Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/docdyhr/mcp-wordpress/agents-mdgit clone --depth 1 https://github.com/docdyhr/mcp-wordpressWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02700 | $0.02700 |
| Opus 5 | $0.01350 | $0.01350 |
| Sonnet 5 | $0.00540 | $0.00540 |
| Haiku 4.5 | $0.00270 | $0.00270 |
Grade C, and why
mcp-wordpress AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- Cache issues: `rm -rf cache/` How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
mcp-wordpress
MCP (Model Context Protocol) Server for WordPress. TypeScript ESM, 71 WordPress tools across 12 categories, exposed over the MCP SDK to any MCP-compatible client.
Quick Start
npm run build # cross-platform clean + tsc && tsc-alias — required before most test/CLI scripts (tests run against dist/)
npm test # Run tests (npm run test:batch)
npm run dev # Build + run with DEBUG=true
npm run health # System check (scripts/health-check.js)
npm run fix:rest-auth # Fix WordPress 401 errors (scripts/fix-rest-api-auth.sh)
npm run lint # eslint src/ tests/
npm run typecheck # tsc --noEmit
npm run security:scan # blocking production npm-audit gate (scripts/security-audit-gate.js) against security-exceptions.json
npm run security:demo # AI security-scanner demo (scripts/security-demo.js) — informational only, not a gate
Architecture
Core: MCP Server (src/index.ts) registers 71 WordPress tools via src/server/ToolRegistry.ts. Client:
src/client/api.ts (WordPressClient) composes per-resource operation classes (src/client/operations/) via
constructor injection; App Passwords, JWT, Basic, and API Key are configurable via .env/mcp-wordpress.config.json —
Cookie auth is also implemented but is client/programmatic-only (see Authentication below). Tools: Posts(6) Pages(6)
Media(5) Users(6) Comments(7) Taxonomies(10) Site(3) Auth(6) Cache(4) Performance(6) SEO(11) System(1) = 71. Key
files: src/client/api.ts, src/server/ToolRegistry.ts, src/tools/, src/config/ServerConfiguration.ts,
src/utils/logger.ts.
Full per-directory contracts live in the Child DOX Index below — read the applicable child doc before editing.
Configuration
Multi-Site (mcp-wordpress.config.json, gitignored — never commit real credentials):
{
"sites": [
{
"id": "site1",
"name": "Site 1",
"config": {
"WORDPRESS_SITE_URL": "https://site.com",
"WORDPRESS_USERNAME": "user",
"WORDPRESS_APP_PASSWORD": "xxxx xxxx xxxx xxxx"
}
}
]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 233 lines · 2,700 tokens per session scan C 521fa467b3a0
mcp-wordpress AGENTS.md is an instructions file published in the GitHub repository docdyhr/mcp-wordpress (106 stars, last pushed 4d ago), licensed MIT. It adds 2,700 tokens to every session, about $0.0135 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
mcp-server-excel coverage-prevention-strategy.instructions.md
Instructions for sbroenne/mcp-server-excel, covering generated surface coverage, contract change workflow, required checks and common incomplete changes.
my-claude-code-setup GEMINI.md
Instructions for centminmod/my-claude-code-setup, covering gemini.md, ai guidance, memory bank system, core context files and project overview.
mcp-server-excel mcp-llm-guidance.instructions.md
Instructions for sbroenne/mcp-server-excel, a project described as: Automate real Microsoft Excel with AI via MCP Server or CLI — Power Query, DAX, VBA, PivotTables, charts, and 326 operations.
cship CLAUDE.md
Instructions for stephenleo/cship, covering cship — ai agent instructions, environment quirks, non-negotiable code patterns, before submitting a pr and project structure.
agentic-workflow CLAUDE.md
Instructions for gtrabanco/agentic-workflow, covering claude.md, repository layout, working rules, authoring a skill and hand off, don't compose across a model/effort boundary.
wprig CLAUDE.md
Claude Code instructions for wprig/wprig, covering wp rig ai agents guide, 1. onboarding & state protocol, 2. architecture & build pipeline, 3. contract-first development and 4. configuration & content first.