Read-only quick start

This guide creates a read-only SitePilot connection with two terminal commands, one client restart, and one bounded inspection. You can follow it yourself or ask an agent to complete it. No content is changed.

The example uses Cursor because its restart path is simple and repeatable. SitePilot also supports Claude Code, Codex, Antigravity CLI, Antigravity IDE, Windsurf, and Claude Desktop.

Before setup

Ask the site owner to provide:

• An HTTPS WordPress site with SitePilot MCP 0.4.10 or later installed and active.
• A WordPress account that can authorize an Application Password.
• Permission to perform one read-only sitepilot-inspect-site call.

On the computer that will run the client, install:

• Node.js 22 or later
• Cursor

Open an empty folder in Cursor and open its terminal. Keep the WordPress username and password private. SitePilot opens WordPress in the browser and never asks you to paste that password into the terminal or chat.

Command 1: connect read-only

Replace https://your-site.example with the WordPress site URL, then run:

npx -y sitepilot-mcp@0.1.6 login --url https://your-site.example --scopes site:read --profile first-user-test --label first-user-test

Your browser opens WordPress:

1. Sign in if asked.
2. Approve the Application Password request.
3. Return to the terminal.

The command should end with output beginning Saved profile first-user-test and should report site:read. Do not continue if it reports broader scopes.

Command 2: configure Cursor

Run:

npx -y sitepilot-mcp@0.1.6 init --client cursor --profile first-user-test

The command writes .cursor/mcp.json and .cursorrules in the folder. It does not put the credential in either file.

Restart once and verify

1. In Cursor, open the Command Palette with Ctrl+Shift+P on Windows or Cmd+Shift+P on macOS.
2. Choose Developer: Reload Window.
3. Start a new agent chat and paste this prompt:

Use the SitePilot MCP tool sitepilot-inspect-site exactly once. Do not call any other tool. Report the WordPress version, SitePilot plugin version, authentication strategy, and granted scopes from that single result.

Setup is complete when the tool call finishes and the response shows a working connection with the granted scope limited to site:read.

Pass conditions

All of these must be true:

• sitepilot-inspect-site succeeds once.
• The result reports the expected WordPress and SitePilot versions.
• Granted scopes contain only site:read.
• No password, Application Password, access token, or refresh token appears in the evidence.

Elapsed time is not a pass condition. Record friction or repeated steps as product-improvement evidence instead of turning a successful, bounded connection into a release failure.

Record the result

Copy this block into the acceptance record:

Date and timezone:
Operator or agent:
Operating system:
Client and version:
Site URL:
SitePilot plugin version:
sitepilot-mcp npm version:
Quick-start guide commit:
Command 1:
Command 2:
Restart performed:
WordPress version reported:
Authentication strategy reported:
Granted scopes reported:
Evidence location:
Friction or repeated steps observed:
Secrets excluded from evidence: yes / no

Clean up after the test

1. Run this command to remove the local profile:

   npx -y sitepilot-mcp@0.1.6 logout --profile first-user-test

2. In WordPress, open the participant’s user profile and revoke the Application Password named SitePilot MCP · first-user-test.

3. Delete the disposable test folder if it is no longer needed.

If setup fails, keep the non-secret terminal output and note the failure point. See the MCP adapter troubleshooting guidance before repeating the test.

---

Public normalization derived from product commit 00c30de825b68dc14535f6455e82c927ad256b47, file docs/read-only-quick-start.md. See source-manifest.json for the source digest and declared normalization classes.