Gravity Forms documents two gates for MCP calls: one site-wide tool allowlist and the connecting WordPress user's capabilities. When several agents connect, enabling a tool for one client makes it globally discoverable subject to each user's permissions, so isolation must be proved through dedicated identities and observed calls.
Use this for reporting assistants, support agents, form builders, data operators, automation clients, agencies, multisite installations, and any site with more than one Gravity Forms MCP user.
Quick answer
Create one dedicated WordPress user and one application password per agent. Define an approved manifest with the exact tools, capabilities, form or entry purpose, data class, environment, owner, and expiry for each client. Export the site-wide allowlist and every agent user's effective capabilities, then collect the tool list each named client can actually see. Run harmless allowed fixtures and pre-approved denied fixtures against synthetic forms and entries. Diff the observed result after every role, allowlist, plugin, add-on, endpoint, or client change.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Reporter | Count synthetic entries | Allowed |
| Reporter | Delete synthetic entry | Denied |
| Builder | Update test form | Allowed |
| Builder | Read restricted entry | Denied by capability design |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Create one user per agent | Record Gravity Forms and WordPress versions, endpoint mode, site-wide tool allowlist, dedicated users, roles, primitive capabilities, application password UUIDs, clients, owners, and expiry dates. | Every agent has a unique user, application password, owner, purpose, and expiry. |
| Define approved manifests | Classify each tool as read, write, destructive, notification, form design, feed, entry, settings, or add-on related and map every capability dependency. | Observed tool inventories match the approved manifests. |
| Compare both access gates | Ask each named client to list visible tools, compare with its approved manifest, and retain a sorted hash without recording credentials or personal form data. | Allowed synthetic calls succeed and denied calls make no changes. |
| Run allowed and denied fixtures | Run one allowed synthetic fixture and one denied fixture per boundary, including cross-agent attempts, form edits, entry reads, notification actions, and deletion tools. | Role, allowlist, endpoint, add-on, and client changes trigger a repeat audit. |
What to check first
- Record Gravity Forms and WordPress versions, endpoint mode, site-wide tool allowlist, dedicated users, roles, primitive capabilities, application password UUIDs, clients, owners, and expiry dates.
- Classify each tool as read, write, destructive, notification, form design, feed, entry, settings, or add-on related and map every capability dependency.
- Ask each named client to list visible tools, compare with its approved manifest, and retain a sorted hash without recording credentials or personal form data.
- Run one allowed synthetic fixture and one denied fixture per boundary, including cross-agent attempts, form edits, entry reads, notification actions, and deletion tools.
- Alert on newly visible write tools, broadened capabilities, shared credentials, unowned users, stale clients, changed endpoint mode, and permission denials that indicate drift.
Field notes
- Write the pass condition before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because deployments, caches, retries, scheduled actions, and background jobs can change the evidence.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Repeat verification after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
agent,user,tool,allowlist,capability,observed,expected,result
reporter,gf_report,List Forms,on,edit_forms,visible,visible,pass
reporter,gf_report,Delete Entries,on,delete_entries,denied,denied,pass
Why this usually happens
- An administrator enables a tool globally to help one agent and forgets the other clients.
- Two agents share one broad WordPress account and application password.
- A role-editor change adds a capability outside the MCP settings screen.
- A client reconnects with a different username and silently receives a new tool inventory.
Decision rule
Keep an agent connected only when its dedicated identity, effective capabilities, visible tools, allowed calls, denied calls, logs, and expiry match a named approved manifest.
Production verification checklist
- Every agent has a unique user, application password, owner, purpose, and expiry.
- Observed tool inventories match the approved manifests.
- Allowed synthetic calls succeed and denied calls make no changes.
- Role, allowlist, endpoint, add-on, and client changes trigger a repeat audit.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Create one user per agent
- Define approved manifests
- Compare both access gates
- Run allowed and denied fixtures
- Alert on observed drift
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while stored records, logs, queues, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, and failure branch that real users reach.
- Leaving temporary exclusions, debug output, helper accounts, broad permissions, or one-off repair code active after verification.
Questions teams ask during testing
Can I run this directly in production?
Begin with read-only evidence and use staging for package, code, database, form, or permission changes. If a production canary is necessary, make it identifiable, reversible, monitored, and unable to expose personal data or charge a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, role, URL, locale, cache state, and downstream integrations. Compare browser, stored, and log evidence instead of relying on one screen.
What should the evidence packet contain?
Keep UTC time, exact versions, synthetic record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact secrets and personal data.
When is the test complete?
Close the work when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, and monitoring covers the next update.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP audit Gravity Forms MCP access.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references