Title: Activate and configure Secure MCP
Author: bethurban
Published: July 2, 2026

---

 1. [Integrations](https://docs.wpvip.com/integrations/)
 2. [Integrations Center](https://docs.wpvip.com/integrations/center/)
 3. [Secure MCP](https://docs.wpvip.com/integrations/center/secure-mcp/)
 4. Activate and configure Secure MCP

#  Activate and configure Secure MCP

[**Secure MCP**](https://docs.wpvip.com/integrations/center/secure-mcp/) is configured
in the VIP Dashboard at 2 levels:

 1. A single organization-wide enablement.
 2. Per-application control over which toolsets are activated where.

Secure MCP is disabled by default. An [Org admin](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles/)
must activate it for the organization before any AI agent can connect.

## Roles and permissions

Activating Secure MCP requires an Org admin role, and changing toolset access for
an application requires an Org or [App admin role](https://docs.wpvip.com/manage-user-access/vip-dashboard/app-role/).
Manage roles via the [**People** panel](https://docs.wpvip.com/vip-dashboard/organization-view/people/)
in the VIP Dashboard.

## Activate MCP for the organization

The **Global MCP** setting controls whether MCP is allowed anywhere in the organization.

 1. Follow the steps to [Add an integration to an organization](https://docs.wpvip.com/integrations/center/add-an-integration/)
    via the **Integrations Center** of the VIP Dashboard.
 2. Navigate to the [organization view](https://docs.wpvip.com/vip-dashboard/organization-view/).
 3. Select **Integrations** from the left-hand navigation menu to open the [Org Integrations](https://docs.wpvip.com/integrations/org-integrations/)
    panel.
 4. Find **Secure MCP** in the list of integrations and select **Manage** to open its
    [Manage Integration](https://docs.wpvip.com/integrations/org-integrations/manage-integration/)
    panel.
 5. In the **Global MCP** section, select **Activate MCP**.
 6. The status of **Global MCP** changes to **Active**. Access to MCP toolsets is now
    managed per application.

When Global MCP is active, an Org admin can pause access at any time by selecting**
Deactivate MCP**. Deactivating stops every agent across the organization from reaching
any application, regardless of per-application settings.

## Control toolsets per application

The VIP MCP and WordPress MCP toolsets are controlled independently. Enabling VIP
MCP for an application lets agents operate the VIP Platform for that application;
enabling WordPress MCP lets agents operate the WordPress site. An application with
both toolsets disabled is not reachable by an agent even while Global MCP is active
for the organization.

### From the Org Integrations panel

After Global MCP is active, use the **Activation Map** section of the **Manage Integration**
panel to choose which toolsets are enabled for applications.

The application list displays one row per application. Select **Add Application**
to add an application to the list.

Expand an application’s details and controls by selecting the arrow to the left 
of its name. This displays all of the application’s environments (production and
non-production). For each, **VIP MCP** and **WordPress MCP** can be toggled on. 
Both are disabled by default.

### From the App Integrations panel

Once Global MCP is active, an Org or App admin can activate toolsets for an application
via the [**App Integrations**](https://docs.wpvip.com/integrations/app-integrations/)
panel. From the list of **App Integrations**, find **Secure MCP** and select **Configure**
to open its [**Configure Integration**](https://docs.wpvip.com/integrations/app-integrations/configure-integration/)
panel. Here, under **App Activation Controls**, **VIP MCP** and **WordPress MCP**
can be toggled on to enable either toolset.

## Configuration is transactional at the organization level

When an organization-level change updates Secure MCP and its toolsets together, 
the update is applied as a single transaction. If part of the update fails, the 
changes that succeeded are rolled back so the configuration does not end in a partial
state. No action is required from an Org admin; on failure, the previous configuration
is restored and the change can be retried.

## Pause or remove access

To pause all access without losing per-application settings, an Org admin can deactivate
Global MCP. Reactivating restores the previous per-application toolset configuration.

To remove access for a single application, disable both toolsets for that application
while leaving Global MCP active for the rest of the organization.

Last updated: July 02, 2026