mcp-wordpress

The server implements extensive security features including robust input validation (Zod schemas, `InputSanitizer`), multiple authentication methods (App Passwords, JWT, Basic, API Key) managed securely via environment variables, rate limiting, and structured logging with sensitive data redaction. URL sanitization prevents common network-based attacks. The `src/security` directory contains modules for AI-driven scanning, code review, automated remediation, monitoring, and CI pipeline integration, indicating a strong focus on security best practices. No `eval` is found in the core server runtime, and external API integrations handle secrets via environment variables. File paths are handled carefully to prevent traversal.