@respira/wordpress-mcp-server@8.3.3
WordPress MCP server + companion plugin giving AI native access to page builder content, not just the REST API. 212 tools, 317 with WooCommerce, 17 page builders and the Site Editor. Element-level edits, full page creation, HTML to builder conversion, sna
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time or stealth behavior was found. The explicit user-command AI-agent configuration and skill installation capability warrants a warning under the stated policy.
Static reason
No blocking static signals were detected.
Trigger
User runs the setup CLI with --install-config and an install token, or runs respira-install-skills.
Impact
Adds or updates a Respira agent capability; a compromised vendor response or forced skill overwrite could affect future agent behavior.
Mechanism
Remote config retrieval and bundled AI-skill/config installation.
AI rationale
No concrete malicious install-time or stealth behavior was found. The explicit user-command AI-agent configuration and skill installation capability warrants a warning under the stated policy.
Evidence
package.jsondist/setup.jsdist/install-skills.jsdist/usage-emitter.js.cursor/mcp.json~/.codex/config.toml~/.claude.json~/.antigravity/mcp.json~/.claude/skills/<skill>/SKILL.md
Network endpoints2
www.respira.press/api/mcp/config/export-by-token?token=<install-token>www.respira.press/mcp-spend/track
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit --install-config fetches token-scoped remote config and writes it into a selected AI-client config.
- Explicit install-skills copies bundled SKILL.md content to ~/.claude/skills and can overwrite with --force.
- Runtime telemetry can POST bearer-authenticated usage metadata to Respira.
Evidence against
- package.json declares bins but no preinstall, install, postinstall, or prepare lifecycle hook.
- Client-config mutation requires --install-config, a supported client choice, and an install token.
- The config merge targets one named MCP-server entry; no broad config replacement was found.
- No source evidence of install-time execution, payload staging, destructive actions, or credential harvesting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
4 flagged · loading sourcedist/server.jsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/server.js:
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
writeFileSync(STATE_FILE_PATH, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
Follow these on every site. They are what separates a great result from a frustrating one, and most are one extra step, not one extra tool.
The Respira MCP is a single-person project actively under development. Real customers hit real bugs, and the fastest fix path is a structured report from the agent that watched it ...
5. **User says yes** → call \`respira_report_issue\` with a clear title (the symptom), brief (one paragraph of what happened), severity (blocker if the w
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/server.jsView on unpkgdist/install-skills.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
const bundled_skills_dir = path.resolve(__dirname, '..', 'skills');
const c = {
reset: '\x1b[0m',
bold: '\x1b[1m',
dim: '\x1b[2m',
red: '\x1b[31m',
green: '\x1b[32m',
yellow: '\x1b[33m',
blue: '\x1b[34m',
cyan: '\x1b[36m',
};
function parseargs(argv) {
const opts = {
dest: path.join(os.homedir(), '.claude', 'skills'),
force: false,
help: false,
};
for (let i = 0; i < argv.length; i++) {
const arg = argv[i];
if (arg === '--help' || arg === '-h') {
opts.help = true;
}
else if (arg === '--force' || arg === '-f') {
opts.force = true;
}
else if (
Findings
2 High4 Medium4 Low
HighEntrypoint Foreign Package Code Overwritedist/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-skills.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/setup.js
MediumAi Review Evidencedist/install-skills.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @respira/wordpress-mcp-server@8.3.3.
See all versions of @respira/wordpress-mcp-server for other recorded verdicts.
- Review the evidence and your use of @respira/wordpress-mcp-server@8.3.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.