Installation

Requirements

• WordPress 6.4 or later
• PHP 7.4 or later
• The WordPress REST API reachable at /wp-json/ — the MCP endpoint is a REST route, so a plugin or server rule that blocks REST will block Sokket too
• An MCP-compatible AI client: Claude Code, Claude Desktop, ChatGPT, Cursor, VS Code, Windsurf, or anything else that supports remote MCP servers over Streamable HTTP
• HTTPS strongly recommended. It’s required for OAuth redirect URIs outside localhost, and you should never send a bearer token over plain HTTP
• Pretty permalinks recommended, so the endpoint is /wp-json/sokket/v1/mcp rather than the ?rest_route= form

You do not need an OpenAI, Anthropic, or any other AI API key. Sokket never calls an AI provider.

Installing the plugin

From your dashboard (recommended):

1. Go to Plugins → Add New.
2. Search for "Sokket".
3. Click Install Now, then Activate.

Manual upload:

1. Download the ZIP from WordPress.org.
2. Go to Plugins → Add New → Upload Plugin, choose the ZIP, and click Install Now.
3. Activate the plugin.

What activation does

Activation is deliberately quiet. It creates the plugin’s own database tables (tokens, the audit log, and the OAuth clients, codes, and tokens tables), stores the default settings, and adds a Sokket menu to your admin sidebar with three screens: Dashboard, Settings, and Connections.

It does not open anything up:

• The MCP server is disabled. Every request to the endpoint is rejected before it is parsed.
• OAuth 2.1 is disabled.
• No tokens exist, so nothing can authenticate.

Nothing on your site is reachable by an AI client until you enable the server and issue a credential yourself.

Installing on a live site? That’s the intended case. Because everything is off by default, installing and activating changes nothing about how your site behaves until you deliberately turn the server on.

Updating

Sokket updates through WordPress.org like any other plugin. Updates never enable the server, never enable OAuth, and never add tools to a bearer token you already issued — a new release’s tools stay off on existing tokens until you tick them on the Access tab. See Tokens & Permissions.

Uninstalling

Deactivating the plugin stops the endpoint immediately; your tokens and log are left in place in case you reactivate.

Deleting the plugin runs a full cleanup: it drops the tokens, audit log, and OAuth tables, deletes the sokket_settings and sokket_version options, and removes the plugin’s transients (sessions, rate-limit counters, and the one-time token display). Nothing is left behind, and every credential stops working the moment the tables go.

Next step

Head to the Getting Started guide to enable the server and connect your first AI client.