Skills/npm/wordpress-mcp-server

wordpress-mcp-server@8.7.7

CAUTION· startup only

Publisher claims: "WordPress MCP server + companion plugin giving AI native access to page builder content, not just the REST API. 283 tools, 387 with WooCommerce, 19 page builders and the Site Editor. Element-level edits, full page creation, HTML to builder conversion, sna" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher respira · publishing for 357 daysInstalls 15,377Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
RESPIRA_API_KEYRESPIRA_USAGE_TOKENWORDPRESS_API_KEY or --wordpress-api-key / --install-tokenConfiguration, not credentials: AI_AGENT_CLIENT, AI_AGENT_VERSION, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_VERSION, CLAUDE_VERSION, CLAUDECODE, CODEIUM_ENV, CODEIUM_VERSION, CODEX_VERSION, CURSOR_AGENT, CURSOR_TRACE_ID, CURSOR_VERSION, MAX_PATH_LENGTH, MCP_AGENT_CLIENT, MCP_AGENT_VERSION, NODE_EXTRA_CA_CERTS, OTEL_EXPORTER_OTLP_HEADERS, RESPIRA_AGENT_CLIENT, RESPIRA_AGENT_TRANSPORT, RESPIRA_AGENT_VERSION, RESPIRA_API_BASE, RESPIRA_CONFIG_B64, RESPIRA_CONFIG_FILE, RESPIRA_CONFIG_MODE, RESPIRA_CONNECTION_SOURCE, RESPIRA_CUSTOM_CA_PATH, RESPIRA_DISABLE_STARTUP_WATCHDOG, RESPIRA_MCP_DISABLE_UPDATE_CHECK, RESPIRA_PLAN_NOTE, RESPIRA_SITES, RESPIRA_STARTUP_BUDGET_MS, RESPIRA_STRICT_CONFIG, RESPIRA_TLS_INSECURE, RESPIRA_URL, RESPIRA_USAGE_OPT_OUT, RESPIRA_WEBSITE_URL, TERM_PROGRAM
Where it talks to
respira.press (its own)Also x.com, yoursite.com, nodejs.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names x.com, yoursite.com, nodejs.org as well as its own vendor. The guard injects RESPIRA_API_KEY, RESPIRA_USAGE_TOKEN, WORDPRESS_API_KEY only into requests to respira.press (and its subdomains) and refuses the rest.

$vet-skills run --secrets RESPIRA_API_KEY=respira.press,RESPIRA_USAGE_TOKEN=respira.press,WORDPRESS_API_KEY=respira.press -- npx -y @respira/wordpress-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials; Hidden zero-width characters detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 32 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sfilesystemwrote ~/.respira/last-startup-error.txt
31sclaimedstartup only: exited (0) before answering · at Hooks.resolve (node:internal/modules/esm/hooks:240:30) at MessagePort.handleMessage (node:internal/modules/esm/worker:199:24) at [nodejs.internal.kHybridDispatch] (node:internal/event_target:843:20) at MessagePort.<anonymous> (node:internal/per_context/messageport:23:28)
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run

Static findings

CRITICAL
Prompting user to enter sensitive credentialsdist/setup.js:263 · Prompting user to enter sensitive credentials — social engineeringprint(' enter the credentials below. Leave blank if no server password is needed.', c.dim);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
npx invocation of non-well-known packagedist/config.d.ts:216 · npx invocation of non-well-known package — may execute untrusted code* 72496 Claude.app/Contents/Helpers/disclaimer .../npx -y @respira/...Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detecteddist/config.js:443 · Hidden zero-width characters detected — may conceal content// v6.11.11: Strip a UTF-8 BOM ("") off the start of a config payloadFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Process kill commanddist/config.js:611 · Process kill command — agent can terminate processes// expected on a first Cowork chat and must not kill the server. BootFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detecteddist/chat-hygiene.js:23 · Hidden zero-width characters detected — may conceal contentconst JUNK_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packagedist/index.js:12 · npx invocation of non-well-known package — may execute untrusted code* Also handle npx cache corruption with a recovery message instead of a stacktrace.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detecteddist/code-policy.js:73 · Hidden zero-width characters detected — may conceal contentlet s = src.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detecteddist/chat-hygiene.js:216 · Hidden zero-width characters detected — may conceal contentconst text = raw.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:1228 · Collapsed <details> block carrying instructions<summary><b>Tools not showing</b></summary> 1. Restart your AI tool completely 2. Validate JSON syntax in config file 3. Check config file location 4. Run `npx Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:1190 · Collapsed <details> block carrying instructions<summary><b>Connection failed</b></summary> 1. Check API key: WordPress > Respira > API Keys 2. URL must include `https://` 3. Plugin must be activated 4. CheckFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/config.js:765 · npx invocation of non-well-known package — may execute untrusted code* an older npx entry that kept winning, and a licence lapse that left the keysFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/config.d.ts:167 · npx invocation of non-well-known package — may execute untrusted code* the .mcpb desktop bundle while an older npx entry stayed in his clientFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/index.js:18 · npx invocation of non-well-known package — may execute untrusted code* non-fatal exception (i.e. not EPIPE, not npx cache corruption) is loggedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/code-policy.js:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// The secret check comes before the hidden-file rule so .env says what it is.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/code-tools.js:141 · Process kill command — agent can terminate processes…site before building on it: what this key may do (developer scopes, expiry, the kill switch, the entitlement), the host facts (PHP version, whether file changes, mu-…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/index.js:38 · npx invocation of non-well-known package — may execute untrusted code// A broken npm/npx install (missing file or package inside node_modulesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/code-tools.js:86 · Process kill command — agent can terminate processes…te with the release that serves, the previous release, failures and whether the kill switch is on. With slug, one app with all its releases and failure records, incl…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/config.d.ts:214 · MCP server using network transport (SSE/HTTP) — data sent over network* @respira/wordpress-mcp-server@latest` entry produces three processes:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commanddist/code-tools.js:147 · Process kill command — agent can terminate processes…en it does not: Developer mode off, setup not finished, not armed, expired, the kill switch on, or the entitlement lapsed. Arming lasts 24 hours and is the site owne…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detecteddist/skill-prompts.js:35 · Hidden zero-width characters detected — may conceal contentlet body = markdown.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detecteddist/config.js:445 · Hidden zero-width characters detected — may conceal content// silently writes a BOM, and JSON.parse rejects with "Unexpected token "Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packagedist/config.js:939 · npx invocation of non-well-known package — may execute untrusted codeevidence.push(`launch path sits inside the npx one-off cache (${path})`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/index.js:23 · npx invocation of non-well-known package — may execute untrusted code* and npx cache corruption (broken install) still exit because there'sFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detecteddist/chat-hygiene.js:254 · Hidden zero-width characters detected — may conceal contentconst text = raw.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packagedist/config.d.ts:240 · npx invocation of non-well-known package — may execute untrusted code* the same user. If they were launched different ways (a bundle and an npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/code-tools.js:602 · Process kill command — agent can terminate processesconst why = s.killed ? 'The kill switch is on.' : !s.wizard_done ? 'The owner has not finished the setup.' : !s.enabled ? 'Developer mode is off.' : !held.length ? 'This key is not armed.' : '';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/config.d.ts:213 · npx invocation of non-well-known package — may execute untrusted code* Measured on a real Claude Desktop machine, ONE `npx -yFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/code-policy.js:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files[/^\.env(\..*)?$/i, 'looks like an environment file with secrets'],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/config.js:908 · npx invocation of non-well-known package — may execute untrusted codenpx_cache: 'npx one-off run from the npm cache',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/config.js:942 · npx invocation of non-well-known package — may execute untrusted code// The npx launcher chain. One `npx -y @respira/...` entry in a client configFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/code-tools.js:563 · Process kill command — agent can terminate processesverdicts.push('The kill switch is on. Apps are off until the owner switches them back on in wp-admin.');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/config.js:986 · MCP server using network transport (SSE/HTTP) — data sent over network* @respira/wordpress-mcp-server@latest` entry produces three processes:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/index.js:200 · npx invocation of non-well-known package — may execute untrusted code// A broken npm/npx install (ERR_MODULE_NOT_FOUND inside _npx orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/startup-failure.js:232 · File type combined with upload action — agent may exfiltrate local data files* last-startup-error.txt, report (rate limited by beforeSend), and exit 1 so theFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/startup-failure.js:5 · npx invocation of non-well-known package — may execute untrusted code* cache that was only half unpacked (npx killed mid-install by a host timeout,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skills --dest ./.claude/skillsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:309 · npx invocation of non-well-known package — may execute untrusted codeprint(' npx add-mcp "npx -y @respira/wordpress-mcp-server@latest"', c.green);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/transports/stdio.js:8 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server --stdio --wp-path=/path/to/wordpress --user=adminFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/yoast-tools.js:110 · File type combined with upload action — agent may exfiltrate local data filesregenerate_llms_txt: { type: 'boolean', description: 'Rewrite llms.txt now, for example after changing cornerstone posts.' },Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/install-skills.d.ts:11 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skills --forceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/config.d.ts:270 · Unpinned dependency* `npm i -g @respira/wordpress-mcp-server@latest` unconditionally. On a ClaudeFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.d.ts:257 · npx invocation of non-well-known package — may execute untrusted code* A bundle installed beside an older npx entry kept losing to it for threeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/install-skills.js:161 · Unpinned dependencyconsole.error(` npm install -g @respira/wordpress-mcp-server@latest`);Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skillsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/config.js:1170 · Unpinned dependencyupgrade_command: 'npm i -g @respira/wordpress-mcp-server@latest',Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
File type combined with upload actiondist/yoast-tools.js:85 · File type combined with upload action — agent may exfiltrate local data files…date and attachment archives on or off, breadcrumbs). Also the state of the llms.txt file and the authors with published posts and whether each is noindex. Every key is one update_yoast_settings takes. Lis…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:76 · npx invocation of non-well-known package — may execute untrusted codenpx @respira/wordpress-mcp-server install-skills [options]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.d.ts:9 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skillsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skills --forceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/startup-failure.js:2 · npx invocation of non-well-known package — may execute untrusted code* Startup failure handling for a broken npm / npx install.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code* Or: npx @respira/wordpress-mcp-server --setupFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.d.ts:10 · npx invocation of non-well-known package — may execute untrusted code* npx @respira/wordpress-mcp-server install-skills --dest ./.claude/skillsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/startup-failure.js:85 · npx invocation of non-well-known package — may execute untrusted code* Classify an error as a broken npm / npx install. Returns null for anythingFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/startup-failure.js:4 · npx invocation of non-well-known package — may execute untrusted code* Why this exists (Sentry RESPIRA-MCP-SERVER-B and -E, 2026-11-04): an npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:349 · npx invocation of non-well-known package — may execute untrusted codenpx @respira/wordpress-mcp-server Start MCP serverFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languageREADME.md:764 · Authorization escalation language · informational: not an instruction file…ocksy does not offer is refused with close names | ### Respira Code (8 tools) Developer Mode for Respira: apps, deploys and guarded SQL, from the Respira Code add-on (plugi…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageREADME.md:775 · Authorization escalation language · informational: not an instruction file| `respira_code_status` | Whether the key holds developer access, when it ends, and why not |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Unpinned dependencydist/config.js:1178 · Unpinned dependencyupgrade_command: 'npm i @respira/wordpress-mcp-server@latest',Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Prompt injectionREADME.md:764 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…ocksy does not offer is refused with close names | ### Respira Code (8 tools) Developer Mode for Respira: apps, deploys and guarded SQL, from the Respira Code add-on (plugi…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
npx invocation of non-well-known packagedist/setup.js:109 · npx invocation of non-well-known package — may execute untrusted code* "No sites configured". They guessed npx was resolving a different copy of theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/startup-failure.js:8 · npx invocation of non-well-known package — may execute untrusted code* gone. npx treats that folder as installed and never repairs it. Node thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup.js:6 · npx invocation of non-well-known package — may execute untrusted code* Or: npx @respira/wordpress-mcp-server --setupFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈106 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @respira/wordpress-mcp-server@8.7.7 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim respira: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  5. Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  6. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim respiraPropose a patch to the maintainer