pilates-mcp-server

CRITICAL: WordPress API username and application password are hardcoded in plain text within `server.py`. This is a severe security risk, allowing anyone with access to the source code to gain full administrative access to the connected WordPress site. These credentials should be stored securely, ideally as environment variables. The installation process uses `curl | bash` which executes remote scripts directly and carries inherent risks of arbitrary code execution if the source is compromised. The server exposes several write operations (create/update posts, custom fields, taxonomies) using these hardcoded credentials, making it highly vulnerable if deployed insecurely.