Skip to main content
Glama

Check the connection

wp_connection_doctor
Read-onlyIdempotent

Diagnose why an app cannot connect to a WordPress site by checking HTTPS, permalinks, endpoint auth, headers, .well-known sign-in, firewalls, Cloudflare, and REST API restrictions.

Instructions

Check what stops an app from connecting to this site and how to fix it: HTTPS, the permalinks, whether the MCP endpoint answers a request without a token with its own 401 or something in front of the site answers instead (a ModSecurity rule, Cloudflare, LiteSpeed, Wordfence, a plugin that restricts the REST API, an HTTP login), whether the server passes the Authorization header on to WordPress, the two sign-in descriptions below /.well-known/ (resource and authorization server, each checked to be this plugin's), the firewall test of the direct sign-in, whether the site is behind Cloudflare, and active plugins known to restrict the REST API. Every request goes from the site to itself, the endpoint asked without the HTTP login of the current request; so a block that applies only to requests from outside, such as Cloudflare's bot rules for AI crawlers, is not seen; the result says so in limits. Returns checks: [{id, status (ok, warn, fail, info or skip), title, finding, steps}], summary (the count per status and one line), checked_at (UTC, ISO 8601) and limits. Changes nothing on the site and keeps nothing, the finding of the firewall test included. Needs manage_options; takes no arguments.

Input Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv4.10.0

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=false, but the description adds substantial context beyond them: it states the tool changes nothing, keeps nothing, requires manage_options, takes no arguments, and performs self-requests from the site to itself. Crucially, it discloses a key limitation—external blocks like Cloudflare bot rules for AI crawlers are not seen—and notes that the result records this in a 'limits' field. This is rich behavioral disclosure that fully complements the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then details the checks. Every sentence adds useful information (specific checks, behavioral constraints, return shape). It is dense and long, with some run-on clauses, but it avoids fluff and remains appropriately sized for a complex diagnostic tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description compensates by explicitly describing the return structure: 'checks: [{id, status, title, finding, steps}], summary, checked_at, and limits.' It also covers auth requirements and operational limitations. Given the tool's complexity, this is a complete and self-contained definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description confirms 'takes no arguments,' which is consistent with the empty input schema. No additional parameter semantics are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Check what stops an app from connecting to this site and how to fix it.' It enumerates the exact checks (HTTPS, permalinks, MCP endpoint behavior, Authorization header, well-known endpoints, firewall, Cloudflare, REST-restricting plugins), making the tool's scope unambiguous. It does not differentiate itself from the sibling diagnostics tool wp_site_health, which prevents a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the diagnostic framing ('Check what stops an app from connecting'), but there is no explicit guidance on when to choose this tool over alternatives such as wp_site_health or wp_get_error_log. No when-not conditions or sibling routing instructions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools