Linkilo’s MCP access is built “secure by default”: until you deliberately open it up, nothing is exposed — and even then, every connection is limited to exactly what you allow. Everything described here is on Linkilo → Manage → MCP Access and applies to Linkilo 2.9 and later.
The two master switches
- Enable MCP access — the kill switch. While OFF (the default), the endpoint refuses every request from everyone. Turning it off later instantly cuts off all connected assistants, and also clears the write switch below.
- Allow confirmed write actions — a separate switch, also OFF by default. While it’s off, every connection is read-only, even tokens with editor or admin roles. Write tools (insert links, create redirects, run or ignore broken-link scans) are hidden from the assistant and refused if called directly.
Even with the write switch on, a write only happens when the token’s role permits that tool and the individual call includes an explicit confirmation (confirm: true) after you approve it in the assistant. Link insertion additionally requires a signed suggestion that Linkilo itself produced, so an assistant cannot invent a link and force it in.
The four roles
| Role | Can |
|---|---|
read_only |
View all insights (linking overview, orphans, anchors, cannibalization, clusters, broken links, redirects, clicks, crawl log, GSC, index coverage, link equity), get link suggestions, and list or generate agency reports. |
read_write |
Everything above, plus run scans and ignore broken links. No content edits. |
editor |
Everything above, plus insert suggested links into posts and create redirects. |
admin |
Everything above — Linkilo administration only. Never WordPress admin: no users, plugins, themes, files, or settings outside Linkilo. There are no tools that only admin can use. |
Roles are strictly ordered; a connection can never do more than its role, and a role can never do more than the global switches allow. In total there are 21 tools: 17 read-only (including the two 3.0 reporting tools, list_report_profiles and generate_agency_report) and 4 write tools.
Tokens are not WordPress logins
A token is a random secret stored hashed; Linkilo never keeps the plain text. It carries none of your WordPress capabilities. Tokens can only be created by a logged-in administrator inside wp-admin — no connected assistant can ever mint, reveal, or escalate a token.
Expiry and revocation
Every token can be given an expiry (30 days, 90 days, 1 year, or Never). Expired tokens are refused exactly like revoked ones. Click Revoke in the Issued tokens table and it takes effect on the very next request.
The audit log
Recent MCP activity at the bottom of the MCP Access page lists the last 20 tool calls: when, which token, which role, which tool, and the outcome — ok, denied (a role or read-only-policy block), or error. If you ever wonder what an assistant actually did on your site, the answer is on that page.
Built-in limits
A single request may contain at most 10 operations, each token is limited to 120 operations per minute, and result sizes are capped so a large site can’t be asked for everything at once. MCP never calls your AI provider: it reads data Linkilo already stored, so connecting an assistant costs you nothing in OpenAI or OpenRouter usage.
No made-up answers
Every MCP tool returns only real stored data. If a dataset is empty, the tool says so explicitly and the assistant is instructed not to invent values — and not to claim the connection is broken when data is simply empty. Assistants can also call get_connection_status for ground truth about the connection, the role, and which data sources are attached.
Last reviewed for Linkilo 3.0.0 (October 2026).