wordpress-mcp-server

The server implements robust security measures for file system operations, including a whitelist approach for allowed directories and file extensions, strict path validation to prevent directory traversal, content scanning for malicious PHP functions (e.g., `eval`, `shell_exec`), and automatic backups with `.htaccess` protection. All endpoints enforce WordPress capabilities (e.g., `manage_options`, `edit_themes`, `edit_plugins`). Environment variables are used for credentials, preventing hardcoded secrets. The high score reflects strong internal safeguards for a tool that grants significant control; however, its power necessitates strong external security practices for the WordPress instance itself.