlimited license on this account, with each destination domain already authorized for that license. Connecting a website does not activate a new license domain. Existing license restrictions still apply.
• On every destination, enable POM AI MCP under Settings → POM AI → AI Tools, then enable Enable OAuth under MCP server. Keep POM AI updated on every destination. The account connection requires its current authoring security policy and will ask you to update an older destination before connecting or executing operations. Use WordPress 6.9+; the complete POM AI package includes the official MCP Adapter and selects it automatically. No separate adapter plugin or transport setting is required. After upgrading a destination from the standard transport, reconnect it to start a native session.
• Use public HTTPS URLs with valid certificates and pretty permalinks. Copy the exact website URL, including its subdirectory. Redirects, custom HTTPS ports and private network addresses are not supported for destination websites.
• Choose the WordPress user whose access the agent should use. Enable only the destination write groups needed for the work.

1. Check and connect a website

1. Sign in to your POM account. Open My Account → POM AI Management → AI site connections.
2. Under Connect a website, select the POM AI Unlimited license and enter the Site URL. Expand Prepare WordPress for the setup checklist.
3. Select Check website. A successful check confirms the license, the website's MCP configuration and OAuth discovery. It does not register an agent or authorize website access. Your form values remain available after the check.
4. Leave the operations checkbox clear for Read only access. Select Allow site operations, including writes permitted by the WordPress user and the site’s enabled write groups when execution is intended.
5. Select Connect a website. Sign in on the destination's WordPress screen as the intended user, review the requested scopes, and select Authorize. Deny grants no access.
6. Back in the account page, find the website under Your websites. Confirm Connected and the intended access, then select Check connection.
7. Repeat for each website. A network's main site does not automatically authorize its subsites; connect each intended subsite explicitly.

Last check shows Verified or Needs attention, the check date and the observed result. This is a snapshot, not continuous monitoring. Every requested site operation checks current license and website access again. A connection can remain listed as Connected while its latest check reports a problem requiring attention.

Setup and connection checks share a limit of 30 checks per hour per account. Starting website authorization has a separate limit of ten attempts per hour. Loading the account page does not run checks against every website.

2. Connect the agent once

Copy Account MCP URL with Copy URL. Add it as a remote HTTP MCP server using OAuth. Do not paste a product license key into a Bearer token field.

For current Claude Code versions, replace ACCOUNT_MCP_URL below with the copied URL:

claude mcp add --transport http --scope user pom-account 'ACCOUNT_MCP_URL'
claude mcp login pom-account

In older Claude Code versions, open /mcp and authenticate pom-account. See the official Claude Code MCP guide.

For Codex:

codex mcp add pom-account --url 'ACCOUNT_MCP_URL'
codex mcp login pom-account

The add command may already start authorization. Complete login when the client still needs authentication. See the official Codex MCP guide.

Sign in with this POM account when the browser opens. The consent screen shows the scopes requested by the client:

Configure narrower scopes in the client before authorizing if execution is not wanted. For example, Codex accepts codex mcp login pom-account --scopes mcp:read,account:sites:read. Claude Code supports a space-separated oauth.scopes setting in its HTTP MCP configuration. The consent screen displays the resulting request; it does not edit the client's scope selection.

Expected result: one agent connection lists the websites you explicitly enrolled. Account consent also covers websites enrolled later. It does not grant access to another customer's websites or administration of the account website itself. Destination permissions still apply.

3. Install the skill and verify a first task

1. Under Install the authoring skill, select Download POM site skill.
2. Extract the complete folder and follow its INSTALL.md. For project installation, use .claude/skills/ in Claude Code or .agents/skills/ in Codex. Preserve the supporting reference files.
3. Start with: “Use POM Site Authoring to list my connected websites. Select the domain I name, inspect its available tools and read an existing page. Do not change anything yet.”
4. Confirm that the agent selects the intended website. For an authorized writing workflow, ask it to create a draft, read it back and inspect it in WordPress before publication.

WordPress does not need to run on the agent's computer. Visual verification requires the agent's own browser access. The skill is also available from a destination's Settings → POM AI → MCP server → Download POM site skill.

Supported operations and security

A connection exposes the destination's supported website-authoring tools, subject to the authorized WordPress user, OAuth scopes and enabled write groups. It cannot manage user accounts, change passwords or roles, install software, execute arbitrary code, or create and modify JavaScript or PHP. HTML follows the destination's WordPress KSES rules, including for administrators. Generic plugin-option dumps and protected internal metadata are unavailable.

Agents can assign scripts that already exist in POM Theme's catalog to editable pages, posts and supported custom content, and to archive, single and feed templates. Selecting an existing script does not grant access to create or edit its source. Script assignments to content need both content and POM Theme write groups.

Update POM AI on each destination when a connection asks for an update, then run Check connection. Installing the skill alone does not change a website's supported operations.

Revoke an agent or reconnect a website

Under Authorized agents, select Revoke agent access beside the intended client. This revokes that agent's account access and refresh credentials, together with its pending authorization codes for your user. Other agents and connected websites remain available. An operation already dispatched may finish. To return, the agent needs a new OAuth authorization. Client names are supplied by clients; use the displayed identifier suffix to distinguish matching names.

Under Your websites, Disconnect removes the selected connection and requests revocation of its destination WordPress grant. Other websites remain available. If remote revocation cannot be confirmed, the notice explains this; Reset OAuth on that destination revokes all of its OAuth clients and tokens.

To change a website's user or granted access:

1. Select Disconnect and reconnect. The old grant is removed immediately.
2. Review the prefilled URL, license and operations checkbox.
3. Select Connect a website and complete fresh destination consent.
4. Confirm Connected, run Check connection, then ask the agent to list websites again and select the new connection.

A disconnected row offers Connect again. Existing website content remains. A new connection has a new client identity and does not take ownership of journals created under the previous one. Preserve any journal information needed for manual review before reconnecting.

When access needs attention

One call targets one website. There is no multi-site transaction or automatic undo. The account accepts up to 1 MiB of routed arguments and 2 MiB responses; destination limits and rate limits also apply. Work in small steps whose results you can inspect.

Related: Authorize a domain for POM AI, Your POM AI subscription.