Give an AI a WordPress admin application password and it can change everything on your site. Agent Connect is the safe alternative: connect over MCP with a scoped, revocable token instead.
What it is
Agent Connect is a built-in MCP server (the open standard AI assistants use to connect to tools). ChatGPT custom connectors, Claude and Codex attach to your site with just a URL and a Bearer token - no WordPress application password. The token is a GOMAX Agent Passport you mint yourself, with a chosen scope, bound to a WordPress user, and revocable in one click. Everything is self-hosted: the tokens and the activity log live on your site only.
How it works
Your MCP URL is /wp-json/gomax-ultimate/v1/agent-connect/mcp. An AI connects to it with the header Authorization: Bearer . From there it can call two core tools: list_capabilities (which shows exactly what THIS token is allowed to do) and run (which executes any GOMAX action within the token's scope - content, SEO, WooCommerce, social, media, settings and more).
The agent's real power is the intersection of three independent gates: (1) the token's scope - read, write, admin, or a single endpoint; (2) the WordPress user the token is bound to - it can never do more than that user's role allows, so a token bound to an Editor cannot touch settings or plugins; and (3) GOMAX's own feature flags, safe-execution and license checks. Destructive actions always require an admin-level scope. Revoke the token and the connection dies instantly (the next call gets a 401).
How to use it
- (Recommended) Create a dedicated WordPress user with a limited role (e.g. Editor) for the agent.
- In GOMAX, mint a connect token: choose a name, a scope (start with read), and bind it to that user. Copy the token - it is shown only once.
- In ChatGPT (Settings → Connectors → add a custom connector), Claude, or Codex, add an MCP server: paste the MCP URL and the token as a Bearer / API key.
- Ask the AI to call list_capabilities first, then work through run. Widen the scope only when you need writes.
- Revoke the token any time from GOMAX to cut the agent off.
Frequently asked questions
Why not just give the AI an application password?
A WordPress application password grants full REST access at that user's permission level - an admin app password lets the holder change everything. A scoped Agent Connect token is limited to what you allow, bound to a user role, and revocable, so you never hand over unrestricted control.
Which AIs can connect?
Any MCP client. That includes ChatGPT custom connectors, Claude, Codex, and other MCP-capable agents. They connect with the MCP URL and a Bearer token.
What can the agent actually do?
Whatever its token's scope permits, and never more than the bound WordPress user's role. A read token can only read; a write token can create and update but not run destructive actions; only an admin/"*" token can do destructive operations. Call list_capabilities to see the exact allowed set.
How do I revoke access?
Revoke the token in GOMAX. The next request from that agent immediately fails with a 401. You can keep several tokens (one per agent) and revoke them independently.
Is my data sent to GOMAX or a cloud?
No. Agent Connect is self-hosted - the MCP server, the tokens and the activity ledger all run on your own site. GOMAX is pay-once and BYOK by design.
Top comments (0)