Sokket adds one menu with three screens: Dashboard, Settings (General + Access), and Connections (OAuth + Connect your AI client).
Dashboard
Sokket → Dashboard is the overview:
- Server Status — whether the MCP server and OAuth 2.1 are enabled, and the endpoint URL with a copy button.
- Recent Activity — the latest tool calls, with a link through to the full log. See Audit Log.
- Active Connections — every OAuth grant and bearer token in one place, each tagged OAuth or Token and read-only or read-write, with a link to manage them.
If nothing is connected yet, this screen points you at creating a token or enabling OAuth.
Settings → General
- Enable MCP server — the master switch. Off by default. While it’s off, every request to the endpoint is rejected before it is parsed. Nothing else on this page has any effect until it’s on.
- Enable OAuth 2.1 — lets clients connect with the endpoint URL alone, approved by signing in. Required by connector interfaces that have no field for a bearer token, such as Claude Desktop’s custom connectors. Manually issued tokens keep working either way. See OAuth 2.1 Connections.
- Endpoint URL — your MCP endpoint, with a copy button. Every client uses this same URL.
- Test connection — sends a real MCP handshake to your own endpoint from your browser and reports what came back.
- Recent activity — the audit log’s most recent entries.
What the test results mean. "Endpoint reachable, authentication is enforced as expected" is the healthy result — the route is live and correctly refusing anonymous requests. "Endpoint did not return a JSON response" means a security plugin, firewall, or permalink problem is intercepting it. "Could not reach the endpoint from your browser" usually means DNS, a local hosts entry, or an offline site. And if the server is disabled, the test says so rather than pretending.
Settings → Access
Where bearer tokens live. Covered in full on Tokens & Permissions; in summary:
- Create token — a Label, the Run as user the connection acts as, the Read-only scope checkbox, and the Allowed tools list grouped by area (write tools carry a write badge).
- Your new token — shown once after creation, with a copy button. Sokket stores only a hash and cannot show it again.
- Tokens table — label, token prefix, bound user, scope, created, last used, and the Edit, Revoke, and Delete actions.
The screen also notes that WordPress Application Passwords work as an alternative, authenticating with the user’s full capabilities and all tools enabled.
Connections → OAuth
- Status — whether OAuth is on, with a link to the General tab if it isn’t.
- Endpoint URL, Discovery document, and Authorization endpoint — the three URLs a client may ask for, each with a copy button.
- Active connections — approved grants: client, user, access level, approval date, last used, and Revoke.
- Registered clients — applications allowed to start an authorization, marked Self-registered or Added by admin, with their client ID, redirect URIs, origin, last used, and Delete.
- Add a client manually — Name, Redirect URIs (one per line, matched exactly, HTTPS only except on localhost), and an optional Issue a client secret checkbox for interfaces that ask for one.
Connections → Connect your AI client
A dropdown of supported clients — Claude Code, Claude Desktop, Claude Desktop (bearer token), ChatGPT, Cursor, VS Code, Windsurf, and a generic option. Choosing one renders the exact command or JSON config for your site, endpoint pre-filled, with a copy button and a YOUR_TOKEN placeholder where your token goes.
This tab is purely an instruction generator — there is no per-client code in the server. See Connecting Your AI Client.
What Sokket stores
For the curious, and for anyone auditing before installation:
| Where | What |
|---|---|
sokket_settings option | The two toggles: enabled and oauth_enabled. |
sokket_version option | The installed schema version. |
{prefix}sokket_tokens | Bearer tokens (hashed), their bound user, allowlist, and read-only flag. |
{prefix}sokket_audit_log | The capped tool-call log. |
{prefix}sokket_oauth_clients | Registered OAuth clients. |
{prefix}sokket_oauth_codes | Short-lived authorization codes. |
{prefix}sokket_oauth_tokens | OAuth access and refresh tokens (hashed). |
| Transients | MCP sessions, rate-limit counters, and the one-time token display. |
Deleting the plugin removes all of it. See Installation.