54
grade D
3 days ago
glama
wp-mcp
A Model Context Protocol server that turns WordPress sites into AI-operable surfaces by exposing CRUD primitives for posts, users, comments, and settings. It supports both local STDIO and remote HTTP transports, allowing AI assistants to manage content and site configuration directly.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 3 credentials: DB_PASSWORD, REMOTE_PASSWORD, TEST_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
ALLOWED_ISSUER_HOSTNAMESconfig
CONFIG_SQLITE_DB_PATHconfig
DB_HOSTconfig
DB_NAME🔐 secret
DB_PASSWORDconfig
DB_PORTconfig
DB_USERconfig
DEFAULT_BLOG_IDconfig
DEFAULT_SITE_IDconfig
LOCAL_CONFIG— file <path> / -f <path> WordPress config manifest location Used by local start to point the init hook at a custom WP config JSON.config
LOCAL_USERNAME— "": "wp-admin"config
LOG_LEVELconfig
MULTISITEconfig
OAUTH_AUTHORIZATION_URL— Authorization server URL https://auth.example.com Sent to clients in error headers and used by the CLI when initializing device flows.config
OAUTH_ISSUER_URLconfig
OAUTH_REGISTRATION_URLconfig
OAUTH_RESOURCE_NAME— Display name for the protected resource Example WordPress MCP Returned in discovery metadata.config
OAUTH_RESOURCE_URL— Public URL of the protected resource https://mcp.example.com Included in OAuth resource metadata and DNS-rebinding protection checks.config
OAUTH_REVOCATION_URLconfig
OAUTH_SCOPES_SUPPORTED— Comma-separated scopes supported by the resource openid,offline_access,posts.read Advertised in discovery metadata and WWW-Authenticate headers.config
OAUTH_SERVICE_DOCUMENTATION_URL— Documentation link for the resource https://docs.example.com/mcp Returned in discovery metadata.config
OAUTH_TOKEN_URLconfig
PORTconfig
REMOTE_AUTH_TYPE— "": "oauth",config
REMOTE_CUSTOM_HEADERS🔐 secret
REMOTE_PASSWORDconfig
REMOTE_URL— "": "https://wp-mcp.example.com/mcp"config
REMOTE_USERNAME🔐 secret
TEST_API_KEYconfig
TEST_DB_HOSTconfig
TEST_DB_PORTconfig
TEST_ENABLEDconfig
WP_MCP_ENV_BASE_PATHconfig
WP_MCP_SECRET_DB_PATHconfig
WP_MCP_SECRET_ENV_FILE// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/rnaga-wp-mcp-1iefiv)commit: 66e65e375e205234ae4da8fa3095ae665c395df6
code hash: 9c4ef39f73cbb924578da34301e8d71cf3aadafcf58c146cddd3643e2228f192
verified: 4/18/2026, 6:28:28 PM