registry / @seomi/wp-mcp / 0.2.0

@seomi/wp-mcp@0.2.0

Universal installer for SEOMI MCP Abilities — wires WordPress projects to AI agents in one command (mu-plugin, MCP servers, Abilities API, MCP Adapter, ai-factory skill).

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User runs `seomi-wp-mcp init`, `update`, or `doctor --fix` and selects applicable options.

Impact

Configured agents can access the chosen WordPress target and perform enabled Metrika management operations.

Mechanism

Explicit project MCP/agent setup with optional SSH and analytics write capability.

Rationale

No concrete malicious chain was found, but the package deliberately provisions agent-accessible WordPress and analytics capabilities. Per policy, explicit user-command agent configuration remains a warn-level capability risk.

Evidence

package.jsonbin/seomi-wp-mcp.mjssrc/commands/init.mjssrc/lib/claude-mcp.mjssrc/lib/metrika-setup.mjsmcp-servers/yandex-metrika/src/seomi_metrika/client.py.claude/.env.mcp.jsonAGENTS.mdCLAUDE.md.claude/mcp-servers/yandex-metrika/wp-content/mu-plugins/

Network endpoints3

github.com/Mikeekb/wp-mcp-abilities.git

@seomi/wp-mcp@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code