BOSSCORE MCP PACK (bosserpnext/bosscore-mcp-pack) is an MCP server listed on the M8ven Trust Index. M8ven graded this before, but the code is no longer public at the location we read it, so we cannot re-check it. No publisher has claimed this listing.

—

Source no longer public

BOSSCORE MCP PACK

Item: BOSSCORE MCP PACK
Author: M8ven

Modular MCP capabilities package for the BOSS ecosystem, enabling WordPress site management, file reading, and cPanel deployment with 63 tools across three profiles (wordpress, files, full) and two transport modes (stdio and HTTP/SSE).

→ bosserpnext/bosscore-mcp-pack · listed on glama

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

bosserpnext

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 3 credentials: DEPLOY_TOKEN, BOSSCORE_MCP_OAUTH_CLIENT_SECRET, WORDPRESS_APP_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes62 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

wp_list_pages

List all WordPress pages

wp_get_page

Get a page by ID with content and meta

wp_create_page

Create a new WordPress page

wp_update_page

Update a page: title, content, status, or meta

wp_delete_page

Delete a page permanently

wp_list_posts

List WordPress blog posts

wp_get_post

Get a blog post by ID

wp_create_post

Create a new blog post

wp_update_post

Update a blog post

wp_delete_post

Delete a blog post permanently

wp_list_media

List media library items

wp_get_media

Get media item by ID with URLs

wp_upload_media

Upload media from a public URL

wp_update_media

Update media metadata (title, alt text, caption)

wp_delete_media

Delete a media item permanently

wp_list_users

List users (may require elevated permissions)

wp_get_user

Get user by ID

wp_get_user_me

Get current authenticated user info

wp_create_user

Create a new WordPress user

wp_update_user

Update a user (name, email, password, roles)

wp_delete_user

Delete a user, reassigning content to another user

wp_list_comments

List recent comments, optionally filtered by post

wp_create_comment

Create a new comment on a post

wp_update_comment

Moderate a comment (approve/trash/spam)

wp_list_categories

List all categories

wp_create_category

Create a new category

wp_update_category

Update a category name or description

wp_delete_category

Delete a category permanently

wp_list_tags

List all tags

wp_create_tag

Create a new tag

wp_list_menus

List navigation menus

wp_get_menu

Get a navigation menu by ID

wp_create_menu

Create a new navigation menu

wp_get_menu_items

Get items for a menu

wp_create_menu_item

Add item to a menu

wp_get_menu_locations

Get all menu locations and their assigned menus

wp_get_settings

Get site settings (title, description, timezone, etc.)

wp_update_settings

Update site settings

wp_get_site_info

Get WordPress site info: version, routes, namespaces

wp_list_blocks

List reusable blocks/patterns

wp_get_block

Get a reusable block by ID with content

wp_create_block

Create a reusable block

wp_update_block

Update a reusable block content

wp_search

Search posts, pages, and other content by query

wp_list_themes

List themes (active + available)

wp_astra_get_settings

Get all Astra theme settings (header, footer, colors, typography)

wp_astra_update_settings

Update Astra theme settings. Use merge=true (default) to merge, false to replace.

wp_astra_set_menu_location

Assign a menu to an Astra header/footer location

wp_astra_get_setting

Get a single Astra setting by key name (e.g. header-button1-text)

wp_astra_get_header_builder

Get the current header builder layout - slot assignments for desktop and mobile

wp_astra_set_header_item

Set component(s) in a header slot. e.g. area=desktop, section=primary, slot=primary_right, items=["button-1"]

wp_astra_configure_button

Batch-configure a header button: text, link, colors, radius, size.

wp_astra_configure_account

Configure the Astra account widget - shows login link when logged out, profile link when logged in.

wp_raw_request

Make any authenticated WP REST API request. endpoint=/wp/v2/pages or full URL

wp_get_rest_index

Get the WP REST API index (all available routes)

file_reader_read_file

Read any file: PDF, DOCX, PPTX, XLSX, images, audio, text, CSV, HTML, Markdown. Auto-detect format.

file_reader_read_image

Read an image file and return base64 data with MIME type

file_reader_convert_to_markdown

Convert any document (PDF, DOCX, PPTX, XLSX, HTML) to clean markdown text

file_reader_list_directory

List files and subdirectories in a directory

file_reader_get_file_info

Get metadata about a file (size, type, modified date)

file_reader_search_in_file

Search for a pattern in a file's content (supports PDF, DOCX, etc.)

boss_deploy

Deploie le code BOSS sur cPanel (git pull + rsync). repo: bosscore (plugin), telet (theme), ou all (les deux).

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configBOSSCORE_MCP_SERVER_URL

configBOSSCORE_MCP_ENFORCE_AUTHEn production, activer =1.

configBOSSCORE_MCP_PROFILE

configBOSSCORE_WORKSPACE$env: = "H:\...\companies"

🔐 secretDEPLOY_TOKEN$env: = "..."

configDEPLOY_URL

configBOSSCORE_MCP_STORE_DIR1. doit pointer vers un répertoire persistant et

configBOSSCORE_MCP_ALLOWED_ORIGINS

configBOSSCORE_MCP_ACCESS_TOKEN_TTL

configBOSSCORE_MCP_REFRESH_TOKEN_TTL

configBOSSCORE_MCP_AUTH_CODE_TTL

configBOSSCORE_MCP_OAUTH_STORE

configBOSSCORE_MCP_OAUTH_CLIENT_ID

🔐 secretBOSSCORE_MCP_OAUTH_CLIENT_SECRET

configBOSSCORE_MCP_OAUTH_REDIRECT_URIS

configBOSSCORE_MCP_OAUTH_SCOPES

configBOSSCORE_PLAN_STORE_LOCK_TIMEOUT

configBOSSCORE_DEPLOY_PLAN_TTL2. vaut 1800 secondes par défaut.

configWORDPRESS_URL$env: = "https://core.bosserpnext.com"

configBOSSCORE_EXEC_ALLOWED_PATHS

configBOSSCORE_EXEC_MAX_OUTPUT

configBOSSCORE_EXEC_TIMEOUT

configBOSSCORE_EXEC_PLAN_TTL

configBOSSCORE_FILE_ROOTS

configWORDPRESS_USERNAME$env: = "boss"

🔐 secretWORDPRESS_APP_PASSWORD$env: = "..."

configBOSSCORE_MAX_FILE_BYTES

configBOSSCORE_MAX_OUTPUT_CHARS

configOLLAMA_URL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

62/62 tools missing one or more hints — wp_list_pages (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); wp_get_page (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); wp_create_page (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

1 child_process call — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/bosserpnext/bosscore-mcp-pack)](https://m8ven.ai/mcp/bosserpnext/bosscore-mcp-pack)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: a29d781c1cdc3b4d5d7fd7687974e14ca1bcdf95

code hash: 18ac6912bc0313d0b5764eaba132d5bd5922d33e8938bf09457a195a1840712b

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client