WPCafe MCP Server (xs-mahbub/wpcafe-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 53 tools. No publisher has claimed this listing.

D
Caution
58/100

WPCafe MCP Server

Connect any MCP-compatible AI assistant to your WordPress site running the WPCafe restaurant plugin. Once connected, your AI assistant can manage reservations, food orders, locations, QR codes, settings, analytics, and every other feature available in the WPCafe admin panel.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

xs-mahbub

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: WPCAFE_APP_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes53 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_dashboard_overview

Get a high-level overview of restaurant performance: total revenue, orders, reservations, and new customers for a date range.

get_dashboard_food_orders

Get a paginated list of food orders from the dashboard analytics view, optionally filtered by status and branch.

get_dashboard_reservations

Get a paginated list of reservations from the dashboard analytics view, optionally filtered by status and branch.

get_top_selling_products

Get the top selling food menu items for a given time period and branch. Useful for menu optimization and promotions.

list_extensions

List all WPCafe modules/extensions with their current on/off status. Includes both free modules (Reservation, Food Ordering, QR Code, Tipping, Mini Cart) and Pro modules (Delivery, Pickup, Discounts, Dine-In, Seat Plan, etc.).

toggle_extension

Enable or disable a WPCafe module by its slug. Affects which features are active on the site.

get_integrations

Get the status and configuration of WPCafe third-party integrations (WooCommerce, FluentCRM, Mailmint, WhatsApp, etc.).

get_addon_plugins

Get the list of available WPCafe addon plugins (Elementor Addons, Bricks Builder, Multivendor) and whether they are installed and active.

list_food_orders

List WooCommerce food orders managed by WPCafe. Returns order summaries including customer, items count, total, and status.

get_food_order

Get full details of a single food order including line items, billing/shipping address, totals, and customer notes.

update_food_order_status

Update the WooCommerce status of a food order (e.g. mark as processing, completed, cancelled).

delete_food_order

Move a food order to trash. The order is not permanently deleted — it can be restored from the WooCommerce orders screen.

update_dashboard_order_status

Update the status of an order directly from the dashboard analytics view (shortcut for the restaurant management panel).

list_locations

List all restaurant locations/branches configured in WPCafe.

get_location

Get details of a single restaurant location including address, coordinates, schedule, and capacity.

create_location

Create a new restaurant location/branch. Requires a name and location coordinates (lat/lng object).

update_location

Update an existing restaurant location. Only provide fields you want to change.

delete_location

Delete a single restaurant location by ID.

bulk_delete_locations

Delete multiple restaurant locations at once.

list_seat_plans

[WPCafe Pro] List visual seat plans / floor layouts for restaurant locations.

get_seat_plan

[WPCafe Pro] Get details of a specific seat plan including table positions, capacities, and shape data.

create_seat_plan

[WPCafe Pro] Create a new seat plan layout for a restaurant location.

update_seat_plan

[WPCafe Pro] Update an existing seat plan (rename or change canvas layout data).

delete_seat_plan

[WPCafe Pro] Delete a seat plan by ID.

list_discounts

[WPCafe Pro] List discount codes configured for food ordering.

get_discount

[WPCafe Pro] Get details of a single discount code including type, amount, usage limits, and expiry.

create_discount

[WPCafe Pro] Create a new discount code for food orders.

update_discount

[WPCafe Pro] Update an existing discount code.

delete_discount

[WPCafe Pro] Delete a discount code by ID.

list_receipt_layouts

[WPCafe Pro] List custom receipt/bill layouts created with the Receipt Layout Builder.

get_receipt

[WPCafe Pro] Get a generated receipt/bill for a specific order. Returns the receipt data or PDF download URL.

list_timed_products

[WPCafe Pro] List products with time-based availability rules (e.g. breakfast items only available 6am-11am).

create_timed_product

[WPCafe Pro] Create a time-availability rule for a product — restrict when it appears on the menu.

list_products

List WooCommerce food menu products managed by WPCafe. Supports filtering by category, location, search, and pagination.

get_product

Get full details of a single food menu product including price, description, categories, labels, images, and WooCommerce meta.

list_product_categories

List WooCommerce product categories used in the WPCafe food menu.

list_qrcodes

List all QR codes created in WPCafe. Each QR code links to a specific table or location for scan-to-order functionality.

get_qrcode

Get details of a single QR code including the image URL, linked table/location, and scan statistics.

create_qrcode

Create a new QR code for a table or location. The QR encodes a URL that customers scan to open the food ordering page.

update_qrcode

Update an existing QR code — rename it or change its linked table/location.

delete_qrcode

Delete a QR code by ID. Scanning the deleted QR code will no longer open the ordering page.

list_reservations

List table reservations with optional filters. Returns paginated results including guest info, date/time, status, and branch.

get_reservation

Get full details of a single reservation by its ID.

create_reservation

Create a new table reservation. Requires guest name, email, date, start_time, end_time, and total_guest. The booking price is calculated server-side.

update_reservation

Update an existing reservation. Only provide fields you want to change.

delete_reservation

Permanently delete a reservation by ID.

bulk_delete_reservations

Delete multiple reservations at once by providing an array of IDs.

cancel_reservation

Cancel a reservation using invoice number and guest email (public-facing cancellation, no admin login required).

get_reservation_time_slots

Get available reservation time slots for a date range. Used to show a calendar of open and blocked slots.

get_reservation_capacity

Check how many seats are available, booked, and total for a specific date/time slot.

get_settings

Get all WPCafe plugin settings. Requires administrator or shop manager role. Sensitive credentials (WhatsApp token, webhook URLs) are only returned for administrators with manage_options capability.

get_public_settings

Get public (non-sensitive) WPCafe settings. Safe to call without admin credentials. Returns reservation form config, colors, schedule, currency, and UI settings.

update_settings

Update one or more WPCafe settings. Only provide the keys you want to change — all other settings remain unchanged. Requires administrator role.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretWPCAFE_APP_PASSWORD"": "xxxx xxxx xxxx xxxx xxxx xxxx"
configWPCAFE_SITE_URL"": "https://yoursite.com",
configWPCAFE_USERNAME"": "your-admin-username",
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

53/53 tools missing one or more hints — get_dashboard_overview (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard_food_orders (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard_reservations (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +50 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

47/53 tool handlers declare input schemas (89%)

Declare an inputSchema with zod/joi/yup on every tool definition.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/xs-mahbub/wpcafe-mcp?variant=verified)](https://m8ven.ai/mcp/xs-mahbub/wpcafe-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: c715c59386ca306ae70727fe8e8345e4b9439a52
code hash: 9544a43c3903ed2b1732e8027cf35c879edde7e1ff848bb78ac9d910e306e998
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client