Linkilo’s MCP access is built so that nothing is exposed until you deliberately open it, and even then each connection is limited to exactly what you allowed. Linkilo 3.0.2 replaced the four roles with three plain-language levels, added areas, an approval queue, and team access. Everything here is on Linkilo → Manage → MCP Access.
The two switches
- Allow AI assistants to connect — the master switch, off by default. While it is off, every request is refused and the sign-in surface is offline. Turning it off later cuts off every connection at once and also clears the second switch.
- Also allow changes (links, broken-link fixes, redirects, scans) — off by default. While it is off, every connection can only read, whatever its level. Change tools are hidden from the assistant and refused if called directly.
The three levels
| Level | What it means |
|---|---|
| View only | Reads reports and suggestions. Changes nothing. |
| Draft only | Proposes changes. Each one waits under MCP Access → Pending AI changes until an administrator approves or rejects it. Scans still run. |
| Publish | Changes go live as soon as you confirm them in the chat. |
Every level can read all link reports (linking overview, orphans, anchors, cannibalization, clusters, broken links, redirects, clicks, crawl log, Search Console queries, index coverage, link equity), get link suggestions, and list or generate agency reports.
Areas
A Draft only or Publish connection also has the areas it may change:
- Internal links — add, remove and re-point links in posts; run the link scan.
- Broken links — fix or unlink broken links, ignore or un-ignore them; run the broken-link scan.
- Redirects — create, turn off and delete redirects.
A connection with Publish and only Broken links can fix a dead link but cannot add an internal link. The owner can change any connection’s level and areas, or disconnect it, from the Connected assistants and keys table.
Every change is confirmed, and runs as a person
A change happens only when all of these are true: Also allow changes is on, the connection’s level and area allow that tool, and the assistant has asked you and you confirmed in the chat (each change tool requires an explicit confirm). Applying a suggestion additionally needs the signed suggestion Linkilo itself produced, so an assistant cannot invent a link and force it in.
Changes run as the WordPress user who approved the connection, so a connection can only edit posts that person can edit. Link edits touch only links whose address is exactly the one given; longer addresses and plain-text mentions are left alone. WordPress keeps a revision of each change and Linkilo’s link audit can restore it. Links in menus, footers, sidebars, theme boxes and page builders are reported, not edited.
The approval queue (Draft only)
Pending AI changes lists each proposed change with what it is, who proposed it and when. Approve applies it now (Linkilo checks it again first, so a change that went stale because the post was edited meanwhile is not applied), Reject discards it. Approve selected and Reject selected handle a batch. Recently decided changes stay visible underneath.
Team access
By default only administrators can connect an assistant. Under Team access, the owner can let other WordPress roles connect their own, and set the most each role may grant: for example an SEO specialist with an Editor account at Draft only, Internal links and Broken links. They choose a level when they approve, up to that cap. Lowering a role’s cap applies to its existing connections on the next request. Changes still run as that person, so an Author can only change their own posts even with Publish. Administrators always have full access.
Expiry and disconnecting
Every connection has an expiry chosen at approval (30 days, 90 days or 1 year; keys can also be set to Never). Expired connections are refused like disconnected ones. Disconnect in the connections table takes effect on the very next request.
Keys and sign-ins are not WordPress logins
A connection carries none of your WordPress capabilities. Keys are random secrets stored hashed; Linkilo never keeps the plain text. Only a logged-in person with team access can approve a connection, inside wp-admin, and no connected assistant can ever mint, reveal or escalate one. No level grants WordPress administration: no users, plugins, themes, files, site settings or SQL. The tools themselves are the boundary.
The two logs
- Sign-in activity shows each step an assistant took while connecting. A healthy connection reads: read the connection details → read the sign-in settings → registered or identified → waiting for your approval → you approved → connected. If a connection fails, the last line shows where it stopped.
- Recent MCP activity lists the last 20 tool calls: when, which connection, its access, which tool, and the outcome:
ok,deniedorerror. If you ever wonder what an assistant did on your site, the answer is here.
Built-in limits
A single request may contain at most 10 operations, each connection is limited to 120 operations per minute, and result sizes are capped. MCP never calls your AI provider: it reads data Linkilo already stored, so connecting an assistant costs nothing in OpenAI or OpenRouter usage.
No made-up answers
Every tool returns only real stored data. If a dataset is empty, the tool says so and the assistant is instructed not to invent values, and not to claim the connection is broken when data is simply empty. get_connection_status gives the ground truth about the connection, its level and areas, and which data sources are attached.
Last reviewed for Linkilo 3.0.2 (October 2026).