MCP authorization
Authentication identifies the client and actor. Authorization is evaluated again for every resource, prompt, and tool call.
Four checks for a write
- OAuth scope: the token must include every scope declared by the tool.
- WordPress capability: the mapped user must be allowed to act on the specific object or product area.
- Write gate: the administrator must have opened the relevant content, option, POM Theme, or WooCommerce gate.
- Schema and allowlist: required arguments, value constraints, post types, meta keys, options, and settings must be accepted.
Typical scope families are:
| Area | Read | Write |
|---|---|---|
| MCP base | mcp:read |
mcp:write |
| WordPress content | wp:content:read |
wp:content:write |
| POM Theme | pom_theme:read |
pom_theme:write |
| WooCommerce catalog | woocommerce:catalog:read |
woocommerce:catalog:write |
Tools also enforce capabilities such as edit_posts, upload_files, moderate_comments, manage_categories, edit_theme_options, manage_options, or WooCommerce management access.
Passing one layer never bypasses another. An administrator without the OAuth write scope is denied; a broad token mapped to a low-privilege user is also denied. Dry run uses the same controls.
POM Cache clear follows its integration capability and does not use a general write gate.
Related guides: capability map, write denied, and security.