registry / @respira/wordpress-mcp-server / 7.5.3

@respira/wordpress-mcp-server@7.5.3

200+ MCP tools for WordPress (275+ with the WooCommerce and ACF add-ons) across 16 page builders. Native page-builder access, context-aware tool filtering, and an agent persona loaded into every handshake. v7.1 'Roots': four new builders (Spectra, Kadence

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `--install-config` or `install-skills`; telemetry runs after MCP server startup and tool calls.

Impact

A remote service controls the MCP entry installed under the Respira server name; installed skills can influence future agent sessions, and telemetry discloses tool/site metadata.

Mechanism

Explicit AI-agent configuration/skill installation plus authenticated usage telemetry.

Rationale

No concrete malicious install-time or stealth execution chain was found. The package nevertheless has explicit-user-command AI-agent configuration mutation and persistent skill installation, so it merits a warning rather than a clean firewall verdict.

Evidence

package.jsondist/setup.jsdist/install-skills.jsdist/usage-emitter.jsskills/migrate-divi-to-bricks/SKILL.mdskills/wordpress-site-dna/telemetry.ts~/.codex/config.toml~/.claude.json~/.claude/skills<cwd>/.cursor/mcp.json~/.antigravity/mcp.json

Network endpoints3

@respira/wordpress-mcp-server@7.5.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code