# WP Update Radar

> WordPress plugin release signals from public support threads, with evidence and explicit unknowns.

- name: xyz.utilityhouse.updates/wp-update-radar
- version: 1.0.1
- connection class: R0 (autonomous)
- trust: 79/100 flags: no-repository
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/xyz.utilityhouse.updates%2Fwp-update-radar
- tools: https://api.protogrid.dev/v1/servers/xyz.utilityhouse.updates%2Fwp-update-radar/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "wp-update-radar": {
      "type": "http",
      "url": "https://updates.utilityhouse.xyz/mcp/registry"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 97
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-94% ~updated-42d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 2 of 2 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 838 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 2, about 838 tokens to load them all
- tool set hash: 3413e64b1a72f861566c8c406b1f4ba0
- badge: [![protogrid quality](https://protogrid.dev/badge/xyz.utilityhouse.updates/wp-update-radar.svg)](https://protogrid.dev/servers/xyz.utilityhouse.updates/wp-update-radar)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://updates.utilityhouse.xyz/mcp/registry (streamable-http, auth none, reachable true, uptime30d 0.93636364)

## Packages

_none_

## Tools (2)

- `wp_update_radar_check`: Reports what wordpress.org's public support forum says about one plugin release, compared with the releases before it, counted the same way on both sides. It does not answer whether an update is safe: nothing here can see your site, your theme, your premium plugins or your PHP version.
`state` is what the evidence supports doing, `signal` is only what was observed:
  HOLD                 elevated public signal for this release
  WAIT                 above this plugin's own normal, or the window is still open
  GUARDED_ROLLOUT      no elevated public signal — roll out somewhere low-stakes first
  NOT_ENOUGH_EVIDENCE  too little was attributable to judge; a gap here, NOT a finding about the release, and not a reason to reassure anyone
The legacy `verdict` field keeps its five strings (known-bad / wait / update-now / too-new / insufficient-data) for clients that already read it.
Use it before applying a plugin update, or when someone asks whether a specific version broke anything. Not a security advisory and not a CVE lookup: it reports what other site owners are saying, which is a different question from whether a release is vulnerable. wordpress.org plugins only — premium and paid plugins have no public forum to read, and themes are out of scope. Covers the most-installed plugins; one outside that set returns an error rather than a guess.
- `wp_update_radar_check_many`: Answers: which of this site's plugin updates are risky right now? Prefer this over the single check whenever there is more than one plugin to look at — a whole site's plugin list costs one call here instead of one call each. Same five verdicts as the single check (known-bad, wait, update-now, too-new, insufficient-data), per item and independent: a plugin that is not indexed reports its own error and the rest still answer. Returns a count of each verdict, so the risky ones can be found without reading every row. Up to 25 plugins per call; more than that is reported, not silently cut. `insufficient-data` means this service does not know, which is not the same as safe. Not a security advisory and not a CVE lookup: it reports what other site owners are saying, which is a different question from whether a release is vulnerable. wordpress.org plugins only — premium plugins have no public forum to read, and themes are out of scope.