An MCP write is denied

A successful read does not prove the corresponding write is authorized. Check the denial layer in order.

Authorization checklist

1. Authentication profile: OAuth needs the required scopes; API key writes need a configured service user with the required capabilities. Native transport also requires read for initialization.
2. Scopes: the token needs mcp:write and the product-area write scope.
3. WordPress capability: the mapped user must be able to edit the exact object or manage the relevant area.
4. Write gate: open the content, option, POM Theme, or WooCommerce gate required by the tool.
5. Allowlist: option names, POM Theme fields, post types, meta keys, and other restricted identifiers must be explicitly supported.
6. Schema: send all required arguments with allowed types and values.

Use the stable domain error code to identify the layer. Reauthorizing with broader scopes does not fix a closed gate; making the user an administrator does not add a missing OAuth scope or allowlist entry.

Dry run uses the same checks. If it fails, the real write will fail too. For a denied POM Theme field or WordPress option, use the supported administration interface rather than another storage path.

After correcting authorization, run the dry run again and show the exact proposed change before applying it.

Related guides: MCP authorization, capability map, and read versus write.