grade C

2 days ago

glama

MCP WordPress Server

Enables comprehensive WordPress site management through natural language in Claude Desktop, supporting multiple sites with 59 tools for content creation, media management, user administration, and performance monitoring.

→ docdyhr/mcp-wordpress · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 6 credentials: NPM_TOKEN, WORDPRESS_API_KEY, WORDPRESS_APP_PASSWORD, WORDPRESS_JWT_PASSWORD, WORDPRESS_JWT_SECRET, WORDPRESS_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configALLOW_PRIVATE_URLS

configBASELINE_FILE

configCACHE_DISABLED

configCACHE_MAX_ITEMS

configCACHE_MAX_MEMORY_MB

configCACHE_TTL

configCOVERAGE_MIN_BRANCHES

configCOVERAGE_MIN_FUNCTIONS

configCOVERAGE_MIN_LINES

configCOVERAGE_MIN_STATEMENTS

configCOVERAGE_PHASE

configCOVERAGE_STRICT

configCOVERAGE_TOLERANCE

configDISABLE_CACHE

configGITHUB_ACTIONS

configGITHUB_SHA

configJSON_OUTPUT

configLEGACY_ERROR_LOGS

configLOG_LEVEL

configMCP_UPLOAD_BASE_DIR

🔐 secretNPM_TOKEN

configPERFORMANCE_TEST

configPORT

configRATE_LIMIT

configRATE_LIMIT_ENABLED

configRATE_LIMIT_REQUESTS

configRATE_LIMIT_WINDOW

configSECURITY_STRICT_MODE

configSEO_BULK_OPERATION_SIZE

configSEO_CACHE_ANALYSIS_TTL

configSEO_CACHE_AUDIT_TTL

configSEO_CACHE_KEYWORDS_TTL

configSEO_CACHE_SCHEMA_TTL

configSEO_DESCRIPTION_MAX_LENGTH

configSEO_DESCRIPTION_MIN_LENGTH

configSEO_ENABLED

configSEO_MAX_CONCURRENT_ANALYSIS

configSEO_MAX_KEYWORD_DENSITY

configSEO_MIN_READABILITY_SCORE

configSEO_MIN_WORD_COUNT

configSEO_PROVIDER_AHREFS

configSEO_PROVIDER_DATAFORSEO

configSEO_PROVIDER_SEARCH_CONSOLE

configSEO_RATE_LIMIT_PER_MINUTE

configSEO_TARGET_KEYWORD_DENSITY

configSEO_TITLE_MAX_LENGTH

configSKIP_PACT_TESTS

configTRAVIS

🔐 secretWORDPRESS_API_KEY

🔐 secretWORDPRESS_APP_PASSWORD— xxxx xxxx xxxx xxxx xxxx xxxx

configWORDPRESS_APP_PASSWORD_2

configWORDPRESS_AUTH_METHOD— app-password

configWORDPRESS_COOKIE_NONCE

🔐 secretWORDPRESS_JWT_PASSWORD

🔐 secretWORDPRESS_JWT_SECRET

configWORDPRESS_MAX_RETRIES

🔐 secretWORDPRESS_PASSWORD— "": "user-password",

configWORDPRESS_SITE_URL— "": "https://myblog.com",

configWORDPRESS_SITE_URL_2

configWORDPRESS_TIMEOUT

configWORDPRESS_USERNAME— "": "admin",

configWORDPRESS_USERNAME_2

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/docdyhr-mcp-wordpress-tbiq6b)](https://m8ven.ai/mcp/docdyhr-mcp-wordpress-tbiq6b)

commit: 62e38b03191c89b6057dced30c65f2cf9a84d8b3

code hash: 78378f8efefee828ad29aef3ab98b2208c229fde9907840384d0c5db398faa6b

verified: 4/18/2026, 6:57:04 PM

view raw JSON →