NO BUG: Bricks 2.4 Beta MCP connection fails with 401 rest_forbidden

Bugs
1

Hi everyone,

I am trying to connect the new Bricks 2.4 Beta MCP integration to VS Code, but I cannot get the authentication to work. I disabled WAF Firewall und do not have any security plugins installed.

The configuration was generated directly by Bricks under:
Bricks → AI → Configuration → Connect AI client → VS Code

{
“servers”: {
“demo.site”: {
“command”: “npx”,
“args”: [
“-y”,
“@automattic/mcp-wordpress-remote@latest”
],
“env”: {
“WP_API_URL”: “``https://example.com/index.php/wp-json/mcp/mcp-adapter-default-server”``,
“WP_API_USERNAME”: “test”,
“WP_API_PASSWORD”: “xxx”
}
}
}
}

The password is the WordPress application password generated in the Bricks AI settings for the selected WordPress user. It is not the normal WordPress login password.

I have already generated a new application password and restarted the MCP server and VS Code. The MCP process starts, but the connection fails:

2026-07-17 16:45:09.406 [info] Stopping server sample-page-plesk-page
2026-07-17 16:45:09.420 [info] Connection state: Stopped
2026-07-17 16:45:09.420 [info] Starting server sample-page-plesk-page
2026-07-17 16:45:09.420 [info] Connection state: Starting
2026-07-17 16:45:09.420 [info] Starting server from LocalProcess extension host
2026-07-17 16:45:09.421 [info] Connection state: Starting
2026-07-17 16:45:09.421 [info] Connection state: Running
2026-07-17 16:45:10.558 [warning] [server stderr] 2026-07-17T14:45:10.558Z [ERROR] [API] API error response: {"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}
2026-07-17 16:45:11.191 [warning] [server stderr] 2026-07-17T14:45:11.189Z [ERROR] [API] API error response: {"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}
2026-07-17 16:45:11.191 [warning] [server stderr] 2026-07-17T14:45:11.189Z [ERROR] [TRANSPORT_DETECT] ❌ Both JSON-RPC and simple transports failed
2026-07-17 16:45:11.192 [warning] [server stderr] {
2026-07-17 16:45:11.192 [warning] [server stderr]   "name": "APIError",
2026-07-17 16:45:11.192 [warning] [server stderr]   "message": "WordPress API error (401): {\"code\":\"rest_forbidden\",\"message\":\"Sorry, you are not allowed to do that.\",\"data\":{\"status\":401}}",

Server Log says:


401 – POST /index.php/wp-json/mcp/mcp-adapter-default-server HTTP/1.1


AH01071: Got error 'PHP message: [ERROR] Permission denied for MCP API access. User ID 0 does not have capability "read" | Context: ["HttpTransport::check_permission"] | User ID: 0; PHP message: [ERROR] Permission denied for MCP API access. User ID 0 does not have capability "read" | Context: ["HttpTransport::check_permission"] | User ID: 0; PHP message: [ERROR] Permission denied for MCP API access. User ID 0 does not have capability "read" | Context: ["HttpTransport::check_permission"] | User ID: 0; PHP message: [ERROR] Permission denied for MCP API access. User ID 0 does not have capability "read" | Context: ["HttpTransport::check_permission"] | User ID: 0'

any help is really appreciated. Thanks!

3

Hi @typomaniac,

Thank you for the report.

The MCP adapter plugin is maintained by the WordPress core team, not Bricks.

The 401 response plus User ID: 0 means WordPress is seeing the MCP request as unauthenticated before the MCP permission check runs.

Please test the same WordPress username and application password against a normal authenticated REST endpoint, for example /wp-json/wp/v2/users/me?context=edit, using Basic Auth. Do not post the password.

If that endpoint also returns 401, the issue is in the WordPress/Application Password/Authorization header path, usually the username/password pair or the server not passing the Authorization header through to WordPress.

Best to share these details with your AI agent of choice so it can guide you on how to troubleshoot your environment and get it working :slight_smile: