wp-content-mcp

The server uses Zod for input validation, which is a good practice to prevent malformed requests. Sensitive credentials (WordPress URL, username, app password, and WP-CLI SSH details) are expected via environment variables, not hardcoded. The implementation relies on `@akungapaul/wp-mcp-shared` for WordPress REST API and WP-CLI interactions. While the `server.js` itself doesn't expose direct command injection vulnerabilities, the security of the WP-CLI integration (especially remote SSH execution) depends heavily on the robustness of the `WPCLIClient` implementation within the shared library. Without access to that library's source, it's an assumption of safe handling of external commands. No 'eval' or obvious obfuscation is present.