@respira/wordpress-mcp-server@8.3.24
WordPress MCP server + companion plugin giving AI native access to page builder content, not just the REST API. 228 tools, 333 with WooCommerce, 17 page builders and the Site Editor. Element-level edits, full page creation, HTML to builder conversion, sna
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not malicious under the inspected source, but it has an explicit user-command capability to install remotely supplied MCP configuration into agent control surfaces. Downgrade to a warning so the installer and remote configuration trust boundary receive scrutiny.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Run the setup command with --install-config, --client, and --install-token, or run the install-skills command.
Impact
A compromised or unexpected configuration service could cause a user-invoked installer to add or replace an MCP server entry.
Mechanism
Remote configuration fetch followed by AI-agent config or skill-file writes.
AI rationale
This is not malicious under the inspected source, but it has an explicit user-command capability to install remotely supplied MCP configuration into agent control surfaces. Downgrade to a warning so the installer and remote configuration trust boundary receive scrutiny.
Evidence
dist/setup.jsdist/install-skills.js.cursor/mcp.json.codex/config.toml.claude.json.antigravity/mcp.json.hermes/config.yaml.claude/skills
Network endpoints1
www.respira.press/api/mcp/config/export-by-token
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- An explicit setup command can download remote configuration and write an MCP entry into AI-agent configuration files.
- The remote payload controls the configured server name and content before the installer merges and writes it.
- The package also has an explicit command that copies bundled skill files into Claude's skills directory.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent configuration changes require --install-config plus a selected client and an install token.
- No source evidence showed secret harvesting, hidden execution, self-dependency, or automatic agent-config mutation during installation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedist/install-skills.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const bundled_skills_dir = path.resolve(__dirname, '..', 'skills');
const c = {
reset: '\x1b[0m',
bold: '\x1b[1m',
dim: '\x1b[2m',
red: '\x1b[31m',
green: '\x1b[32m',
yellow: '\x1b[33m',
blue: '\x1b[34m',
cyan: '\x1b[36m',
};
function parseargs(argv) {
const opts = {
dest: path.join(os.homedir(), '.claude', 'skills'),
force: false,
help: false,
};
for (let i = 0; i < argv.length; i++) {
const arg = argv[i];
if (arg === '--help' || arg === '-h') {
opts.help = true;
}
else if (arg === '--force' || arg === '-f') {
opts.force = true;
}
else if (
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/install-skills.jsView on unpkgdist/config.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
Findings
3 High5 Medium4 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-skills.js
HighSemantic Analysis Limiteddist/config.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/wordpress-client.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/setup.js
MediumAi Review Evidencedist/setup.js
MediumAi Review Evidencedist/setup.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @respira/wordpress-mcp-server@8.3.24.
See all versions of @respira/wordpress-mcp-server for other recorded verdicts.
- Review the evidence and your use of @respira/wordpress-mcp-server@8.3.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.