mcp-server

The server leverages WordPress's authentication mechanisms (user login or application passwords) for API access, which is a strong security practice. It uses `logiscape/mcp-sdk-php` for JSON-RPC message handling, delegating core protocol parsing security to the SDK. The `RestController` includes `Access-Control-Allow-Origin: *` header, noted as a 'workaround for MCP Inspector', which can be a security risk (e.g., CSRF vulnerability) if not strictly controlled or intended for production. The `MediaManager::upload_to_media_library` function accepts a `$media_path` parameter directly, which could be a vulnerability if an MCP tool exposes this functionality without robust sanitization of the path. The `RestApi::rest_callable` function dynamically constructs REST API routes and dispatches requests, relying on WordPress's internal API validation for safety.