Check MCP server status

Two ways to confirm the server is healthy: the diagnostics button in the settings panel, and the public status endpoint. Use the first when setting up, the second when a client is misbehaving.

The MCP settings panel

Settings → POM AI → MCP server shows three cards.

Endpoints — the MCP URL, the protected resource metadata URL and the authorization server metadata URL. See Find the MCP server URL.

Credentials — whether an API key is active, and its last four characters. Buttons to Generate / rotate API key, Revoke API key and Reset OAuth.

If pretty permalinks are not configured, an error appears above these cards explaining that the discovery and OAuth endpoints listed below currently return 404. Fix that before anything else — the endpoint URLs are printed either way, so the failure is otherwise silent.

Status — a short list:

The last line is worth reading on multisite. Configuring the wrong subsite is a common and confusing mistake.

Run diagnostics

The Run diagnostics button makes the site call its own endpoints and reports what came back. It answers the questions that matter when something is wrong:

• Permalinks enabled — false explains why the .well-known and OAuth URLs 404.
• Authorization header seen and API key header seen — whether those headers survived the journey to WordPress. A stripped Authorization header is the classic cause of OAuth failing silently.
• CloudFront detected, with the paths that must bypass caching and the headers that must be forwarded.
• Self-tests for the protected resource metadata, the authorization server metadata and the status endpoint, each reporting the HTTP status, the content type, whether the body parsed as JSON, and whether HTML appeared where JSON should be.

That last check is the useful one: HTML in the response means something upstream — a security plugin, a WAF challenge, a maintenance page — intercepted the request.

Recent MCP logs

Below the cards, the panel lists the ten most recent MCP events with time, action, status, authentication type and the acting user. Selecting an action opens the full entry.

This is where you see what a connected client actually did: authentications, tool calls, denials and rate limits. Sensitive values are redacted before anything is written, and long values are truncated.

Log entries are pruned automatically according to Log retention days, which defaults to 30.

The status endpoint

https://example.com/wp-json/pom-ai-mcp/v1/status

Public, unauthenticated, and safe to open in a browser. It reports whether the server is active, the MCP endpoint, which authentication methods are enabled, whether an API key exists, which products were detected, the POM AI version, which write gates are open, and the supported protocol versions.

Full detail in The status endpoint.

A quick health routine

1. Open the status endpoint in a browser. JSON means the server is answering.
2. Check capabilities — do the open write gates match what you intended?
3. Check the detected products.
4. Run diagnostics from the settings panel.
5. Confirm the self-tests are OK and no HTML appeared.
6. Check the recent logs for denials you cannot explain.

Reading a problem

After changing settings

Re-run diagnostics after enabling the MCP tool, changing authentication settings, opening a write gate, or changing permalinks. The endpoint URLs and rewrite rules are established when the tool initializes, and diagnostics is the fastest confirmation that the current state is what you think it is.