registry / @respira/wordpress-mcp-server / 7.4.1

@respira/wordpress-mcp-server@7.4.1

200+ MCP tools for WordPress (275+ with the WooCommerce and ACF add-ons) across 16 page builders. Native page-builder access, context-aware tool filtering, and an agent persona loaded into every handshake. v7.1 'Roots': four new builders (Spectra, Kadence

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `--install-config` or the `install-skills` bin; telemetry occurs during MCP tool use.

Impact

Can modify selected agent configuration and send documented usage metadata to Respira.

Mechanism

Explicit AI-agent configuration/skill installation plus package telemetry.

Rationale

This is not malicious by source inspection, but explicit AI-agent configuration mutation and bundled skill installation warrant a warning under the firewall policy. The mutations are user-triggered and scoped to Respira entries, not npm lifecycle-driven.

Evidence

package.jsondist/setup.jsdist/install-skills.jsdist/usage-emitter.jsskills/mobile-experience-report/telemetry.tsSOUL.md

Network endpoints3

www.respira.press/api/mcp/config/export-by-token?token=<install-token>www.respira.press/mcp-spend/trackwww.respira.press/api/skills/track-usage

@respira/wordpress-mcp-server@7.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code