wp-menus-mcp

The server utilizes environment variables for sensitive WordPress credentials (URL, username, app password), which is good practice for managing secrets. Input validation is performed using `zod` schemas for each tool, which helps mitigate common injection vulnerabilities. The `set_menu_location` tool directly interacts with a sensitive WordPress settings endpoint (`/wp/v2/settings`). While the input is validated, misconfiguration of WordPress permissions for the provided application password or insufficient security measures for the MCP server itself could lead to unauthorized menu changes or broader site settings modifications. No 'eval' or obvious obfuscation is present in the provided code.