Fix "Couldn't reach the admin API" in Easy MCP AI

The Easy MCP AI screens in WordPress (Dashboard, Connections, Tools, Activity and Settings) load their data from the plugin's own admin API at /wp-json/easy-mcp-ai-admin/v1/. When that request is refused with HTTP 401 or 403, the screens can't load and show:

Couldn't reach the admin API. If a security plugin blocks the REST API, allow the easy-mcp-ai-admin namespace.

This only affects the admin screens. Connecting an AI client uses a different address; if an AI client can't connect, see Troubleshooting Easy MCP AI Connection Issues.

In this article

• Reload the page first
• Check that you're signed in as an administrator
• Allow the admin API in your security plugin
• Check the hide-admin setting in wp-config.php
• Ask your host to allow the admin API
• Verify the resolution
• Security

Reload the page first

Every admin request carries a security token (a WordPress nonce) that expires after a while. If the Easy MCP AI screen was open for a long time, or your browser restored it from an old session, the token may no longer be valid and the request is refused.

Reload the page. If the screens load again, nothing else is needed.

If the error comes back on every reload, a caching plugin or your host may be serving an old copy of the admin page. Exclude /wp-admin/ from page caching, clear the cache, and reload.

Check that you're signed in as an administrator

The admin API only answers users who can manage the site (the manage_options capability, which administrators have). Editors, authors and other roles get the error even when everything else is fine.

Sign in with an administrator account and open Easy MCP AI > Dashboard again.

Allow the admin API in your security plugin

Security plugins that restrict or disable the WordPress REST API can block the admin API too. The plugin's own diagnostics recognize Wordfence, Solid Security, Sucuri Security, Defender and NinjaFirewall; plugins that offer a "Disable REST API" or "Restrict REST API" setting behave the same way.

In your security plugin's REST API settings:

1. Allow the easy-mcp-ai-admin/v1 namespace (or the path /wp-json/easy-mcp-ai-admin/), so the Easy MCP AI screens can load.
2. If AI clients should connect too, also allow the easy-mcp-ai/v1 namespace (or /wp-json/easy-mcp-ai/).
3. Save, then reload the Easy MCP AI screen.

If you're not sure which plugin is responsible, deactivate your security plugins one at a time and reload the Easy MCP AI screen after each. When the screens load, the last plugin you deactivated is the one to configure. Reactivate it after you've added the exception.

Check the hide-admin setting in wp-config.php

The EASY_MCP_AI_HIDE_ADMIN constant can switch off the plugin's admin screens on purpose, for example on client sites. Set to true, it blocks the admin pages and the admin API behind them. Set to 'menu', it only hides the menu entry and the screens keep working.

Open wp-config.php and look for EASY_MCP_AI_HIDE_ADMIN. If it is set to true and you need the screens, remove the line or change the value to 'menu'. See White-Label and Hidden Admin and wp-config Constants for details.

Ask your host to allow the admin API

Some hosts run a web application firewall, such as ModSecurity, in front of WordPress. A firewall rule can refuse requests to /wp-json/ before WordPress sees them, so no WordPress setting helps.

Contact your host and share:

• The path /wp-json/easy-mcp-ai-admin/v1/ and the HTTP status (401 or 403).
• The time you saw the error.
• That the request comes from a signed-in administrator in wp-admin.

Ask them to allow these requests with a narrow exception. Do not ask them to disable the firewall or other security protection globally.

Verify the resolution

Reload Easy MCP AI > Dashboard. The Dashboard, its Diagnostics card and the other Easy MCP AI screens should load without the error. Press Re-run on the Diagnostics card to check the rest of the setup, including whether a security plugin also affects AI client connections.

If the error remains, contact support and include the HTTP status, the list of active security plugins, and whether the error also appears after reloading in a private browser window.

Security

If you identify a potential security vulnerability in this plugin, please disclose it responsibly. Follow the protocols on the Themeisle Security Page.