Wordpress (cmsmcp) MCP Server
@cmsmcp/wordpress
npm
v0.3.2
Published by @cmsmcp — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
MCP server for WordPress — full REST API v2 coverage with 80+ tools
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 5 = 95. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([wp_get_page, wp_create_full_post, wp_get_url_details, wp_list_font_collections]) co-exist with external-action tools ([wp_create_comment, wp_list_webhook_events, wp_get_webhook_event, wp_clear_webhook_events, wp_get_webhook_url]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [wp_get_page, wp_create_full_post, wp_get_url_details, wp_list_font_collections] → sinks [wp_create_comment, wp_list_webhook_events, wp_get_webhook_ev
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow wp_get_page → wp_create_comment
Tools 169
Each tool and what it can reach — statically extracted from the published source.
wp_clear_webhook_eventsnetwork egresswp_create_commentnetwork egresswp_create_full_postingests untrusted inputwp_get_pageingests untrusted inputwp_get_url_detailsingests untrusted inputwp_get_webhook_eventnetwork egresswp_get_webhook_urlnetwork egresswp_list_font_collectionsingests untrusted inputwp_list_webhook_eventsnetwork egresswp_build_block_contentno sensitive capability
Show 159 more tools ↓
wp_bulk_update_postsno sensitive capabilitywp_clone_postno sensitive capabilitywp_component_contactno sensitive capabilitywp_component_ctano sensitive capabilitywp_component_faqno sensitive capabilitywp_component_featuresno sensitive capabilitywp_component_herono sensitive capabilitywp_component_pricingno sensitive capabilitywp_component_statsno sensitive capabilitywp_component_teamno sensitive capabilitywp_component_testimonialsno sensitive capabilitywp_create_app_passwordno sensitive capabilitywp_create_blockno sensitive capabilitywp_create_block_postno sensitive capabilitywp_create_categoryno sensitive capabilitywp_create_custom_postno sensitive capabilitywp_create_font_faceno sensitive capabilitywp_create_font_familyno sensitive capabilitywp_create_full_pageno sensitive capabilitywp_create_landing_pageno sensitive capabilitywp_create_menuno sensitive capabilitywp_create_menu_itemno sensitive capabilitywp_create_navigationno sensitive capabilitywp_create_pageno sensitive capabilitywp_create_pattern_categoryno sensitive capabilitywp_create_postno sensitive capabilitywp_create_tagno sensitive capabilitywp_create_templateno sensitive capabilitywp_create_template_partno sensitive capabilitywp_create_userno sensitive capabilitywp_create_widgetno sensitive capabilitywp_delete_app_passwordno sensitive capabilitywp_delete_blockno sensitive capabilitywp_delete_categoryno sensitive capabilitywp_delete_commentno sensitive capabilitywp_delete_custom_postno sensitive capabilitywp_delete_font_faceno sensitive capabilitywp_delete_font_familyno sensitive capabilitywp_delete_mediano sensitive capabilitywp_delete_menuno sensitive capabilitywp_delete_menu_itemno sensitive capabilitywp_delete_navigationno sensitive capabilitywp_delete_pageno sensitive capabilitywp_delete_pattern_categoryno sensitive capabilitywp_delete_pluginno sensitive capabilitywp_delete_postno sensitive capabilitywp_delete_revisionno sensitive capabilitywp_delete_tagno sensitive capabilitywp_delete_templateno sensitive capabilitywp_delete_template_partno sensitive capabilitywp_delete_template_revisionno sensitive capabilitywp_delete_userno sensitive capabilitywp_delete_widgetno sensitive capabilitywp_detect_page_builderno sensitive capabilitywp_export_contentno sensitive capabilitywp_export_siteno sensitive capabilitywp_get_acf_fieldsno sensitive capabilitywp_get_blockno sensitive capabilitywp_get_block_typeno sensitive capabilitywp_get_categoryno sensitive capabilitywp_get_commentno sensitive capabilitywp_get_custom_postno sensitive capabilitywp_get_font_collectionno sensitive capabilitywp_get_font_faceno sensitive capabilitywp_get_font_familyno sensitive capabilitywp_get_global_stylesno sensitive capabilitywp_get_meno sensitive capabilitywp_get_mediano sensitive capabilitywp_get_menuno sensitive capabilitywp_get_menu_itemno sensitive capabilitywp_get_menu_locationno sensitive capabilitywp_get_navigationno sensitive capabilitywp_get_navigation_fallbackno sensitive capabilitywp_get_pattern_categoryno sensitive capabilitywp_get_pluginno sensitive capabilitywp_get_postno sensitive capabilitywp_get_post_statusno sensitive capabilitywp_get_post_typeno sensitive capabilitywp_get_revisionno sensitive capabilitywp_get_settingsno sensitive capabilitywp_get_sidebarno sensitive capabilitywp_get_site_healthno sensitive capabilitywp_get_tagno sensitive capabilitywp_get_taxonomyno sensitive capabilitywp_get_templateno sensitive capabilitywp_get_template_partno sensitive capabilitywp_get_template_revisionno sensitive capabilitywp_get_themeno sensitive capabilitywp_get_theme_global_stylesno sensitive capabilitywp_get_userno sensitive capabilitywp_get_widgetno sensitive capabilitywp_get_widget_typeno sensitive capabilitywp_get_yoast_seono sensitive capabilitywp_install_pluginno sensitive capabilitywp_list_acf_field_groupsno sensitive capabilitywp_list_app_passwordsno sensitive capabilitywp_list_block_pattern_categoriesno sensitive capabilitywp_list_block_patternsno sensitive capabilitywp_list_block_typesno sensitive capabilitywp_list_blocksno sensitive capabilitywp_list_categoriesno sensitive capabilitywp_list_commentsno sensitive capabilitywp_list_custom_postsno sensitive capabilitywp_list_font_facesno sensitive capabilitywp_list_font_familiesno sensitive capabilitywp_list_global_style_variationsno sensitive capabilitywp_list_mediano sensitive capabilitywp_list_menu_itemsno sensitive capabilitywp_list_menu_locationsno sensitive capabilitywp_list_menusno sensitive capabilitywp_list_navigationsno sensitive capabilitywp_list_pagesno sensitive capabilitywp_list_pattern_categoriesno sensitive capabilitywp_list_pluginsno sensitive capabilitywp_list_post_statusesno sensitive capabilitywp_list_post_typesno sensitive capabilitywp_list_postsno sensitive capabilitywp_list_revisionsno sensitive capabilitywp_list_sidebarsno sensitive capabilitywp_list_tagsno sensitive capabilitywp_list_taxonomiesno sensitive capabilitywp_list_template_partsno sensitive capabilitywp_list_template_revisionsno sensitive capabilitywp_list_templatesno sensitive capabilitywp_list_themesno sensitive capabilitywp_list_usersno sensitive capabilitywp_list_widget_typesno sensitive capabilitywp_list_widgetsno sensitive capabilitywp_render_blockno sensitive capabilitywp_render_widget_typeno sensitive capabilitywp_save_component_as_patternno sensitive capabilitywp_searchno sensitive capabilitywp_search_block_directoryno sensitive capabilitywp_search_pattern_directoryno sensitive capabilitywp_setup_menuno sensitive capabilitywp_site_auditno sensitive capabilitywp_update_acf_fieldsno sensitive capabilitywp_update_blockno sensitive capabilitywp_update_categoryno sensitive capabilitywp_update_commentno sensitive capabilitywp_update_custom_postno sensitive capabilitywp_update_global_stylesno sensitive capabilitywp_update_mediano sensitive capabilitywp_update_menuno sensitive capabilitywp_update_menu_itemno sensitive capabilitywp_update_navigationno sensitive capabilitywp_update_pageno sensitive capabilitywp_update_pattern_categoryno sensitive capabilitywp_update_pluginno sensitive capabilitywp_update_postno sensitive capabilitywp_update_settingsno sensitive capabilitywp_update_sidebarno sensitive capabilitywp_update_tagno sensitive capabilitywp_update_templateno sensitive capabilitywp_update_template_partno sensitive capabilitywp_update_userno sensitive capabilitywp_update_widgetno sensitive capabilitywp_update_yoast_seono sensitive capabilitywp_upload_mediano sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (169 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.3.2 latest |
A 95/100 | 1 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @cmsmcp/wordpress --onlineOther implementations of Wordpress 15
Independent packages implementing the same tool, scanned with the same engine. Compare all 16 side by side →
MCP Server for WordPress REST API — connect AI agents to WordPress (posts, pages, media, users, custom post types, WooCommerce, Yoast / Rank Math, block themes, multisite, batch).
MCP server for WordPress REST API — manage posts, pages, media, comments, categories, tags, and users
MCP server for WordPress REST API — manage pages, posts, shortcodes and Elementor content from Claude Code.
MCP (Model Context Protocol) server for publishing and managing articles on WordPress sites
A plugin to integrate WordPress with Model Context Protocol (MCP), providing AI-accessible interfaces to WordPress data and functionality through standardized tools, resources, and prompts. Enables AI assistants to interact with posts, users, site setting
MCP server for WordPress integration
More in API Development
Adapters for the FrontMCP framework
Transcend MCP Server — Admin tools.
Transcend MCP Server — Assessments tools.
MCP Server for Bling
MCP Server for Blogger API
Official MCP server for Brilliant Directories — manage members, posts, leads, reviews, and more.