Sign in instead of pasting a password

The second route on NibWP → Connect is Sign in. Instead of minting a key and pasting it into a configuration file, you give your assistant the site's MCP address, it sends you back to your own site, and you approve the connection there. Nothing is copied, and no password is stored in the client.

What the approval screen shows. It names the application asking, and the host it wants to reach. Then It is asking to: with a tick-box for each permission:

• Read your site — view posts, pages, media and settings. Changes nothing.
• Create and edit content — add and update content. Cannot delete.

Anything heavier is grouped separately under And these, which go further: — Delete and reorganise, Read and write files, and Run code and build features. Every box the client asked for starts ticked, and every one is yours to untick before pressing Approve. The screen also states which WordPress account the connection will act as: it can never do more than that account can. If abilities happen to be switched off, it says so rather than letting you approve a connection that quietly does nothing.

When it is offered. Only when your client speaks remote MCP, the site is served over HTTPS, and the host actually serves the discovery documents. A cloud assistant also needs an address it can reach, so a local or private hostname rules it out.

When an application password is the better choice. Any client that speaks only stdio, a site on a local address, and hosts that block /.well-known/ or strip the authentication header. A password works regardless, which is why it is the recommended default.

Connections can be revoked at any time under Manage connections and keys.

Full guide: How to: connect with OAuth