Common issues
401 / Unauthorized
The API key is wrong, was revoked, or the Authorization header did not reach the server. Create a fresh key and re-copy the snippet. Keys are shown once and cannot be recovered.
If you use an Application Password, the header must be Basic (base64 of username:password), not Bearer. Pasting the password alone always fails.
No tools appear in the client
Fully quit and restart the MCP client — closing the window is often not enough. If tools are still missing, confirm MCP is enabled under Settings → MCP and that the WordPress Abilities API is available on your site.
Some tools are missing, but others work
Expected behavior. Tools from disabled modules are not published. A key also sees only what its user role allows — a Sales Rep key will not expose manager-only records.
Tool returns “not allowed” or empty results
The key acts as a specific user. Issue a key from an account with wider access if the agent needs a broader view — do not share your administrator key with teammates.
“Server failed to start” (Claude Desktop / Codex)
These clients use a Node.js helper (mcp-remote). Run node -v in a terminal. If it fails, install Node.js LTS from nodejs.org and restart the client.
Claude Desktop lost all MCP servers
claude_desktop_config.json must be valid JSON. A single missing comma prevents every server from loading, not just DoubleScale.
Works locally but not from another machine
The endpoint URL must be reachable from where the client runs. A localhost URL only works on the same computer.
Security best practices
- Keep MCP disabled until you actively need external agent access.
- Issue least-privilege keys — bind keys to the user who will actually use them, not an administrator, unless admin scope is required.
- Revoke unused keys from Settings → MCP when a laptop is lost or a contractor leaves.
- Never commit snippets to Git — they contain live credentials.
- Prefer not emailing keys — setup instructions yes; the key itself only over a channel you can revoke.
- Use HTTPS in production — required for Application Passwords and recommended for all MCP traffic.
Disabling MCP
Turn off Enable MCP for AI Agents in Settings → MCP. The REST route unregisters on the next request cycle. Existing API keys remain stored but are useless while MCP is off. Revoke keys you no longer need.