WPCafe MCP Server (xs-mahbub/wpcafe-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 53 tools. No publisher has claimed this listing.
Connect any MCP-compatible AI assistant to your WordPress site running the WPCafe restaurant plugin. Once connected, your AI assistant can manage reservations, food orders, locations, QR codes, settings, analytics, and every other feature available in the WPCafe admin panel.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
xs-mahbub
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_dashboard_overviewGet a high-level overview of restaurant performance: total revenue, orders, reservations, and new customers for a date range.
get_dashboard_food_ordersGet a paginated list of food orders from the dashboard analytics view, optionally filtered by status and branch.
get_dashboard_reservationsGet a paginated list of reservations from the dashboard analytics view, optionally filtered by status and branch.
get_top_selling_productsGet the top selling food menu items for a given time period and branch. Useful for menu optimization and promotions.
list_extensionsList all WPCafe modules/extensions with their current on/off status. Includes both free modules (Reservation, Food Ordering, QR Code, Tipping, Mini Cart) and Pro modules (Delivery, Pickup, Discounts, Dine-In, Seat Plan, etc.).
toggle_extensionEnable or disable a WPCafe module by its slug. Affects which features are active on the site.
get_integrationsGet the status and configuration of WPCafe third-party integrations (WooCommerce, FluentCRM, Mailmint, WhatsApp, etc.).
get_addon_pluginsGet the list of available WPCafe addon plugins (Elementor Addons, Bricks Builder, Multivendor) and whether they are installed and active.
list_food_ordersList WooCommerce food orders managed by WPCafe. Returns order summaries including customer, items count, total, and status.
get_food_orderGet full details of a single food order including line items, billing/shipping address, totals, and customer notes.
update_food_order_statusUpdate the WooCommerce status of a food order (e.g. mark as processing, completed, cancelled).
delete_food_orderMove a food order to trash. The order is not permanently deleted — it can be restored from the WooCommerce orders screen.
update_dashboard_order_statusUpdate the status of an order directly from the dashboard analytics view (shortcut for the restaurant management panel).
list_locationsList all restaurant locations/branches configured in WPCafe.
get_locationGet details of a single restaurant location including address, coordinates, schedule, and capacity.
create_locationCreate a new restaurant location/branch. Requires a name and location coordinates (lat/lng object).
update_locationUpdate an existing restaurant location. Only provide fields you want to change.
delete_locationDelete a single restaurant location by ID.
bulk_delete_locationsDelete multiple restaurant locations at once.
list_seat_plans[WPCafe Pro] List visual seat plans / floor layouts for restaurant locations.
get_seat_plan[WPCafe Pro] Get details of a specific seat plan including table positions, capacities, and shape data.
create_seat_plan[WPCafe Pro] Create a new seat plan layout for a restaurant location.
update_seat_plan[WPCafe Pro] Update an existing seat plan (rename or change canvas layout data).
delete_seat_plan[WPCafe Pro] Delete a seat plan by ID.
list_discounts[WPCafe Pro] List discount codes configured for food ordering.
get_discount[WPCafe Pro] Get details of a single discount code including type, amount, usage limits, and expiry.
create_discount[WPCafe Pro] Create a new discount code for food orders.
update_discount[WPCafe Pro] Update an existing discount code.
delete_discount[WPCafe Pro] Delete a discount code by ID.
list_receipt_layouts[WPCafe Pro] List custom receipt/bill layouts created with the Receipt Layout Builder.
get_receipt[WPCafe Pro] Get a generated receipt/bill for a specific order. Returns the receipt data or PDF download URL.
list_timed_products[WPCafe Pro] List products with time-based availability rules (e.g. breakfast items only available 6am-11am).
create_timed_product[WPCafe Pro] Create a time-availability rule for a product — restrict when it appears on the menu.
list_productsList WooCommerce food menu products managed by WPCafe. Supports filtering by category, location, search, and pagination.
get_productGet full details of a single food menu product including price, description, categories, labels, images, and WooCommerce meta.
list_product_categoriesList WooCommerce product categories used in the WPCafe food menu.
list_qrcodesList all QR codes created in WPCafe. Each QR code links to a specific table or location for scan-to-order functionality.
get_qrcodeGet details of a single QR code including the image URL, linked table/location, and scan statistics.
create_qrcodeCreate a new QR code for a table or location. The QR encodes a URL that customers scan to open the food ordering page.
update_qrcodeUpdate an existing QR code — rename it or change its linked table/location.
delete_qrcodeDelete a QR code by ID. Scanning the deleted QR code will no longer open the ordering page.
list_reservationsList table reservations with optional filters. Returns paginated results including guest info, date/time, status, and branch.
get_reservationGet full details of a single reservation by its ID.
create_reservationCreate a new table reservation. Requires guest name, email, date, start_time, end_time, and total_guest. The booking price is calculated server-side.
update_reservationUpdate an existing reservation. Only provide fields you want to change.
delete_reservationPermanently delete a reservation by ID.
bulk_delete_reservationsDelete multiple reservations at once by providing an array of IDs.
cancel_reservationCancel a reservation using invoice number and guest email (public-facing cancellation, no admin login required).
get_reservation_time_slotsGet available reservation time slots for a date range. Used to show a calendar of open and blocked slots.
get_reservation_capacityCheck how many seats are available, booked, and total for a specific date/time slot.
get_settingsGet all WPCafe plugin settings. Requires administrator or shop manager role. Sensitive credentials (WhatsApp token, webhook URLs) are only returned for administrators with manage_options capability.
get_public_settingsGet public (non-sensitive) WPCafe settings. Safe to call without admin credentials. Returns reservation form config, colors, schedule, currency, and UI settings.
update_settingsUpdate one or more WPCafe settings. Only provide the keys you want to change — all other settings remain unchanged. Requires administrator role.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
WPCAFE_APP_PASSWORD"": "xxxx xxxx xxxx xxxx xxxx xxxx"WPCAFE_SITE_URL"": "https://yoursite.com",WPCAFE_USERNAME"": "your-admin-username",Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
53/53 tools missing one or more hints — get_dashboard_overview (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard_food_orders (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard_reservations (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +50 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
47/53 tool handlers declare input schemas (89%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/xs-mahbub/wpcafe-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check