registry / Credential exfiltration / @respira/wordpress-mcp-server
@respira/wordpress-mcp-server
WordPress MCP server + companion plugin giving AI native access to page builder content, not just the REST API. 253 tools, 357 with WooCommerce, 19 page builders and the Site Editor. Element-level edits, full page creation, HTML to builder conversion, sna
This report shows the evidence for @respira/wordpress-mcp-server@8.6.4. 1 of 69 known versions is blocked or flagged. The newest version, 8.6.9, is allowed. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically forwards a connected site’s API credential to its fixed telemetry collector when the key has the supported site prefix. This is concrete credential disclosure without recipient-specific consent, so the package should be blocked.
Static reason
No blocking static signals were detected.
Trigger
An MCP tool call occurs while telemetry is enabled and the site has a `respira_site_` API key.
Impact
The collector receives a credential used to authenticate requests to the connected WordPress site, creating potential access beyond usage reporting.
Mechanism
The server registers the configured site key with the emitter. For this key prefix, the emitter uses the same key as a bearer for its telemetry request.
Attack narrative
The setup flow accepts a `respira_site_` API key, which the WordPress client uses for authenticated site requests. At runtime, the server registers that key for usage reporting; the emitter recognizes this prefix as a direct telemetry bearer and sends it to Respira’s collector on tool calls. The environment opt-out is not an affirmative consent gate, and the scoped-token path does not protect this prefix.
AI rationale
The package automatically forwards a connected site’s API credential to its fixed telemetry collector when the key has the supported site prefix. This is concrete credential disclosure without recipient-specific consent, so the package should be blocked.
Evidence
dist/setup.jsdist/wordpress-client.jsdist/server.jsdist/usage-emitter.js
Network endpoints1
www.respira.press/mcp-spend/track
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The setup wizard accepts `respira_site_` API keys, and the WordPress client uses the configured key for authenticated WordPress requests.
- The server registers that same key with the usage emitter, which records events after MCP tool calls.
- Unless opted out, the emitter treats `respira_site_` as a direct telemetry bearer and returns the registered site key for matching events.
- The emitter sends requests to Respira’s fixed usage collector with that bearer in the Authorization header.
- The code also supports scoped telemetry tokens, but the direct site-key path bypasses that safeguard.
Evidence against
- The collector is package-aligned, the code provides an environment opt-out, and it can use a scoped telemetry token; these do not gate the direct site-key path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcedist/install-skills.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const bundled_skills_dir = path.resolve(__dirname, '..', 'skills');
const c = {
reset: '\x1b[0m',
bold: '\x1b[1m',
dim: '\x1b[2m',
red: '\x1b[31m',
green: '\x1b[32m',
yellow: '\x1b[33m',
blue: '\x1b[34m',
cyan: '\x1b[36m',
};
function parseargs(argv) {
const opts = {
dest: path.join(os.homedir(), '.claude', 'skills'),
force: false,
help: false,
};
for (let i = 0; i < argv.length; i++) {
const arg = argv[i];
if (arg === '--help' || arg === '-h') {
opts.help = true;
}
else if (arg === '--force' || arg === '-f') {
opts.force = true;
}
else if (
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/install-skills.jsView on unpkgdist/chat-hygiene.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Findings
6 High2 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-skills.js
HighSemantic Analysis Limiteddist/chat-hygiene.js#virtual:normalized:round1
HighAi Review Evidencedist/setup.js
HighAi Review Evidencedist/wordpress-client.js
HighAi Review Evidencedist/server.js
HighAi Review Evidencedist/server.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @respira/wordpress-mcp-server@8.6.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @respira/wordpress-mcp-server@8.6.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.