MCP 0.4.2 / Authorization
Remote command policy
Learn which terminal commands can be read, executed, approved, or blocked remotely.
Every command owner classifies remote access as read, execute, approval, or blocked. Unknown commands fail closed.
Read commands may run only with the required connection, actor, scope, and owning capability. Execute commands require a dedicated server-safe handler. Approval commands return a short-lived approval URL before running.
Browser-only behavior, wallet signing, passwords, private keys, administrator commands, presentation-only shortcodes, and commands without a server-safe contract remain unavailable.
MCP never replays terminal browser code on the server and never converts a client request into broader WordPress authority. Changing the actor, scope, command, arguments, add-on state, or capability requires a fresh authorization decision.