Users, identities, and credentials are not MCP content
POM AI does not expose tools to list, create, update, delete, or impersonate WordPress users. It also does not return passwords, license keys, API keys, OAuth tokens, application passwords, payment credentials, or private service configuration as resources.
The authenticated actor still matters. OAuth scopes define the requested MCP access, and the mapped WordPress user must independently hold the capability required by each tool. An API key can optionally map to a service user for its read profile; that mapping does not become a user-management interface.
Safe identity handling
- Connect with the least-privileged account that can perform the task.
- Use OAuth for interactive write sessions.
- Never paste bearer tokens, API keys, or license keys into prompts or screenshots.
- Do not store secrets in post meta, options, comments, or page content.
- Revoke or rotate credentials through their owning interface if exposure is suspected.
Comment replies and created comments are attributed to the acting WordPress user. The client should not claim another person’s identity.
Account, role, password, and credential changes belong in the WordPress user administration, POM AI license interface, or MCP connection settings as appropriate.
Related guides: MCP authentication, authorization, and safe support information.