MCP Manager never asks for or stores your main WordPress password. Instead it uses WordPress’s built-in Application Passwords — separate, revocable credentials made for exactly this kind of connection.
How it works
- Each password is generated by WordPress’s secure system and tied to your user account.
- It’s shown only once, right after you generate it — copy it straight into your client.
- You can create a separate password for each client (Claude, VS Code, Copilot, and so on), so you can revoke one without affecting the others.
Viewing & revoking passwords
Every password appears in your WordPress profile under Users → Profile → Account Management → Application Passwords. From there you can see when each was last used and revoke any of them instantly — that connection stops working immediately.
Two layers of safety: a valid password only gets a client to the server — Access Control then decides whether that user is actually allowed to use it. See Access control & permissions.