Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "wp-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@rnaga/[email protected]",
        "local",
        "start"
      ],
      "env": {
        "LOCAL_USERNAME": "${LOCAL_USERNAME}",
        "WP_DB_HOST": "${WP_DB_HOST}",
        "WP_DB_PORT": "3306",
        "WP_DB_NAME": "${WP_DB_NAME}",
        "WP_DB_USER": "${WP_DB_USER}",
        "WP_DB_PASSWORD": "${WP_DB_PASSWORD}",
        "LOCAL_MULTISITE": "false",
        "LOCAL_DEFAULT_BLOG_ID": "1",
        "LOCAL_DEFAULT_SITE_ID": "1",
        "LOCAL_SSL_ENABLED": "false"
      }
    }
  }
}

claude mcp add wp-mcp -e "LOCAL_USERNAME=${LOCAL_USERNAME}" -e "WP_DB_HOST=${WP_DB_HOST}" -e "WP_DB_PORT=3306" -e "WP_DB_NAME=${WP_DB_NAME}" -e "WP_DB_USER=${WP_DB_USER}" -e "WP_DB_PASSWORD=${WP_DB_PASSWORD}" -e "LOCAL_MULTISITE=false" -e "LOCAL_DEFAULT_BLOG_ID=1" -e "LOCAL_DEFAULT_SITE_ID=1" -e "LOCAL_SSL_ENABLED=false" -- npx -y @rnaga/[email protected] local start

[mcp_servers.wp-mcp]
command = "npx"
args = ["-y", "@rnaga/[email protected]", "local", "start"]
env = { "LOCAL_USERNAME" = "${LOCAL_USERNAME}", "WP_DB_HOST" = "${WP_DB_HOST}", "WP_DB_PORT" = "3306", "WP_DB_NAME" = "${WP_DB_NAME}", "WP_DB_USER" = "${WP_DB_USER}", "WP_DB_PASSWORD" = "${WP_DB_PASSWORD}", "LOCAL_MULTISITE" = "false", "LOCAL_DEFAULT_BLOG_ID" = "1", "LOCAL_DEFAULT_SITE_ID" = "1", "LOCAL_SSL_ENABLED" = "false" }

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wp-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@rnaga/[email protected]",
        "local",
        "start"
      ],
      "enabled": true,
      "environment": {
        "LOCAL_USERNAME": "{env:LOCAL_USERNAME}",
        "WP_DB_HOST": "{env:WP_DB_HOST}",
        "WP_DB_PORT": "3306",
        "WP_DB_NAME": "{env:WP_DB_NAME}",
        "WP_DB_USER": "{env:WP_DB_USER}",
        "WP_DB_PASSWORD": "{env:WP_DB_PASSWORD}",
        "LOCAL_MULTISITE": "false",
        "LOCAL_DEFAULT_BLOG_ID": "1",
        "LOCAL_DEFAULT_SITE_ID": "1",
        "LOCAL_SSL_ENABLED": "false"
      }
    }
  }
}

{
  "mcpServers": {
    "wp-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@rnaga/[email protected]",
        "local",
        "start"
      ],
      "env": {
        "LOCAL_USERNAME": "${LOCAL_USERNAME}",
        "WP_DB_HOST": "${WP_DB_HOST}",
        "WP_DB_PORT": "3306",
        "WP_DB_NAME": "${WP_DB_NAME}",
        "WP_DB_USER": "${WP_DB_USER}",
        "WP_DB_PASSWORD": "${WP_DB_PASSWORD}",
        "LOCAL_MULTISITE": "false",
        "LOCAL_DEFAULT_BLOG_ID": "1",
        "LOCAL_DEFAULT_SITE_ID": "1",
        "LOCAL_SSL_ENABLED": "false"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=wp-mcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBybmFnYS93cC1tY3BAMS4wLjkiLCJsb2NhbCIsInN0YXJ0Il0sImVudiI6eyJMT0NBTF9VU0VSTkFNRSI6IiR7TE9DQUxfVVNFUk5BTUV9IiwiV1BfREJfSE9TVCI6IiR7V1BfREJfSE9TVH0iLCJXUF9EQl9QT1JUIjoiMzMwNiIsIldQX0RCX05BTUUiOiIke1dQX0RCX05BTUV9IiwiV1BfREJfVVNFUiI6IiR7V1BfREJfVVNFUn0iLCJXUF9EQl9QQVNTV09SRCI6IiR7V1BfREJfUEFTU1dPUkR9IiwiTE9DQUxfTVVMVElTSVRFIjoiZmFsc2UiLCJMT0NBTF9ERUZBVUxUX0JMT0dfSUQiOiIxIiwiTE9DQUxfREVGQVVMVF9TSVRFX0lEIjoiMSIsIkxPQ0FMX1NTTF9FTkFCTEVEIjoiZmFsc2UifX0%3D"
}

{
  "servers": {
    "wp-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@rnaga/[email protected]",
        "local",
        "start"
      ],
      "env": {
        "LOCAL_USERNAME": "${LOCAL_USERNAME}",
        "WP_DB_HOST": "${WP_DB_HOST}",
        "WP_DB_PORT": "3306",
        "WP_DB_NAME": "${WP_DB_NAME}",
        "WP_DB_USER": "${WP_DB_USER}",
        "WP_DB_PASSWORD": "${WP_DB_PASSWORD}",
        "LOCAL_MULTISITE": "false",
        "LOCAL_DEFAULT_BLOG_ID": "1",
        "LOCAL_DEFAULT_SITE_ID": "1",
        "LOCAL_SSL_ENABLED": "false"
      }
    }
  }
}

{
  "mcpServers": {
    "wp-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@rnaga/[email protected]",
        "local",
        "start"
      ],
      "env": {
        "LOCAL_USERNAME": "${LOCAL_USERNAME}",
        "WP_DB_HOST": "${WP_DB_HOST}",
        "WP_DB_PORT": "3306",
        "WP_DB_NAME": "${WP_DB_NAME}",
        "WP_DB_USER": "${WP_DB_USER}",
        "WP_DB_PASSWORD": "${WP_DB_PASSWORD}",
        "LOCAL_MULTISITE": "false",
        "LOCAL_DEFAULT_BLOG_ID": "1",
        "LOCAL_DEFAULT_SITE_ID": "1",
        "LOCAL_SSL_ENABLED": "false"
      }
    }
  }
}

extensions:
  "wp-mcp":
    enabled: true
    name: "wp-mcp"
    type: stdio
    cmd: "npx"
    args:
      - "-y"
      - "@rnaga/[email protected]"
      - "local"
      - "start"
    envs:
      "LOCAL_USERNAME": "${LOCAL_USERNAME}"
      "WP_DB_HOST": "${WP_DB_HOST}"
      "WP_DB_PORT": "3306"
      "WP_DB_NAME": "${WP_DB_NAME}"
      "WP_DB_USER": "${WP_DB_USER}"
      "WP_DB_PASSWORD": "${WP_DB_PASSWORD}"
      "LOCAL_MULTISITE": "false"
      "LOCAL_DEFAULT_BLOG_ID": "1"
      "LOCAL_DEFAULT_SITE_ID": "1"
      "LOCAL_SSL_ENABLED": "false"
    timeout: 300

Placeholders to fill from your own secret store: ${WP_DB_PASSWORD}. The registry never accepts secret values.

This is a local package: the command runs on your machine.

Quality – / 100not scored

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

protocoln/a · weight 25

n/a
protocol.modern, protocol.stateless, protocol.transport, protocol.list_ttlno remote answered a protocol handshake (not probed yet, unreachable, or local-only)

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygienen/a · weight 30

n/a
tools.descriptions, tools.description_length, tools.schemas, tools.annotations, tools.directory_hints, tools.token_cost, tools.api_dumptool list unknown (behind auth, not probed, or empty)

stabilityn/a · weight 15

n/a
stability.changes, stability.rug_pulltool list unknown

dependencies33 · weight 15

fail
deps.known_vulns9 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-23hp-3jrh-7fpw in [email protected] (indirect, fixed in 7.5.19), GHSA-34x7-hfp2-rc4v in [email protected] (indirect, fixed in 7.5.7), GHSA-83g3-92jg-28cx in [email protected] (indirect, fixed in 7.5.8), ...; 5 more of lower severity or without a fix
fail
deps.mcp_sdk_version@modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
pass
deps.resolvable@rnaga/[email protected] resolved: 286 packages

Tool list unknown · checked 2026-10-20 07:21 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 87 / 100

provenance80

livenessn/a

freshness85

hygiene100

+repository +namespace-matches-repo ~liveness-unmeasured ~updated-89d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@rnaga/[email protected] npm285 dependencies, resolved · MCP SDK @modelcontextprotocol/sdk 1.30.1 · advisories checked 2026-10-19

advisory	severity	package	fixed in
GHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited input	critical	`[email protected]`indirect	fixed in `7.5.19`
GHSA-6qxp-vccf-f47hMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server	high	`@modelcontextprotocol/[email protected]`MCP SDK, direct	fixed in `1.31.0`
GHSA-34x7-hfp2-rc4vnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal	high	`[email protected]`indirect	fixed in `7.5.7`
GHSA-83g3-92jg-28cxArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction	high	`[email protected]`indirect	fixed in `7.5.8`
GHSA-8qq5-rm4j-mr97node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization	high	`[email protected]`indirect	fixed in `7.5.3`
GHSA-8x88-c5mf-7j5wnode-tar: Negative tar entry size causes infinite loop in archive replace	high	`[email protected]`indirect	fixed in `7.5.18`
GHSA-9ppj-qmqm-q256node-tar Symlink Path Traversal via Drive-Relative Linkpath	high	`[email protected]`indirect	fixed in `7.5.11`
GHSA-qffp-2rhf-9h96tar has Hardlink Path Traversal via Drive-Relative Linkpath	high	`[email protected]`indirect	fixed in `7.5.10`
GHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection	high	`[email protected]`indirect	fixed in `7.5.21`
GHSA-r6q2-hw4h-h46wRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS	high	`[email protected]`indirect	fixed in `7.5.4`

5 more advisories in the dependencies endpoint.

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

package	registry	version	runtime	secrets
`@rnaga/wp-mcp`	npm	1.0.9	npx	`WP_DB_PASSWORD`

Tools (0)

No tools observed. Local packages are never executed by the registry.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.rnaga/wp-mcp",
  "title": "WordPress MCP Server",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
  "version": "1.0.9",
  "packages": [
    {
      "version": "1.0.9",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@rnaga/wp-mcp",
      "runtimeHint": "npx",
      "registryType": "npm",
      "packageArguments": [
        {
          "type": "positional",
          "value": "local",
          "description": "Command to run (local, remote, http, utils)"
        },
        {
          "type": "positional",
          "value": "start",
          "description": "Subcommand to start the local MCP server"
        }
      ],
      "runtimeArguments": [
        {
          "name": "-y",
          "type": "named",
          "description": "Automatically confirm npx package installation"
        }
      ],
      "environmentVariables": [
        {
          "name": "LOCAL_USERNAME",
          "isRequired": true,
          "description": "WordPress username to assume for capability checks"
        },
        {
          "name": "WP_DB_HOST",
          "isRequired": true,
          "description": "WordPress database host"
        },
        {
          "name": "WP_DB_PORT",
          "default": "3306",
          "description": "WordPress database port"
        },
        {
          "name": "WP_DB_NAME",
          "isRequired": true,
          "description": "WordPress database name"
        },
        {
          "name": "WP_DB_USER",
          "isRequired": true,
          "description": "WordPress database user"
        },
        {
          "name": "WP_DB_PASSWORD",
          "isSecret": true,
          "isRequired": true,
          "description": "WordPress database password"
        },
        {
          "name": "LOCAL_MULTISITE",
          "default": "false",
          "description": "Enable WordPress multisite mode"
        },
        {
          "name": "LOCAL_DEFAULT_BLOG_ID",
          "default": "1",
          "description": "Default blog ID for multisite"
        },
        {
          "name": "LOCAL_DEFAULT_SITE_ID",
          "default": "1",
          "description": "Default site ID for multisite"
        },
        {
          "name": "LOCAL_SSL_ENABLED",
          "default": "false",
          "description": "Enable SSL for database connection"
        },
        {
          "name": "LOCAL_SSL_CA_FILEPATH",
          "description": "Path to SSL CA certificate file"
        },
        {
          "name": "LOCAL_SSL_CERT_FILEPATH",
          "description": "Path to SSL certificate file"
        },
        {
          "name": "LOCAL_SSL_KEY_FILEPATH",
          "description": "Path to SSL key file"
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/rnaga/wp-mcp",
    "source": "github"
  },
  "description": "MCP server for WordPress. Manage posts, users, comments, terms, metadata, and settings."
}