Wordpress (cavort-it-systems) MCP Server
@cavort-it-systems/wordpress-mcp
npm
v3.0.0
Published by @cavort-it-systems — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Lightweight WordPress MCP server - token-optimized REST API access
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([wp_get_page]) co-exist with external-action tools ([wp_create_comment, fulfillment_update_settings]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [wp_get_page] → sinks [wp_create_comment, fulfillment_update_settings]
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow wp_get_page → wp_create_comment
Tools 200
Each tool and what it can reach — statically extracted from the published source.
fulfillment_update_settingsnetwork egresswp_create_commentnetwork egresswp_get_pageingests untrusted inputacf_create_field_groupno sensitive capabilityacf_delete_field_groupno sensitive capabilityacf_export_field_groupno sensitive capabilityacf_get_field_groupno sensitive capabilityacf_get_post_fieldno sensitive capabilityacf_get_post_fieldsno sensitive capabilityacf_import_field_groupsno sensitive capability
Show 190 more tools ↓
acf_list_field_groupsno sensitive capabilityacf_update_field_groupno sensitive capabilityacf_update_post_fieldno sensitive capabilityacf_update_post_fieldsno sensitive capabilityfulfillment_fulfill_orderno sensitive capabilityfulfillment_get_settingsno sensitive capabilityfulfillment_queueno sensitive capabilityfulfillment_reprint_jobno sensitive capabilityfulfillment_statusno sensitive capabilityfulfillment_update_applyno sensitive capabilityfulfillment_update_checkno sensitive capabilitylist_sitesno sensitive capabilitymcp_add_menu_itemno sensitive capabilitymcp_add_widgetno sensitive capabilitymcp_assign_menu_locationno sensitive capabilitymcp_assign_termsno sensitive capabilitymcp_bulk_delete_mediano sensitive capabilitymcp_bulk_get_optionsno sensitive capabilitymcp_change_user_roleno sensitive capabilitymcp_check_updatesno sensitive capabilitymcp_clean_commentsno sensitive capabilitymcp_clean_revisionsno sensitive capabilitymcp_create_cpt_postno sensitive capabilitymcp_create_menuno sensitive capabilitymcp_create_termno sensitive capabilitymcp_create_userno sensitive capabilitymcp_delete_cpt_postno sensitive capabilitymcp_delete_mediano sensitive capabilitymcp_delete_menuno sensitive capabilitymcp_delete_menu_itemno sensitive capabilitymcp_delete_optionno sensitive capabilitymcp_delete_termno sensitive capabilitymcp_delete_themeno sensitive capabilitymcp_delete_userno sensitive capabilitymcp_delete_widgetno sensitive capabilitymcp_flush_cacheno sensitive capabilitymcp_flush_rewriteno sensitive capabilitymcp_get_cron_statusno sensitive capabilitymcp_get_debug_infono sensitive capabilitymcp_get_elementor_buildno sensitive capabilitymcp_get_elementor_conditionsno sensitive capabilitymcp_get_elementor_elementno sensitive capabilitymcp_get_elementor_flatno sensitive capabilitymcp_get_elementor_kitno sensitive capabilitymcp_get_elementor_page_settingsno sensitive capabilitymcp_get_healthno sensitive capabilitymcp_get_mediano sensitive capabilitymcp_get_media_statsno sensitive capabilitymcp_get_menuno sensitive capabilitymcp_get_menu_locationsno sensitive capabilitymcp_get_optionno sensitive capabilitymcp_get_php_infono sensitive capabilitymcp_get_plugins_healthno sensitive capabilitymcp_get_post_typeno sensitive capabilitymcp_get_sidebar_widgetsno sensitive capabilitymcp_get_system_infono sensitive capabilitymcp_get_tablesno sensitive capabilitymcp_get_taxonomyno sensitive capabilitymcp_get_userno sensitive capabilitymcp_get_user_metano sensitive capabilitymcp_get_versionno sensitive capabilitymcp_get_widgetno sensitive capabilitymcp_install_pluginno sensitive capabilitymcp_install_plugin_zipno sensitive capabilitymcp_install_themeno sensitive capabilitymcp_install_theme_zipno sensitive capabilitymcp_list_cpt_postsno sensitive capabilitymcp_list_elementor_templatesno sensitive capabilitymcp_list_mediano sensitive capabilitymcp_list_menusno sensitive capabilitymcp_list_optionsno sensitive capabilitymcp_list_post_typesno sensitive capabilitymcp_list_rolesno sensitive capabilitymcp_list_sidebarsno sensitive capabilitymcp_list_taxonomiesno sensitive capabilitymcp_list_termsno sensitive capabilitymcp_list_usersno sensitive capabilitymcp_list_widget_typesno sensitive capabilitymcp_move_widgetno sensitive capabilitymcp_optimize_tablesno sensitive capabilitymcp_regenerate_thumbnailsno sensitive capabilitymcp_reorder_widgetsno sensitive capabilitymcp_run_cronno sensitive capabilitymcp_search_elementorno sensitive capabilitymcp_search_pluginsno sensitive capabilitymcp_search_replaceno sensitive capabilitymcp_search_themesno sensitive capabilitymcp_set_optionno sensitive capabilitymcp_sideload_mediano sensitive capabilitymcp_update_all_pluginsno sensitive capabilitymcp_update_all_themesno sensitive capabilitymcp_update_coreno sensitive capabilitymcp_update_cpt_postno sensitive capabilitymcp_update_elementor_elementno sensitive capabilitymcp_update_elementor_kitno sensitive capabilitymcp_update_elementor_page_settingsno sensitive capabilitymcp_update_mediano sensitive capabilitymcp_update_menuno sensitive capabilitymcp_update_menu_itemno sensitive capabilitymcp_update_pluginno sensitive capabilitymcp_update_termno sensitive capabilitymcp_update_themeno sensitive capabilitymcp_update_userno sensitive capabilitymcp_update_user_metano sensitive capabilitymcp_update_widgetno sensitive capabilitywoo_add_order_noteno sensitive capabilitywoo_bulk_update_stockno sensitive capabilitywoo_create_attributeno sensitive capabilitywoo_create_attribute_termno sensitive capabilitywoo_create_categoryno sensitive capabilitywoo_create_couponno sensitive capabilitywoo_create_customerno sensitive capabilitywoo_create_productno sensitive capabilitywoo_create_variationno sensitive capabilitywoo_delete_categoryno sensitive capabilitywoo_delete_couponno sensitive capabilitywoo_delete_productno sensitive capabilitywoo_delete_variationno sensitive capabilitywoo_get_couponno sensitive capabilitywoo_get_customerno sensitive capabilitywoo_get_customer_ordersno sensitive capabilitywoo_get_orderno sensitive capabilitywoo_get_order_notesno sensitive capabilitywoo_get_productno sensitive capabilitywoo_get_product_metano sensitive capabilitywoo_list_attribute_termsno sensitive capabilitywoo_list_attributesno sensitive capabilitywoo_list_categoriesno sensitive capabilitywoo_list_couponsno sensitive capabilitywoo_list_customersno sensitive capabilitywoo_list_ordersno sensitive capabilitywoo_list_productsno sensitive capabilitywoo_list_tagsno sensitive capabilitywoo_list_variationsno sensitive capabilitywoo_sales_reportno sensitive capabilitywoo_stock_reportno sensitive capabilitywoo_top_sellersno sensitive capabilitywoo_update_categoryno sensitive capabilitywoo_update_couponno sensitive capabilitywoo_update_customerno sensitive capabilitywoo_update_order_statusno sensitive capabilitywoo_update_productno sensitive capabilitywoo_update_product_metano sensitive capabilitywoo_update_variationno sensitive capabilitywp_activate_pluginno sensitive capabilitywp_activate_themeno sensitive capabilitywp_create_categoryno sensitive capabilitywp_create_pageno sensitive capabilitywp_create_postno sensitive capabilitywp_create_tagno sensitive capabilitywp_create_userno sensitive capabilitywp_deactivate_pluginno sensitive capabilitywp_delete_categoryno sensitive capabilitywp_delete_commentno sensitive capabilitywp_delete_mediano sensitive capabilitywp_delete_pageno sensitive capabilitywp_delete_pluginno sensitive capabilitywp_delete_postno sensitive capabilitywp_delete_tagno sensitive capabilitywp_delete_userno sensitive capabilitywp_get_active_themeno sensitive capabilitywp_get_commentno sensitive capabilitywp_get_mediano sensitive capabilitywp_get_namespacesno sensitive capabilitywp_get_pluginno sensitive capabilitywp_get_postno sensitive capabilitywp_get_settingsno sensitive capabilitywp_get_themeno sensitive capabilitywp_get_userno sensitive capabilitywp_list_categoriesno sensitive capabilitywp_list_commentsno sensitive capabilitywp_list_mediano sensitive capabilitywp_list_pagesno sensitive capabilitywp_list_pluginsno sensitive capabilitywp_list_postsno sensitive capabilitywp_list_tagsno sensitive capabilitywp_list_themesno sensitive capabilitywp_list_usersno sensitive capabilitywp_meno sensitive capabilitywp_moderate_commentsno sensitive capabilitywp_search_postsno sensitive capabilitywp_site_infono sensitive capabilitywp_update_categoryno sensitive capabilitywp_update_commentno sensitive capabilitywp_update_mediano sensitive capabilitywp_update_pageno sensitive capabilitywp_update_postno sensitive capabilitywp_update_settingsno sensitive capabilitywp_update_tagno sensitive capabilitywp_update_userno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v3.0.0 latest |
A 96/100 | 1 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @cavort-it-systems/wordpress-mcp --onlineOther implementations of Wordpress 15
Independent packages implementing the same tool, scanned with the same engine. Compare all 16 side by side →
MCP Server for WordPress REST API — connect AI agents to WordPress (posts, pages, media, users, custom post types, WooCommerce, Yoast / Rank Math, block themes, multisite, batch).
MCP server for WordPress REST API — manage posts, pages, media, comments, categories, tags, and users
MCP server for WordPress REST API — manage pages, posts, shortcodes and Elementor content from Claude Code.
MCP (Model Context Protocol) server for publishing and managing articles on WordPress sites
A plugin to integrate WordPress with Model Context Protocol (MCP), providing AI-accessible interfaces to WordPress data and functionality through standardized tools, resources, and prompts. Enables AI assistants to interact with posts, users, site setting
MCP server for WordPress integration
More in Content Management
Apify MCP Server
Model Context Protocol (MCP) Server for the *@inkeep/agents-mcp* API.
Medicare spending, chronic conditions, hospital quality, readmissions, and enrollment
Public read-only MCP for products, frameworks, guides, methodology, and blog metadata.
Community-maintained MCP server for Atlassian Confluence Data Center. Not affiliated with Atlassian.
MCP server for Contentful Content Management API integration