wp-settings-mcp

The server provides powerful administrative capabilities over a WordPress site, including updating critical site settings, managing users (list, create, delete), and flushing cache. It relies on WordPress REST API and WP-CLI, which can grant extensive control if configured with administrator credentials. The security of this server heavily depends on the secure management of sensitive environment variables such as WORDPRESS_APP_PASSWORD and SSH_KEY_PATH, and the secure deployment of the MCP server itself (e.g., strong authentication, network access controls). A compromise of this server could lead to full control over the connected WordPress instance and potentially the underlying server if WP-CLI is enabled with SSH access. Input validation with Zod helps with schema adherence but does not mitigate the risk of authorized users performing sensitive actions or a compromised server being misused.