@respira/wordpress-mcp-server@8.3.4
WordPress MCP server + companion plugin giving AI native access to page builder content, not just the REST API. 213 tools, 318 with WooCommerce, 17 page builders and the Site Editor. Element-level edits, full page creation, HTML to builder conversion, sna
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malware or unconsented install-time mutation was found. The explicit agent-config and skill installation capabilities remain a meaningful guarded control-surface risk.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs --install-config with a client and install token, or invokes install-skills.
Impact
Adds package-supplied or remote behavior to an AI-agent control surface.
Mechanism
Remote MCP-config installation and local AI-skill deployment.
AI rationale
No concrete malware or unconsented install-time mutation was found. The explicit agent-config and skill installation capabilities remain a meaningful guarded control-surface risk.
Evidence
package.jsondist/setup.jsdist/install-skills.jsdist/server.jsSOUL.md~/.codex/config.toml~/.claude.json~/.antigravity/mcp.json.cursor/mcp.json~/.claude/skillsskills/*/SKILL.md
Network endpoints1
www.respira.press
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit setup fetches remote MCP configuration then writes it into AI-client config files.
- Explicit skill installer copies behavior-bearing SKILL.md files into Claude’s skills directory.
- Runtime loads package SOUL.md into MCP instructions, influencing connected agents.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Config mutation is gated by an explicit --install-config command, approved client name, and install token.
- Existing client config is parsed and only the selected MCP-server entry is merged.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcedist/server.jsView file
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/server.js:
import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
writeFileSync(STATE_FILE_PATH, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
Follow these on every site. They are what separates a great result from a frustrating one, and most are one extra step, not one extra tool.
The Respira MCP is a single-person project actively under development. Real customers hit real bugs, and the fastest fix path is a structured report from the agent that watched it ...
5. **User says yes** → call \`respira_report_issue\` with a clear title (the symptom), brief (one paragraph of what happened), severity (blocker if the w
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/server.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @respira/wordpress-mcp-server@8.3.3
matchedIdentity = npm:[redacted]:8.3.3
similarity = 0.909
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/server.jsView on unpkgFindings
3 High5 Medium4 Low
HighEntrypoint Foreign Package Code Overwritedist/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/install-skills.js
HighPrevious Version Dangerous Deltadist/server.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/setup.js
MediumAi Review Evidencedist/setup.js
MediumAi Review Evidencedist/install-skills.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @respira/wordpress-mcp-server@8.3.4.
See all versions of @respira/wordpress-mcp-server for other recorded verdicts.
- Review the evidence and your use of @respira/wordpress-mcp-server@8.3.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.