registry / mcp-wordpress / 3.3.16

mcp-wordpress@3.3.16

Comprehensive Model Context Protocol server for WordPress management with composition-based architecture, 59 tools, SEO toolkit, performance monitoring, intelligent caching, and production-ready authentication

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 245 file(s), 2.20 MB of source, external domains: api.example.com, api.github.com, demo.wordpress.com, developer.wordpress.org, developers.google.com, example.com, github.com, img.shields.io, opensource.org, schema.org, secure.gravatar.com

Source & flagged code

13 flagged

dist/security/SecurityReviewer.jsView file

Lines 6-46javascript

6import * as path from "path";

7import { SecurityUtils } from "./SecurityConfig.js";

8import { SecurityValidationError } from "./InputValidator.js";

9import { LoggerFactory } from "../utils/logger.js";

10/**

11 * Comprehensive security review rules

12 */

13const SECURITY_REVIEW_RULES = [

14 // Authentication Rules

15 {

16 id: "auth-001",

17 name: "Hardcoded Credentials",

18 description: "Detects hardcoded passwords, API keys, and secrets",

19 category: "authentication",

20 severity: "critical",

21 pattern: /(password|secret|key|token)\s*[:=]\s*['"][^'"]{8,}['"]/gi,

22 message: "Hardcoded credential detected",

23 recommendation: "Use environment variables or secure credential storage",

24 cweId: "CWE-798",

25 examples: {

26 vulnerable: `const password = "mysecretpassword123";`,

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/security/SecurityReviewer.jsView on unpkg · L26

27 secure: `const password = process.env.DB_PASSWORD;`,

28 },

29 },

30 {

31 id: "auth-002",

32 name: "Weak Password Policy",

33 description: "Detects weak password validation",

34 category: "authentication",

35 severity: "medium",

36 pattern: /password.*length.*[<>]\s*[1-7]\b/gi,

37 message: "Weak password length requirement",

38 recommendation: "Enforce minimum 8-character passwords with complexity requirements",

39 cweId: "CWE-521",

40 examples: {

41 vulnerable: `if (password.length < 6) return false;`,

42 secure: `if (password.length < 8 || !/(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)/.test(password)) return false;`,

43 },

44 },

45 {

46 id: "auth-003",

Lines 424-464javascript

424 return Math.max(0, 100 - normalizedPenalty);

425 }

426 /**

427 * Analyze code patterns

428 */

429 analyzePatterns(content) {

430 const positive = [];

431 const negative

bin/mcp-wordpress.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

3// NPX wrapper for MCP WordPress Server

4import path from "path";

5import { fileURLToPath } from "url";

7const __filename = fileURLToPath(import.meta.url);

dist/cache/HttpCacheWrapper.jsView file

Lines 24-64javascript

24 if (options.method.toUpperCase() !== "GET") {

25 return await requestFn();

26 }

27 const cacheKey = this.generateCacheKey(options);

28 const cachedEntry

dist/client/api.d.tsView file

Lines 15-55typescript

15 * categories, tags, and site settings with robust error handling and performance optimization.

16 *

17 * Features:

18 * - Multiple authentication methods (App Passwords, JWT, Basic Auth, API Key)

19 * - Automatic retry logic with exponential backoff

dist/client/api.jsView file

Lines 27-67javascript

27 * categories, tags, and site settings with robust error handling and performance optimization.

28 *

29 * Features:

30 * - Multiple authentication methods (App Passwords, JWT, Basic Auth, API Key)

31 * - Automatic retry logic with exponential backoff

docs/developer/RELEASE_PROCESS.mdView file

Lines 434-474markdown

434### BREAKING CHANGES

435

436- authentication configuration format has changed

437```

438

439### Migration Guides

440

441For breaking changes, create migration guides in `docs/developer/MIGRATION_GUIDE.md`:

442

443````markdown

444## Migrating from v1.x to v2.x

445

446### Authentication Configuration Changes

docs/api/tools/wp_switch_auth_method.mdView file

Lines 34-74markdown

34 "message": "wp_switch_auth_method executed successfully"

35}

36```

38**Error Example (Authentication failure):**

40```json

41{

42 "error": "Authentication failed",

43 "message": "Invalid credentials or insufficient permissions"

44}

45```

docs/api/tools/wp_create_user.mdView file

57patternName = generic_password severity = medium line = 57 matchedText = wp_creat...lue"

Medium

Secret Pattern

Hardcoded password in docs/api/tools/wp_create_user.md

docs/api/tools/wp_create_user.mdView on unpkg · L57

docs/SECURITY.mdView file

275patternName = generic_password severity = medium line = 275 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L275

276patternName = generic_password severity = medium line = 276 matchedText = const co..." };

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L276

src/security/SecurityReviewer.tsView file

88patternName = generic_password severity = medium line = 88 matchedText = vulnerab...";`,

Medium

Secret Pattern

Hardcoded password in src/security/SecurityReviewer.ts

src/security/SecurityReviewer.tsView on unpkg · L88

src/client/api.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = * pa...xxx'

Medium

Secret Pattern

Hardcoded password in src/client/api.ts

src/client/api.tsView on unpkg · L92

Source & flagged code

13 flagged · loading source

dist/security/SecurityReviewer.jsView file

26patternName = generic_password severity = medium line = 26 matchedText = vulnerab...";`,

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/security/SecurityReviewer.jsView on unpkg · L26

444if (/eval\s*\(/g.test(content)) L445: negative.push("Uses dangerous eval() function"); L446: if (/innerHTML.*\+/g.test(content))

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/SecurityReviewer.jsView on unpkg · L444

bin/mcp-wordpress.jsView file

11const mainModule = path.join(__dirname, "..", "dist", "index.js"); L12: import(mainModule);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mcp-wordpress.jsView on unpkg · L11

dist/cache/HttpCacheWrapper.jsView file

44return { L45: data: cachedEntry.value.data, L46: status: 200,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cache/HttpCacheWrapper.jsView on unpkg · L44

dist/client/api.d.tsView file

35patternName = generic_password severity = medium line = 35 matchedText = * pa...xxx'

Medium

Secret Pattern

Hardcoded password in dist/client/api.d.ts

dist/client/api.d.tsView on unpkg · L35

dist/client/api.jsView file

47patternName = generic_password severity = medium line = 47 matchedText = * pa...xxx'

Medium

Secret Pattern

Hardcoded password in dist/client/api.js

dist/client/api.jsView on unpkg · L47

docs/developer/RELEASE_PROCESS.mdView file

454patternName = generic_password severity = medium line = 454 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in docs/developer/RELEASE_PROCESS.md

docs/developer/RELEASE_PROCESS.mdView on unpkg · L454

docs/api/tools/wp_switch_auth_method.mdView file

54patternName = generic_password severity = medium line = 54 matchedText = wp_switc...lue"

Medium

Secret Pattern

Hardcoded password in docs/api/tools/wp_switch_auth_method.md

docs/api/tools/wp_switch_auth_method.mdView on unpkg · L54

docs/api/tools/wp_create_user.mdView file

57patternName = generic_password severity = medium line = 57 matchedText = wp_creat...lue"

Medium

Secret Pattern

Hardcoded password in docs/api/tools/wp_create_user.md

docs/api/tools/wp_create_user.mdView on unpkg · L57

docs/SECURITY.mdView file

275patternName = generic_password severity = medium line = 275 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L275

276patternName = generic_password severity = medium line = 276 matchedText = const co..." };

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L276

src/security/SecurityReviewer.tsView file

88patternName = generic_password severity = medium line = 88 matchedText = vulnerab...";`,

Medium

Secret Pattern

Hardcoded password in src/security/SecurityReviewer.ts

src/security/SecurityReviewer.tsView on unpkg · L88

src/client/api.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = * pa...xxx'

Medium

Secret Pattern

Hardcoded password in src/client/api.ts

src/client/api.tsView on unpkg · L92

Findings

14 Medium7 Low

MediumSecret Patterndist/security/SecurityReviewer.js

MediumDynamic Requirebin/mcp-wordpress.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/client/api.d.ts

MediumSecret Patterndist/client/api.js

MediumSecret Patterndocs/developer/RELEASE_PROCESS.md

MediumSecret Patterndocs/api/tools/wp_switch_auth_method.md

MediumSecret Patterndocs/api/tools/wp_create_user.md

MediumSecret Patterndocs/SECURITY.md

MediumSecret Patternsrc/security/SecurityReviewer.ts

MediumSecret Patternsrc/client/api.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/security/SecurityReviewer.js

LowWeak Cryptodist/cache/HttpCacheWrapper.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

13 flagged

dist/security/SecurityReviewer.jsView file

Lines 6-46javascript

6import * as path from "path";

7import { SecurityUtils } from "./SecurityConfig.js";

8import { SecurityValidationError } from "./InputValidator.js";

9import { LoggerFactory } from "../utils/logger.js";

10/**

11 * Comprehensive security review rules

12 */

13const SECURITY_REVIEW_RULES = [

14 // Authentication Rules

15 {

16 id: "auth-001",

17 name: "Hardcoded Credentials",

18 description: "Detects hardcoded passwords, API keys, and secrets",

19 category: "authentication",

20 severity: "critical",

21 pattern: /(password|secret|key|token)\s*[:=]\s*['"][^'"]{8,}['"]/gi,

22 message: "Hardcoded credential detected",

23 recommendation: "Use environment variables or secure credential storage",

24 cweId: "CWE-798",

25 examples: {

26 vulnerable: `const password = "mysecretpassword123";`,

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/security/SecurityReviewer.jsView on unpkg · L26

27 secure: `const password = process.env.DB_PASSWORD;`,

28 },

29 },

30 {

31 id: "auth-002",

32 name: "Weak Password Policy",

33 description: "Detects weak password validation",

34 category: "authentication",

35 severity: "medium",

36 pattern: /password.*length.*[<>]\s*[1-7]\b/gi,

37 message: "Weak password length requirement",

38 recommendation: "Enforce minimum 8-character passwords with complexity requirements",

39 cweId: "CWE-521",

40 examples: {

41 vulnerable: `if (password.length < 6) return false;`,

42 secure: `if (password.length < 8 || !/(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)/.test(password)) return false;`,

43 },

44 },

45 {

46 id: "auth-003",

Lines 424-464javascript

424 return Math.max(0, 100 - normalizedPenalty);

425 }

426 /**

427 * Analyze code patterns

428 */

429 analyzePatterns(content) {

430 const positive = [];

431 const negative

bin/mcp-wordpress.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

3// NPX wrapper for MCP WordPress Server

4import path from "path";

5import { fileURLToPath } from "url";

7const __filename = fileURLToPath(import.meta.url);

dist/cache/HttpCacheWrapper.jsView file

Lines 24-64javascript

24 if (options.method.toUpperCase() !== "GET") {

25 return await requestFn();

26 }

27 const cacheKey = this.generateCacheKey(options);

28 const cachedEntry

dist/client/api.d.tsView file

Lines 15-55typescript

15 * categories, tags, and site settings with robust error handling and performance optimization.

16 *

17 * Features:

18 * - Multiple authentication methods (App Passwords, JWT, Basic Auth, API Key)

19 * - Automatic retry logic with exponential backoff

dist/client/api.jsView file

Lines 27-67javascript

27 * categories, tags, and site settings with robust error handling and performance optimization.

28 *

29 * Features:

30 * - Multiple authentication methods (App Passwords, JWT, Basic Auth, API Key)

31 * - Automatic retry logic with exponential backoff

docs/developer/RELEASE_PROCESS.mdView file

Lines 434-474markdown

434### BREAKING CHANGES

435

436- authentication configuration format has changed

437```

438

439### Migration Guides

440

441For breaking changes, create migration guides in `docs/developer/MIGRATION_GUIDE.md`:

442

443````markdown

444## Migrating from v1.x to v2.x

445

446### Authentication Configuration Changes

docs/api/tools/wp_switch_auth_method.mdView file

Lines 34-74markdown

34 "message": "wp_switch_auth_method executed successfully"

35}

36```

38**Error Example (Authentication failure):**

40```json

41{

42 "error": "Authentication failed",

43 "message": "Invalid credentials or insufficient permissions"

44}

45```

docs/api/tools/wp_create_user.mdView file

57patternName = generic_password severity = medium line = 57 matchedText = wp_creat...lue"

Medium

Secret Pattern

Hardcoded password in docs/api/tools/wp_create_user.md

docs/api/tools/wp_create_user.mdView on unpkg · L57

docs/SECURITY.mdView file

275patternName = generic_password severity = medium line = 275 matchedText = const pa...rd";

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L275

276patternName = generic_password severity = medium line = 276 matchedText = const co..." };

Medium

Secret Pattern

Hardcoded password in docs/SECURITY.md

docs/SECURITY.mdView on unpkg · L276

src/security/SecurityReviewer.tsView file

88patternName = generic_password severity = medium line = 88 matchedText = vulnerab...";`,

Medium

Secret Pattern

Hardcoded password in src/security/SecurityReviewer.ts

src/security/SecurityReviewer.tsView on unpkg · L88

src/client/api.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = * pa...xxx'

Medium

Secret Pattern

Hardcoded password in src/client/api.ts

src/client/api.tsView on unpkg · L92