WordPress

The Inception Agents plugin (3.1.0 or later) puts your agent surface on your own domain. Once it is connected, your site:

• Serves /mcp, your site’s MCP server, and /.well-known/mcp.json, which points agents there. Personal agents and chat connectors call it from their own servers. Each request is passed to Inception Agents signed with a relay key only your site holds, so each visitor is counted and rate-limited as themselves.
• Serves /llms.txt, /agent/… answers and the agent files (/.well-known/agent.json, /.well-known/agent-capabilities.json).
• Loads the page script, which registers your Agent Actions for an agent on the page in browsers that support them.
• Adds discovery links and structured data (JSON-LD) to your pages.

Your own content always wins. /agent/… is only answered where WordPress has no page, post or archive of its own, and if you publish a page at /mcp the plugin leaves it alone and says so in its settings.

Nothing is sent to Inception Agents until an administrator connects the plugin. Until then it makes no requests, adds nothing to your pages, sets no cookies and does not answer /llms.txt or /agent/…. The settings page lists what each part sends before you connect.

What you need

• WordPress 6.3 or later and PHP 7.4 or later.
• The plugin zip, version 3.1.0 or later. The plugin is not in the WordPress plugin directory yet: the install plan (below) gives you the download link and the SHA-256 to check it against before you install.
• An Inception Agents account with your website added.
• One of: WP-CLI over SSH on the WordPress server, or a WordPress administrator who can upload a plugin and paste a code. No application password or administrator password is needed for the WP-CLI route.

Going live, step by step

Going live is a checklist, and each step counts as done only when a check proves it, never because a setting was saved. It runs from Claude or your coding agent through the Inception Agents connector: ask it to take your site live and it follows the /inception-go-live playbook, reading the go-live state (get_go_live_state) before and after every step. The same steps work for your developer or your agency.

1. Your website. Add the host your visitors use, exactly (add_domain). www.example.com and example.com are different hosts.

2. The install plan. get_install_plan looks at your homepage from outside and recommends the WordPress plugin (or the Cloudflare Worker), with the reasons, any warnings, the download link, its SHA-256 and the exact steps for your site. If it says the homepage is served from the other host (www or the apex), install for the plan’s installHost.

3. Install the plugin. With WP-CLI: download the zip, check its SHA-256 against the plan, then wp plugin install <the zip> --activate --force (--force replaces an older copy); the plan gives the exact commands. Or the site owner uploads the same zip in Plugins → Add New → Upload Plugin and activates it. Check the WordPress Site Address is the install host.

4. Connect with a one-time install code. create_install_code makes a code for your host and the WordPress path. It works once, within an hour, so connect right away:

   • In WordPress: Settings → Inception Agents, read what is sent, paste the code, tick the box and click Connect.

   • With WP-CLI, with the code on standard input so it stays out of your shell history and the process list:

     wp inception connect <<'EOF'
     iac_…
     EOF
     wp inception status
     

   • Or as an administrator: POST /wp-json/inception-agents/v1/connect with {"code": "<install-code>"} (an application password works).

   Connecting gives your site a relay key for its hostname. The key’s secret stays on your server and is never printed, and connecting again revokes the key the site held before.

5. If the site is behind Cloudflare. On Pro and above, add the bot-protection skip rule the install plan gives you before the next step; it covers the proof path, and a challenged proof fails. On Free, Bot Fight Mode cannot be skipped by a rule: turn it off, or some agents will be challenged. Leave Cloudflare’s own switch (AI → Agent Readiness → WebMCP) off (see Agent Actions). To read visitors’ real addresses, tick This site is behind Cloudflare in the plugin’s settings, but only if your server accepts connections from your own Cloudflare zone alone (for example with Authenticated Origin Pulls or Cloudflare Tunnel).

6. Prove the install. verify_install fetches https://your-site.com/.well-known/inception-verify with a fresh challenge, and the plugin answers it itself. A pass proves the site is yours, with no DNS record or file to add, and turns on /mcp for it.

7. Approve the tools, and choose who gets leads. preview_agent_tools shows exactly which tools a visiting agent will be offered, each marked as a lookup or an action. Approve them with approve_agent_tools: answers you publish later need no new approval, and any other change to the tools does. Name the people at your business who receive leads (set_lead_recipients), and send_test_notification so you know the email arrives.

8. Reachable from outside. check_reachability checks your site the way an agent sees it: the page script, /.well-known/mcp.json, /mcp and its tool list with a standard MCP client, the briefing, and the relay. It passes when /mcp serves exactly the tools you approved.

9. A test lead reaches a person. run_live_test acts as a buyer’s agent on your live site: it asks a few questions, then requests a callback. Everyone on your lead list gets an email marked TEST that shows what the agent asked first, with a link to replay the conversation. One of them opens it and clicks I received this test lead. It is never billed.

10. Live. complete_go_live checks everything again and marks the site live. From then on the site is checked every hour, and the people who receive leads get an email if agents stop being able to reach it (for example, if the plugin is deactivated).

Check it yourself

# Agents are pointed at /mcp
curl -s https://your-site.com/.well-known/mcp.json

# Your business, as a plain-text summary for agents
curl -s https://your-site.com/llms.txt

# The tools an agent calling from its own servers is offered
curl -s -X POST https://your-site.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# The connection, from the server
wp inception status

/mcp and /.well-known/mcp.json answer only requests addressed to the hostname the site connected with: a copy of the site under another name, such as a staging clone, does not serve them.

What it sends, and when

Only after an administrator connects the plugin:

What agents ask and what your site answers are recorded in your workspace as agent conversations, with contact details masked. The plugin also adds suggested text to your privacy policy guide (Settings → Privacy → Policy guide).

If Inception Agents cannot be reached

Agent routes that were answered before are served from a saved copy. Otherwise the plugin answers with HTTP 503 and a Retry-After header. Your normal pages are not affected. Search-engine crawlers such as Googlebot, Bingbot and Applebot get exactly what people get, and agent answers are sent with X-Robots-Tag: noindex, so they are never listed in place of your pages.

Pages you already have under /agent/

They keep working. On a real estate site, for example, /agent/jane-doe/ is never taken over: the plugin only answers at /agent/… addresses where WordPress would otherwise show “not found”, and Settings → Inception Agents lists any content it finds under /agent/.

Caching and security plugins

/mcp responses are never cached, and requests from AI agents are fetched fresh. If a caching plugin, a security plugin or a bot challenge answers these paths itself, exclude them from it:

/mcp
/.well-known/mcp.json
/.well-known/inception-verify
/.well-known/agent.json
/.well-known/agent-capabilities.json
/llms.txt
/llms-full.txt
/agent/*

Behind a load balancer or proxy

Add its addresses under Settings → Inception Agents → Trusted proxies (ranges no wider than /16 for IPv4 or /32 for IPv6); the visitor’s address is then read from the X-Forwarded-For hop that proxy added. Otherwise X-Forwarded-For and CF-Connecting-IP are ignored, because anyone can send them.

WooCommerce

If WooCommerce is active, the plugin also serves the ACP and UCP commerce files, adds product structured data, gives AI agents (never search engines) an enriched copy of product and category pages, and credits orders to the AI assistant that referred the visitor. Without WooCommerce none of this runs.

Connecting with a tenant ID

Connecting with a tenant ID still works (Settings → Inception Agents → Connect with a tenant ID instead), but then the site does not serve /mcp. A site upgraded from 3.0 keeps its tenant-ID connection: to turn on /mcp, disconnect and connect again with an install code.

Troubleshooting

• “This install code is not valid for this site.” The code was used, expired, or made for another host. Create a new one for the exact host and connect at once.
• verify_install says the site did not answer 200. The plugin is not active and connected, or a Cloudflare bot challenge blocks our check: add the skip rule.
• verify_install says the site did not answer with an install proof. Something else answers /.well-known/inception-verify (a cache, a security plugin, a bot challenge): exclude that path from it.
• The proof was made with a relay key for another host. The plugin is connected for the other host (www or the apex). Install and connect for the plan’s installHost.
• /mcp is not served. The site was connected with a tenant ID rather than an install code, a page of your own at /mcp takes precedence (the settings page says so), or the request was addressed to another hostname.
• The tools served are not the tools you approved. Something changed after the approval: preview the tools again, and approve again only if the list is right.

Disconnect and remove

Disconnect in Settings → Inception Agents (or wp inception disconnect) to stop all requests at once. It asks Inception Agents to revoke your site’s relay key and removes the key from your site, even if Inception Agents cannot be reached (the settings page says which). Deleting the plugin does the same, and removes all of its settings, including the tenant ID, and its cached data. Once the site is live, a deactivated plugin shows up in the hourly check, and the people who receive leads are told.