io.github.Servosity/wordpress-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• cli/internal/cli/deliver.go:164mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  	_ = compact
  	contentType := "application/json"
  	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
  	if err != nil {
  		return fmt.Errorf("building webhook request: %w", err)

• cli/internal/cli/feedback.go:79mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		return err
  	}
  	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
  	if err != nil {
  		return fmt.Errorf("building feedback request: %w", err)

• cli/internal/cli/media_upload.go:182mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  // header WordPress requires to name the upload.
  func mediaDoUpload(ctx context.Context, timeout time.Duration, base, auth, filename, contentType string, data []byte) (json.RawMessage, int, error) {
  	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+"/media", bytes.NewReader(data))
  	if err != nil {
  		return nil, 0, fmt.Errorf("creating request: %w", err)

• cli/internal/cli/media_upload.go:208mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		return nil, 0, err
  	}
  	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(b))
  	if err != nil {
  		return nil, 0, err

• cli/internal/client/client.go:1209mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		}
  
  		req, err := http.NewRequestWithContext(ctx, method, targetURL, bodyReader)
  		if err != nil {
  			return nil, 0, fmt.Errorf("creating request: %w", err)

• cli/internal/cliutil/probe.go:75mcp-go-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any component is caller-supplied the server can be aimed at hosts it can reach and the caller cannot.

  		client = &http.Client{Timeout: defaultProbeTimeout}
  	}
  	req, reqErr := http.NewRequestWithContext(ctx, "GET", url, nil)
  	if reqErr != nil {
  		return ReachabilityUnreachable, 0, fmt.Errorf("building request: %w", reqErr)

• cli/internal/learn/derive.go:330mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		data, err := os.ReadFile(filepath.Join(dir, seg.name)) // #nosec G304 -- listed from state dir
  		if err != nil {
  			continue

• cli/internal/learn/journal.go:410mcp-go-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and opened without confinement. filepath.Join cleans `..` but does not confine: a component of "../../etc/passwd" still resolves outside the base.

  			continue
  		}
  		data, err := os.ReadFile(filepath.Join(dir, s.name)) // #nosec G304 -- listed from state dir
  		if err != nil {
  			if os.IsNotExist(err) {

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 7 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at cli/internal/cli/doctor.go:592; Secret Keyword at cli/internal/cli/platform_cli_test.go:427; Secret Keyword at cli/internal/config/config.go:516; Secret Keyword at cli/internal/config/config.go:660; Secret Keyword at cli/internal/config/config.go:809; Secret Keyword at cli/internal/config/config_perms_test.go:30; Hex High Entropy String at cli/internal/platform/testdata/receipt-status-golden.json:2

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

• cli/go.modgolang.org/x/text 0.39.0 — GO-2026-6629

  transitive, no CVSS published, fixed in 0.41.0

  https://osv.dev/vulnerability/GO-2026-6629

Maintenance

• recency

  last commit 1 day(s) before 2026-10-16

• issue_responsiveness

  median over 50 issue(s) in the last 6 months: 59.3 day(s) to first maintainer comment

• release_cadence

  released 1 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  cli/LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  CHANGELOG.md present

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately