Install MCP

1. Install the current cointacted-mcp.zip package in WordPress.
2. Confirm the required integrations below are available.
3. Activate Cointacted MCP.
4. Review the plugin's WordPress administration surfaces and health notices before enabling it for users.
5. Open a frontend account's Account Security → Connected MCP apps section and copy the displayed server URL into a compatible MCP client.

Configure the administrator server first

Open Cointacted → Operations MCP → Settings. Keep write-capable tools disabled. Connect a trusted administrator client over HTTPS with a WordPress Application Password, then call initialize, tools/list, ping, and one read-only status tool. Confirm the audit view records the client, tool, outcome, and time without recording raw arguments.

Do not use an administrator credential for an end-user connection. The administrator server and the Pro user server are separate trust boundaries.

Enable user MCP only when required

For the Pro user server, enable User MCP connections only after HTTPS, pretty permalinks, cache exclusions, and the frontend account-security surface are ready. Open the site as a normal user, visit Account Security → Connected MCP apps, copy that user's server URL, and complete OAuth authorization with PKCE S256 in a compatible client. Approve the minimum scopes, verify one read call, disconnect the app, and confirm its refresh token can no longer be used.

An approval-class terminal command must return a short-lived approval URL before execution. Test expiry, argument changes, replay, wrong user, and wrong client; every case must fail without running the command.

Requirements

Cointacted Social Terminal is required for terminal-owned operations.

Updates should be installed from a verified package while preserving the plugin slug cointacted-mcp.

Pretty permalinks must be available for the OAuth discovery and consent URLs. The plugin refreshes its rewrite rules on activation and when the user-MCP schema is first installed after an update. Production sites should use HTTPS; only native loopback redirect URLs may use HTTP.

Reverse proxies and page caches must bypass /cointacted-mcp/authorize/, /cointacted-mcp/approvals/, /.well-known/oauth-, and the /wp-json/cointacted-mcp/v1/oauth/ and /user/mcp REST routes. The approval page is private, short-lived account state and must never be cached.

Continue with the operator and connection guide, or return to the product overview.