Skip to content
Documentation

Your EMCP guide

Answers from our docs

YOUR CHAT, YOUR CHOICE

Before we chat

MSR Builds processes your question and up to four recent messages on our server to answer from the EMCP docs. AI is optional and needs your separate permission.

The chat is kept in this page's memory, not saved as a conversation in our database or browser storage. Our hosting and security services process connection information, such as your IP address, to prevent abuse.

Cloudflare Turnstile checks your browser and connection to prevent automated abuse when you send a question. No login is required.

Please leave out personal, sensitive or confidential information, passwords and API keys.

You can withdraw consent and clear this page's chat at any time. This cannot undo a request already sent or erase provider/security records.

Chat privacy, retention & your rights ↗ · Privacy contact

Starting chat consents to this processing. You can browse our docs without using the chat.

Gateway network identity

EMCP Gateway is operated by MSR Builds. It sends authenticated WordPress management requests on behalf of a connected site’s authorized user. It does not crawl sites for search indexing or AI training. WordPress permissions and EMCP tool controls still apply to every operation.

Identifying requests

Section titled “Identifying requests”

The stable User-Agent product name is EMCP-Gateway. The current full value is:

EMCP-Gateway/1.0 (+https://emcptools.com/docs/connecting/gateway-network/)

The 1.0 identifies this network identity format, not the plugin release. Earlier Gateway releases used undici; historical logs may still contain that identifier. A User-Agent is an identification aid, not proof of authenticity or authorization.

The current deployment sends site traffic over IPv4. Its outbound addresses, verified on 2026-10-19, are:

  • 51.161.91.207

51.161.91.207 is the dedicated outbound IPv4 for EMCP Gateway site requests. Use this address when configuring hosting exceptions for EMCP. It is reserved for the service and remains stable while the hosting allocation is maintained. Any planned change will be reflected in this published list.

The website’s or gateway hostname’s DNS records are not an outbound-IP list. The current list is also available as machine-readable JSON. When preparing an exception, use this published list and the diagnostic report for the deployment being investigated. There are currently no outbound IPv6 addresses.

Endpoints and authentication

Section titled “Endpoints and authentication”

Requests use HTTPS on port 443 and the POST method:

PathPurpose
/wp-json/emcp-tools/oauth/v1/tokenOAuth token refresh, using a form-encoded request.
/wp-json/mcp/emcp-tools-serverMCP requests, using JSON and a Bearer access token.

Subdirectory installations can have a site-path prefix. The hosting diagnostics show the actual destination path. Keep the Authorization, Content-Type, Accept, Mcp-Session-Id, and X-Request-Id headers intact. Gateway API requests cannot complete CAPTCHA or JavaScript browser challenges.

Collecting hosting diagnostics

Section titled “Collecting hosting diagnostics”
  1. Open Connected Sites and select Refresh status.
  2. Expand Hosting diagnostics beneath the affected site.
  3. Copy or download the report and send it to your hosting provider.

The report includes UTC timestamps, destination paths, HTTP status codes, request IDs, and Cloudflare Ray IDs when supplied. Outbound addresses in the report are deployment configuration, not a measurement of each request’s source IP. Credentials, cookies, request bodies, and response bodies are excluded. Check timestamps carefully: an earlier cached report does not describe a later attempt.

What to ask your hosting provider

Section titled “What to ask your hosting provider”

Ask them to inspect both edge firewall/bot-protection events and origin access logs, using the report’s timestamps and identifiers. Requests blocked at the edge may never appear in origin logs. Missing origin logs alone do not establish the exact blocking rule.

Request the rule ID and action (block, challenge, or rate limit), and a narrowly scoped exception for legitimate EMCP requests. Keep WordPress authentication and unrelated site protections enabled. Avoid allowing all traffic based only on a spoofable User-Agent or opening the entire /wp-json/ namespace.

Kinsta documents IP, path, and User-Agent exceptions in its bot-protection guide. Ask Kinsta support how to scope the exception to EMCP and which edge rule applies. EMCP does not currently claim Cloudflare Verified Bot status or Web Bot Auth support.

If access remains blocked, send the host’s findings and diagnostic report to EMCP support.