Gravity Forms 3.1 can connect AI clients through MCP using a WordPress application password. Deleting a local client entry does not revoke the server credential, remove an overprivileged user, disable enabled tools, end another client session, or prove that a former contractor can no longer read entries or change forms.
Use this when an employee, agency, contractor, AI client, development laptop, or automation stops using a Gravity Forms MCP connection.
Quick answer
Start from a connection register that maps one client and environment to a dedicated WordPress user, application-password UUID, allowed Gravity Forms MCP tools, owner, purpose, creation time, last-used time, and expiry. Export a redacted before-state, disable the client configuration, revoke the exact application password in WordPress, end relevant sessions, remove tools or the user only when no other approved dependency exists, and rotate any secret that was shared. From the former client, prove read and write calls fail without revealing the password. Preserve the HTTP status, MCP error class, WordPress log, and final account state.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Former client | List forms | Authentication denied |
| Former client | Update form | Denied before mutation |
| Replacement | Read-only user | Allowed read only |
| Shared account | Dependency found | Separate identity before removal |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Map client to server identity | Map client name, device, environment, WordPress user ID, role, application-password UUID, tool set, endpoint, owner, purpose, creation, expiry, and last-used timestamps. | The former application-password UUID is absent or revoked. |
| Export redacted before-state | Review whether the user or password is shared by another client, integration, staging site, or emergency workflow before revocation. | Former read and write calls fail before reaching form data. |
| Revoke the exact password | Capture a redacted before-state, revoke the server-side application password, end sessions, and remove local configuration from every managed device. | Approved replacement clients retain only intended access. |
| Prove denied and allowed controls | Replay one read-only and one previously allowed write call from the former client, plus a control call from an approved replacement identity. | Post-revocation logs and the access register agree. |
What to check first
- Map client name, device, environment, WordPress user ID, role, application-password UUID, tool set, endpoint, owner, purpose, creation, expiry, and last-used timestamps.
- Review whether the user or password is shared by another client, integration, staging site, or emergency workflow before revocation.
- Capture a redacted before-state, revoke the server-side application password, end sessions, and remove local configuration from every managed device.
- Replay one read-only and one previously allowed write call from the former client, plus a control call from an approved replacement identity.
- Review access, REST, security, Gravity Forms, and MCP logs for post-revocation attempts and set an alert for unexpected use.
Field notes
- Write the expected result before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because caches, retries, scheduled actions, and deployments can change the evidence between checks.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Review the result again after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
wp user application-password list USER_ID --fields=uuid,name,created,last_used,last_ip
wp user application-password delete USER_ID PASSWORD_UUID
# Redact IP and identity data in shared evidence.
Why this usually happens
- The client configuration is removed while the WordPress application password remains active.
- Several devices share one user and password, so no owner can revoke one connection safely.
- Write tools stay enabled after the original project ends.
- A user is deleted before logs and dependent integrations are mapped.
Decision rule
Offboarding is complete only when the exact server credential is revoked, former calls fail before data access or mutation, approved integrations still work, and logs plus ownership records show the final state.
Production verification checklist
- The former application-password UUID is absent or revoked.
- Former read and write calls fail before reaching form data.
- Approved replacement clients retain only intended access.
- Post-revocation logs and the access register agree.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Map client to server identity
- Export redacted before-state
- Revoke the exact password
- Prove denied and allowed controls
- Monitor and close ownership
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while logs, stored records, background jobs, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, request path, and failure branch that users actually reach.
- Leaving debug output, temporary exclusions, helper accounts, duplicate hooks, broad permissions, or relaxed firewall rules active after verification.
Questions teams ask during testing
Can I test this directly in production?
Start with read-only evidence. Use staging for code, package, security, checkout, form, privacy, or cache changes. If a production canary is necessary, make it identifiable, reversible, monitored, and incapable of exposing personal data or charging a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, URL, role, locale, cache state, and downstream integration. Compare the public result, stored result, and logs instead of relying on one browser view.
What evidence should I retain?
Keep UTC time, exact versions, request or record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact credentials, tokens, and personal data.
When is the work complete?
Close it when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, monitoring is active, and the owner has the evidence packet.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, synthetic fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP review Gravity Forms MCP access.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references