Go Back to Parent Doc

Getting Started

This guide takes you from a fresh install to a working AI connection. If you haven’t installed the plugin yet, start with the Installation page.

Step 1 — Enable the MCP server

Go to Sokket → Settings → General:

  1. Tick Enable MCP server and click Save Changes. The status indicator switches from Disabled to Enabled.
  2. Copy the Endpoint URL — it looks like https://yoursite.com/wp-json/sokket/v1/mcp. Every client uses this same URL.
  3. Click Test connection. This sends a real MCP handshake to your own endpoint from your browser and tells you what came back.

What the test tells you. "Endpoint reachable, authentication is enforced as expected" is the result you want — it proves the route is live and correctly refusing anonymous requests. "Endpoint did not return a JSON response" means something between the internet and WordPress is intercepting it: usually a security plugin, a firewall rule, or a permalink problem. See FAQ & Troubleshooting.

Step 2 — Decide how your client will authenticate

There are two paths, and you can use both at once:

  • A bearer token — you create it here and paste it into your client. Best when the client has a place to put a token (Claude Code, Cursor, VS Code, Windsurf, ChatGPT). It gives you the finest control: a per-token tool allowlist.
  • OAuth 2.1 — the client configures itself from the endpoint URL alone, then sends the user to your site to sign in and approve. Required by connector interfaces with no token field, such as Claude Desktop’s custom connectors. Turn it on with Enable OAuth 2.1 on the same General tab, and see OAuth 2.1 Connections.

The rest of this guide uses a bearer token, because it’s the tighter option to start with.

Step 3 — Create a token

Go to Sokket → Settings → Access:

  1. Label — name it after where it will live, for example "Claude Code on my laptop". When you revoke it later, you’ll want to know which one it was.
  2. Run as user — pick the WordPress user this connection acts as. Every request runs as that user and can never exceed their capabilities. An Editor cannot list plugins no matter what you tick.
  3. Scope — leave Read-only ticked for your first token. It blocks every write tool for this connection even if you tick one by mistake.
  4. Allowed tools — tick what this connection may call, grouped by area. A good first set for auditing a site: get_site_info, list_plugins, list_themes, get_php_error_log_tail, list_posts, get_post, search_content.
  5. Click Create token.

The plaintext token is shown once, at the top of the screen. Copy it now — Sokket stores only a SHA-256 hash and genuinely cannot show it to you again. If you lose it, revoke that token and create another.

Start read-only. Give the agent a look around first. Once you trust what it does with the site, edit the token, untick Read-only, and enable the specific write tools you want — see Tokens & Permissions.

Step 4 — Connect your AI client

Go to Sokket → Connections → Connect your AI client and choose your client from the dropdown. The page renders the exact command or config for your site, with the endpoint already filled in and YOUR_TOKEN marking where your token goes. Click Copy.

For Claude Code, for example, that’s a single terminal command:

claude mcp add --transport http sokket-site-connector-for-mcp https://yoursite.com/wp-json/sokket/v1/mcp --header "Authorization: Bearer YOUR_TOKEN"

Cursor, VS Code, and Windsurf each get their own JSON block for their own config file; ChatGPT and Claude Desktop get step-by-step instructions for their connector UIs. Every variant is covered on Connecting Your AI Client.

Step 5 — Run your first tool call

Restart or reconnect your client so it performs the MCP handshake, then ask it something that needs the site. Good first prompts:

  • "Use the WordPress MCP server to tell me what versions of WordPress and PHP this site runs, and what the active theme is."
  • "List the plugins with updates available."
  • "Show me the last 50 lines of the PHP error log and explain anything that looks serious."

Your client will list the tools it can see — and it only sees the tools your token allows and the bound user has the capability for. If a tool is missing from the list, that’s the permission model doing its job.

Step 6 — Watch the audit log

Go back to Sokket → Dashboard. Under Recent Activity you’ll see each call with its timestamp, the user, the tool name, and the outcome. This is your record of what the agent actually did — see Audit Log.

Step 7 — Grant writes when you’re ready

When you want the agent to change things, go back to Settings → Access, click Edit on the token, untick Read-only, and tick only the write tools you need — create_post and update_post for content work, moderate_comment and reply_to_comment for the comment queue, upload_media and set_featured_image for images.

Remember the second gate: the bound user still has to have the capability. create_term needs manage_categories; moderate_comment needs moderate_comments. See the Tool Reference for what each tool requires.

Where to go next

You May Also Read:

Shopping Cart
  • Your cart is empty.