MCP rate limiting
POM AI counts requests in per-minute buckets associated with the authenticated client or, when necessary, a hashed IP-based key.
Limits
- Read methods use the administrator-configured MCP rate, defaulting to 60 per minute.
- Write tools use the configured read rate or 20 per minute, whichever is lower.
- OAuth registration and token requests use a fixed limit of 5 per minute.
The setting is clamped to at least one. Counters are aligned to the current UTC minute and retained slightly longer than a minute to cover the bucket boundary.
In the standard transport, read and write methods share a counter, with the lower ceiling checked for writes. Native transport counts each authenticated HTTP request against the configured limit and counts each write execution once against a separate write ceiling. Permission probes do not count as writes; write previews do.
Standard MCP rate failures use JSON-RPC -32029. Native request-limit failures use HTTP 429 with Retry-After; native write-limit failures use a tool result with isError: true and a rate-limit message. OAuth endpoints use HTTP 429. See the error contract.
Client strategy
Use pagination responsibly, cache discovery results for the current connection, and avoid reading the same resource before every tool call. Serialize consequential writes rather than firing a broad batch of independent calls. On rate limit, wait for the next minute boundary and retry with backoff; immediate loops only extend the failure pattern.
Do not automatically retry non-idempotent writes after a lost response. Read the target state first.
The rate limit protects the WordPress site; it is unrelated to POM AI credit balances and does not change provider quotas.
Related guides: rate-limit troubleshooting, transport, and read-only audit recipe.