wp-seo-mcp

The server handles sensitive WordPress credentials and SSH details via environment variables, which is a good practice. It utilizes a shared WordPress MCP SDK, implying a layer of abstraction and potentially secure handling of API interactions. There are no direct `eval` or arbitrary command injection points visible in the provided tool handlers. The `WPCLIClient`, if enabled and configured for SSH, represents a powerful execution context, but its use in the provided tools is confined to specific WordPress actions and not arbitrary shell commands, minimizing direct exploitability from the client's perspective. Overall, the security relies heavily on the secure configuration of the environment (e.g., strong application passwords, restricted SSH access) and the robustness of the `@akungapaul/wp-mcp-shared` library.