Bricks Builder MCP Server
bricks-builder-mcp
npm
v3.12.4
Published by an unidentified publisher — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Serveur MCP pour piloter Bricks Builder (WordPress) depuis Claude/Codex — édition de pages, gestion d'éléments, audit technique, audit design visuel, upload optimisé WebP. Communauté Discord : https://discord.gg/rX22zHRzH
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Package runs install-time scripts MTC-SUP-010 | supply-chain |
2. Client adoption risk — 99 − 5 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
low Package runs install-time scripts (postinstall)MTC-SUP-010
"bricks-builder-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.
Evidence: node -e "console.log('\n[bricks-builder-mcp] Pour activer verify_element/audit_page/audit_design_page, lance UNE FOIS :\n npx playwright install chromium\n')"
Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.
Location: package bricks-builder-mcp
Tools 73
Each tool and what it can reach — statically extracted from the published source.
get_page_custom_codeingests untrusted inputget_page_jsoningests untrusted inputget_page_structureingests untrusted inputlist_bricks_optionsreads sensitive dataupdate_page_jsoningests untrusted inputadd_color_to_paletteno sensitive capabilityadd_elementno sensitive capabilityadd_menu_itemno sensitive capabilityanalyze_json_structureno sensitive capabilityaudit_design_pageno sensitive capability
Show 63 more tools ↓
audit_pageno sensitive capabilitybatch_addno sensitive capabilitycheck_skill_versionno sensitive capabilitycreate_global_classno sensitive capabilitycreate_pageno sensitive capabilitycreate_postno sensitive capabilitycreate_taxonomy_termno sensitive capabilitycreate_theme_styleno sensitive capabilitydelete_custom_fontno sensitive capabilitydelete_elementno sensitive capabilitydelete_global_classno sensitive capabilitydelete_pageno sensitive capabilitydelete_postno sensitive capabilitydelete_theme_styleno sensitive capabilityduplicate_pageno sensitive capabilityfind_elementsno sensitive capabilityget_bricks_optionno sensitive capabilityget_code_execution_statusno sensitive capabilityget_custom_codeno sensitive capabilityget_elementno sensitive capabilityget_element_schemano sensitive capabilityget_filter_schemano sensitive capabilityget_global_stylesno sensitive capabilityget_postno sensitive capabilityhealth_checkno sensitive capabilitylist_all_pagesno sensitive capabilitylist_bricks_pagesno sensitive capabilitylist_color_paletteno sensitive capabilitylist_componentsno sensitive capabilitylist_css_variablesno sensitive capabilitylist_custom_fontsno sensitive capabilitylist_global_classesno sensitive capabilitylist_mediano sensitive capabilitylist_menusno sensitive capabilitylist_missing_featuresno sensitive capabilitylist_post_typesno sensitive capabilitylist_postsno sensitive capabilitylist_spacing_scalesno sensitive capabilitylist_theme_stylesno sensitive capabilitylist_typography_scalesno sensitive capabilityregister_custom_fontno sensitive capabilityregister_google_font_locallyno sensitive capabilityreorder_sectionsno sensitive capabilityreport_missing_featureno sensitive capabilityresolve_missing_featureno sensitive capabilityset_code_executionno sensitive capabilityset_css_variableno sensitive capabilityset_custom_codeno sensitive capabilityset_homepageno sensitive capabilityset_page_custom_codeno sensitive capabilityset_spacing_scaleno sensitive capabilityset_typography_scaleno sensitive capabilityupdate_elementno sensitive capabilityupdate_global_classno sensitive capabilityupdate_global_stylesno sensitive capabilityupdate_page_metano sensitive capabilityupdate_postno sensitive capabilityupdate_theme_styleno sensitive capabilityupload_local_fileno sensitive capabilityupload_local_files_batchno sensitive capabilityupload_mediano sensitive capabilityupload_media_batchno sensitive capabilityverify_elementno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (73 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v3.12.4 latest |
A 94/100 | 1 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan bricks-builder-mcp --onlineMore in Content Management
Apify MCP Server
Model Context Protocol (MCP) Server for the *@inkeep/agents-mcp* API.
Medicare spending, chronic conditions, hospital quality, readmissions, and enrollment
Public read-only MCP for products, frameworks, guides, methodology, and blog metadata.
Community-maintained MCP server for Atlassian Confluence Data Center. Not affiliated with Atlassian.
MCP server for Contentful Content Management API integration