PixelYourSite MCP Security
Tokens
Tokens are the only way to authenticate with the MCP server. There are no passwords, no session cookies, and no WordPress login involved. Every request must carry a valid token in the authorization header.
When you generate a token, a 32-character random string is created using WordPress’s wp_generate_password. The raw token is shown to you once and is never stored. What is stored is its SHA-256 hash. When a request arrives, the incoming token is hashed and compared against stored hashes using hash_equals — a constant-time comparison that prevents timing attacks.
Up to 25 tokens can be active at the same time. Each token has a label, a creation date, and a last-used timestamp. The token list in PixelYourSite → MCP shows all active tokens but never their values.
If you lose a token, revoke it and generate a new one.
Multiple tokens
Create one token per client or person. This means you can revoke access for one client without affecting others. Typical usage: one token for Claude Desktop, a separate one for an agency team member, another for a staging environment.
The activity log records which token was used for every write operation. If something unexpected happens, you can identify which token made the change and revoke it.
Who can create tokens
Only WordPress users with the manage_options capability (Administrators) can access the MCP settings page and generate or revoke tokens.
Read-only mode
The read-only toggle in PixelYourSite → MCP blocks all write tools regardless of which token is used. Every set_*tool returns an error instead of writing. Read tools continue to work normally.
Use this when:
- You want to share access for auditing without risking any changes
- You want a safety net during a conversation where you are only checking configuration
- You are on PYS Free, where writes are already blocked regardless
Rate limiting
Two rate limits apply to every request:
- Per IP address: 60 requests per minute
- Per token: 120 requests per minute
If either limit is reached, the request is rejected and the assistant receives an error. Normal conversations are well within these limits — a complex full workflow typically involves 10 to 20 tool calls.
Loop and failure protection
Two additional guards prevent runaway behaviour:
Loop detection: if the same tool is called with identical arguments 3 times within 30 seconds from the same IP, the third call is blocked with a “Possible loop detected” message. The assistant will stop and report the issue rather than continue.
Repeated failure detection: if the same tool fails 3 times in a row within 60 seconds from the same IP, subsequent calls are blocked until the window expires. This prevents the assistant from endlessly retrying a broken configuration.
Activity log
Every write operation is recorded in the activity log with:
- Timestamp
- Tool name
- The note the AI assistant provided explaining what it was doing and why
- IP address
- Whether the operation succeeded or failed
The log is capped at 500 entries (newest first). View it in PixelYourSite → MCP. It cannot be written to or manipulated through MCP — it is a read-only audit trail from inside WordPress.
What the server exposes
The MCP server exposes only PixelYourSite tools. It does not expose:
- Other WordPress plugins or their data
- The WordPress database directly
- The file system
- Customer names, email addresses, phone numbers, or order details
- API tokens or credentials that have been saved (credentials are write-only and cannot be read back through any tool)
- Live ad platform data (campaign stats, ROAS, audience sizes)
The server is scoped to PYS tools only by design. Other plugins that register WordPress abilities do not appear on the PYS MCP endpoint.
HTTPS
The MCP endpoint should be served over HTTPS on production sites. The token is transmitted in the authorization header on every request — plain HTTP exposes it to anyone who can observe the traffic. Local development environments can use the --allow-http flag in the client config.