/wp-json/pom-ai-mcp/v1/mcp: MCP transport endpoint
The single endpoint every MCP client talks to. It carries the JSON-RPC messages that make up an MCP session.
https://example.com/wp-json/pom-ai-mcp/v1/mcpMethods
| Method | Purpose |
|---|---|
POST |
Carries JSON-RPC messages — the normal path |
GET |
A readiness probe returning the protocol version and server name |
DELETE |
Ends a session |
OPTIONS |
CORS preflight, answered with 204 |
Authentication
Required on every method except OPTIONS. Send either an OAuth Bearer token or the API key header — never both, which is rejected as ambiguous.
An unauthenticated request returns 401. When OAuth is enabled, that response carries a WWW-Authenticate header naming the protected resource metadata URL, which is how a client bootstraps discovery. See How discovery works.
Protocol version
The server supports 2025-06-18 and 2025-03-26, defaulting to the first.
A client states its version in the MCP-Protocol-Version header. Omitting it accepts the default; sending an unsupported value is refused with a JSON-RPC error rather than being silently downgraded.
JSON-RPC methods
The POST body is a JSON-RPC 2.0 message, or an array of them for a batch. Supported methods:
| Method | Does |
|---|---|
initialize |
Returns the protocol version, server name and capabilities |
tools/list |
Lists tools with name, description and input schema |
tools/call |
Runs a tool |
resources/list |
Lists readable resources |
resources/read |
Reads one resource by URI |
prompts/list |
Lists published prompts |
prompts/get |
Returns one prompt, with arguments applied |
Anything else returns JSON-RPC error -32601. A malformed body returns -32700, and a message that is not valid JSON-RPC 2.0 returns -32600.
Notifications — messages whose method starts with notifications/ and that carry no ID — are accepted and produce no response, as the protocol requires.
Batching
An array of messages is processed in order and the responses returned as an array. Notifications inside a batch contribute no response, so a batch of five messages including two notifications returns three results.
Tool results
A successful tools/call returns a content array holding one text item whose text is the tool's result as pretty-printed JSON. An assistant reporting a block of JSON is behaving normally.
Errors come back as JSON-RPC error -32000 with the message and a code naming the specific failure — pom_ai_mcp_scope_denied, pom_ai_mcp_forbidden, pom_ai_mcp_write_gate_closed and so on. Those codes are what to quote when diagnosing.
Rate limiting
Checked per message. Reads use the configured per-minute limit; tools/call on a write tool uses the lower write ceiling. Exceeding it returns JSON-RPC error -32029. See Rate limits.
Caching and CORS
Every response carries Cache-Control: no-store and Pragma: no-cache. If a CDN or proxy caches this path, sessions break in confusing ways — exclude it.
Cross-origin requests are answered only when the Origin is on your allowlist, which is empty by default. Requests without an Origin header, which is normal for a server-side client, are unaffected. See Cross-origin requests.
What it does not do
- No streaming or server-sent events; each request returns a complete response.
- No background jobs or progress reporting.
- No session state beyond what the protocol requires —
DELETEsimply acknowledges.
Checking it by hand
A GET with valid credentials returns a small readiness payload. That confirms authentication and protocol negotiation without invoking any tool, which makes it the cleanest first check when a client will not connect.
If it returns HTML, something upstream is intercepting the path. If it returns 401 with credentials attached, the Authorization header is probably being stripped — the diagnostics in the MCP settings panel report that explicitly.