MCP servers

Overview

Control access to registered WordPress MCP servers. Select the subject with AAM::api()->mcp_servers($access_level, $settings). Omit $access_level to use the current user or visitor.

PHP class: AAM_Framework_Service_McpServers.

Method reference

Method	Purpose
`deny($name)`	Store a deny rule.
`allow($name)`	Store an allow rule.
`reset($name = null)`	Remove one rule or all rules for this level.
`is_denied($name)`	Check the effective deny decision.
`is_allowed($name)`	Check the effective allow decision.

Return values vary by method. Rule updates usually return bool; reads can return a value, null, or an array. Errors follow the service’s error_handling setting and may produce WP_Error.

Accepted identifiers

Pass the registered MCP server ID as a string, for example 'my-server'. Child tools, prompts, and resources have separate services and need their own identifiers.

Example

$servers = AAM::api()->mcp_servers('role:subscriber');
$servers->deny('private-server');
$blocked = $servers->is_denied('private-server');

This denies access to private-server for Subscribers. $blocked checks the effective server decision.

Developer notes

Server rules and child tool, prompt, and resource rules are separate.
These methods control access decisions; they do not register MCP servers.
The selected access level determines whose rules are stored or evaluated. See Access levels.

Behavior and parameters

deny($name) and allow($name) write a server access rule. reset($name = null) clears one or all server rules.
is_denied() and is_allowed() resolve inherited access. Server registration and execution are handled by WordPress MCP.