Skip to main content

​
The connection token

Each connection has a random 48-character secret, stored on the site only as a SHA-256 hash. It is shown once, when the connection is created. A valid token runs the request as the WordPress user who created the connection, with that user’s capabilities. Revoked or unknown tokens get 401. The token can arrive in the Authorization: Bearer header or in the URL. The header is read first and is the better place: a token in a URL lands in server logs and browser histories. Claude Code’s setup command uses the header; the web connectors only take a URL, so the URL form stays. The connection row says which way each connection presents its token.

​
What the endpoint refuses

  • A request whose JSON-RPC envelope is malformed.
  • A browser page on another site (an Origin header that is not this site’s own), before any token is read. Server clients send no Origin. The bevel_mcp_allowed_origins filter adds hosts of your own.
  • More than twenty failed authentications from one address in a minute (429 for the rest of it).
  • More than 120 tool calls from one connection in a minute.
  • A file on an upload link whose connection has been revoked, or whose capability has been switched off since.
A tool that throws answers as a tool error the assistant can read, never as a fatal page.

​
What leaves the site

Nothing, unless a tool is called that needs it:
  • my.wpbevel.com, on a site connected to a Bevel account: before the first page or blog post of the day, to read the allowance, and after each one, to count it. It receives the license key, the site’s address and activation id, the tool’s name and the plugin version, never the content. It is also asked about Bevel MCP updates when WordPress checks for them, and for today’s count when Bevel → MCP Connectors is opened.
  • api.openverse.org receives the search words when the assistant looks for a photo, with your site’s address in the user-agent line. Choosing a result downloads that image from wherever it is hosted.
  • The website named to fetch_brand: its homepage, up to three stylesheets and the logo images it links.
  • A Google Drive or Dropbox link you paste, fetched in its direct-download form.
No page, post or template is ever sent to a Bevel server. When the assistant calls a tool, the request comes from the assistant to your site and the answer goes back to it; that conversation is covered by the assistant’s terms.

​
What stays on the site

Credentials stored in widget settings (a form’s Mailchimp key, a Slack webhook) are redacted when a page is read and restored when the page is saved back. They never reach the assistant.

​
What an assistant cannot do

Delete a page, post, template, menu or media file. Publish without being asked. Upload a file that is not an image or a font. Change another user’s account. Reach a capability the site or the connection has switched off.

​
Uninstalling

Deleting the plugin removes its connections, settings, log and upload receipts, and nothing else. Everything the assistant built is the site’s content and stays.