WordPress.com MCP integrations now run on OAuth 2.1
WordPress.com switched its MCP server to OAuth 2.1 with PKCE, so AI agents no longer need long-lived tokens pasted into a config file. What the code verifier protects against, and what an authorized agent can do on your site.