What the POM AI MCP server does not expose

Knowing the boundaries is as useful as knowing the tools. Some of these are deliberate refusals; others are simply outside the server's scope.

It is not an AI service

No tool here calls a language model, generates text or images, or consumes POM AI credits. The intelligence is entirely in the client you connect.

POM AI's own generation tools — writing, translation, images — are separate and live in the WordPress administration. They are not exposed over MCP.

It does not expose secrets

Option and meta tools deny secret-like keys, so they cannot be used to read credentials out of the database. The POM AI license key, the MCP API key and OAuth tokens are not readable through any tool.

Logs redact sensitive values before writing and truncate long ones.

It is site-scoped, never network-wide

The server belongs to one site. There is no tool that enumerates a multisite network, reaches another site's content, or changes network settings. Each site has its own endpoint, credentials, settings and logs.

It does not manage WordPress itself

No installing, activating, updating or deleting plugins and themes. No user creation, role editing or password changes. No file editing. No database queries. No cron or scheduling control. No core updates.

An assistant that needs those things needs a human with an administrator login, not this server.

It does not bypass WordPress

Every operation runs as a real user through ordinary WordPress functions. Capabilities apply exactly as they would in the admin, and any plugin hooking those operations still runs.

That is a deliberate design choice: it means MCP cannot do something the acting user could not do by hand, and it means your existing customisations are not circumvented.

Media fetching is constrained

Remote media downloads block private and reserved network addresses, refuse redirects, cap response size and accept only safe raster image types.

So a tool cannot be pointed at an internal address to probe your network, and cannot pull arbitrary file types into the media library.

Optional groups are absent, not broken

POM Theme, WooCommerce and POM Cache tools exist only when those products are active. On a site without WooCommerce, the catalogue tools are not registered at all — a client asking for one gets pom_ai_mcp_unknown_tool.

Check the status endpoint to see what was detected.

There is no undo

Writes are immediate. There is no draft state for a tool call, no confirmation dialog and no rollback. A successful call has already changed the site.

dry_run exists on some write tools and is the closest thing to a preview. Backups are the only real recovery.

No streaming or long-running jobs

The server answers a request and returns. There is no background processing, no job queue and no progress reporting. A client wanting to change five hundred records makes five hundred calls, bounded by the rate limit.

Rate limits are not a safety mechanism

Reads are capped per client per minute and writes at a lower ceiling. This bounds how fast a session can act; it does not prevent a determined sequence of harmful changes. Treat it as a speed bump.

It cannot judge intent

The server checks scopes, capabilities, gates and schemas. It cannot tell whether a change is a good idea, whether a price is right, whether copy is accurate or whether deleting something was intended.

That judgement is yours, expressed through which gates you open, which user approves, whether you work on staging, and how you brief the assistant.

Not designed for untrusted callers

Every call authenticates and the surface is deliberately narrow, but this is not a public API. Do not expose it to clients you would not give a WordPress login to, and keep the allowed-origins list empty unless a specific browser client needs it.

Where the detail lives

MCP boundaries covers the per-tool limits and the operations that are deliberately absent. For what is available, see the capability map.