# How to connect an AI agent > Let Claude or another MCP-compatible AI agent control this site's cache — purge, tune, benchmark — through a scoped token, or via OAuth with no token to copy. - Category: AI & agents - Canonical: https://xspeedcache.com/docs/mcp-server/ --- MCP — the Model Context Protocol — lets an AI agent call tools on your behalf. Connect this site and you can ask Claude to purge the cache, check the hit ratio, or run a benchmark in plain language, instead of clicking through panels. This is also the most powerful thing you can hand an AI, so the panel is built around controlling exactly what it can do and revoking it quickly. > **Where to find it** > > 1. In your WordPress admin, click **xSpeed Cache** in the left menu. > 2. In the xSpeed Cache sidebar, open the **AI & agents** group. > 3. Click the **MCP** card. > > *Shortcut: open `wp-admin/admin.php?page=xspeed#/ai-agents/mcp` directly.* > > ✅ This panel is part of **xSpeed Cache (Free)**. ![Connection status and controls](https://xspeedcache.com/_astro/mcp-status.RQchPX7g.png) 1. **Status** — with **Refresh**, **Rotate** and **Disconnect**. --- ## Settings at a glance | Control | What it does | | --- | --- | | **Refresh** | Re-check the connection state. | | **Rotate** | Issue a new token, invalidating the old one. | | **Disconnect** | Revoke access entirely. | | **Connection format** | Four ways to give the details to your client. | | **Connect via xSpeed Hub** | OAuth sign-in with no token to copy. | --- ## How it works Once connected, an AI agent authenticates with a token and calls xSpeed's tools. The panel shows **Connected** along with the granted scopes — typically **read, write**. **The token travels in an `Authorization` header**, which the panel notes means "it never lands in a URL or server log." That matters: a token in a query string ends up in access logs, browser history and referrer headers. In a header it doesn't. --- ## Four ways to connect ![Connection formats and the command](https://xspeedcache.com/_astro/mcp-connect.Dd43XGSp.png) 1. **Format picker** — choose what your client expects. 2. **The four formats.** 3. **The generated command** — containing your token. | Format | For | | --- | --- | | **Claude Code (CLI)** | A single terminal command registering xSpeed with Claude Code. | | **JSON config** | Clients configured with a JSON block. | | **AI prompt** | Paste-into-chat text for an agent that can configure itself. | | **Remote (OAuth)** | Sign-in flow — **no token to copy**. | Three of these put your token on screen so you can copy it. **Remote (OAuth) is the exception** — it's the only format where no token is displayed at all, because authentication happens through a sign-in rather than a copied secret. > 🔒 **Treat the token like a password.** The panel says it plainly: *"it lets an AI control this site."* Anyone holding it can purge your cache and change your settings. > > That makes the format choice a security decision, not just a convenience one. A token pasted into a terminal is in your shell history; pasted into a chat, it's in that conversation's history. **Prefer OAuth where your client supports it** — there's nothing to leak. **Rotate** issues a new token and invalidates the old one — the right move if a token may have been exposed. **Disconnect** revokes access entirely. --- ## What the agent can actually do ![The tools list](https://xspeedcache.com/_astro/mcp-tools.DfFl0YzC.png) 1. **Tools your AI agent can call** — expandable, with a count. The panel lists every tool exposed to the agent, with a count in the header — **98** on this install. That's worth expanding before you connect anything. The count is the point. Connecting an agent isn't granting one capability; it's granting a large surface across caching, optimization, diagnostics and settings. The scopes shown beside the status (**read, write**) tell you the shape of that access: read alone would be observation, write means the agent can change your configuration. Review the list, and if the breadth concerns you, that's a reason to prefer a short-lived connection you **Disconnect** when finished rather than leaving open indefinitely. --- ## xSpeed Hub — one connection for many sites ![The xSpeed Hub option](https://xspeedcache.com/_astro/mcp-hub.Dt_7Txmp.png) 1. **xSpeed Hub** — control caching across all your sites from one AI connection. 2. **Connect via xSpeed Hub** — one-click sign-in. If you run several sites, connecting each one separately means several tokens to manage and revoke. The Hub inverts that: connect your sites to the Hub, connect the AI to the Hub **once**, and you can say *"purge cache on acme"* and have it work. The flow is three steps — connect this site, connect your AI once from the Hub dashboard, then control every site. As the panel notes: *"One click — sign in to your account and approve. No token to copy."* Same security advantage as the OAuth format, extended across sites: no secret to paste, and revocation happens in one place rather than site by site. --- ## Related - [xSpeed Cache MCP Tool Reference](https://xspeedcache.com/docs/mcp-tool-reference/) - [How to connect an AI provider](https://xspeedcache.com/docs/ai-provider/) - [How to control AI data collection](https://xspeedcache.com/docs/ai-privacy/) - [How to run a full site scan](https://xspeedcache.com/docs/scan/) - [How to read your dashboard](https://xspeedcache.com/docs/overview/)