@respira/wordpress-mcp-server 8.0.2 → 8.0.3

package/README.md

@@ -768,6 +768,8 @@ npm cache clean --force
 
 API key validation happens server-side in the WordPress plugin. The MCP server passes credentials but does not store or validate them.
 
+`wordpress_run_security_audit` performs bounded read-only evidence collection for reviewed advisories. `wordpress_update_core_security` installs only an exact, catalog-approved security patch after backup confirmation and explicit two-step approval, and returns post-update verification evidence.
+
 Report vulnerabilities to security@respira.press.
 
 ---

package/TOOL_CATALOG.md

@@ -2,7 +2,7 @@
 
 <!-- Generated by scripts/check-tool-registry-parity.mjs. Do not edit by hand. -->
 
-Generated catalog: **169 core tools**, **105 WooCommerce tools**, **274 total**.
+Generated catalog: **171 core tools**, **105 WooCommerce tools**, **276 total**.
 
 The runtime applies site context and per-site governance, so an individual connection may expose a smaller relevant subset.
 
@@ -144,6 +144,7 @@ The runtime applies site context and per-site governance, so an individual conne
 - `wordpress_restore_session` — write; hosted/stdio
 - `wordpress_restore_snapshot` — write; native + hosted
 - `wordpress_run_pagespeed_audit` — read; hosted/stdio
+- `wordpress_run_security_audit` — read; native + hosted
 - `wordpress_scan_page_accessibility` — read; hosted/stdio
 - `wordpress_search_abilities` — read; native + hosted
 - `wordpress_search_docs` — read; hosted/stdio
@@ -152,6 +153,7 @@ The runtime applies site context and per-site governance, so an individual conne
 - `wordpress_switch_site` — write; native + hosted
 - `wordpress_update_acf_field_group` — write; hosted/stdio
 - `wordpress_update_comment` — write; native + hosted
+- `wordpress_update_core_security` — write; native + hosted
 - `wordpress_update_custom_post` — write; native + hosted
 - `wordpress_update_design_token` — write; native + hosted
 - `wordpress_update_element` — write; native + hosted

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAyIhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAusGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IA2yC9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA8YzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAsQzE,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,YAAY,CAA4B;IAChD,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAAS;IACpC,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAK;IAC9B,iFAAiF;IACjF,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IAEhE;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;gBA4Bb,WAAW,EAAE,mBAAmB,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE;IAiVvE,OAAO,CAAC,cAAc;IAItB;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IA4BrB,gEAAgE;IAChE,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;YACW,UAAU;IA2CxB;;;;;;;;;;;;;;OAcG;YACW,WAAW;IAiJzB;;;;;;;;;OASG;YACW,kBAAkB;IAyIhC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,qBAAqB;YAiBrB,kBAAkB;IA6FhC,yFAAyF;IACzF,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,6BAA6B;IA0BrC;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,aAAa;YAmQP,kBAAkB;YA6BlB,yBAAyB;IASvC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAyBd,QAAQ;IAuvGtB;;;;;;OAMG;IACH;;;;;;;;;;;;;oDAagD;IAChD,OAAO,CAAC,mBAAmB,CAAoD;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAS;IAC1D;;mDAE+C;IAC/C,OAAO,CAAC,0BAA0B,CAAoC;IAEtE;;;;;;;;OAQG;YACW,0BAA0B;YAyC1B,oBAAoB;YA6CpB,2BAA2B;IAQzC;;;;OAIG;YACW,cAAc;IAQ5B,OAAO,CAAC,mBAAmB;IAo7C3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAe3C;IAEF;;;;OAIG;IACH,OAAO,CAAC,0BAA0B;YAmCpB,cAAc;IA4G5B,oEAAoE;IACpE,OAAO,CAAC,iBAAiB;IAoBzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,eAAe;YAuCT,gBAAgB;IAo0C9B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA8YzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA6UxB,GAAG;CAyCV"}

package/dist/server.js

@@ -3302,6 +3302,54 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 },
                 readOnlyHint: true,
             },
+            // Safety & Security center
+            {
+                name: 'wordpress_run_security_audit',
+                description: 'Run a bounded, read-only WordPress security evidence pass. Returns authoritative WordPress/WooCommerce versions, official core checksum mismatches, administrators, standard and must-use plugins, WordPress cron hooks, known advisory indicators, scan coverage and explicit host-level limitations. Set deep_scan=true to inspect uploads and must-use plugin paths for executable files. This tool never deletes or rewrites anything.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        advisory_ids: {
+                            type: 'array',
+                            items: { type: 'string' },
+                            description: 'Optional reviewed advisory IDs to record as the audit scope, for example wordpress-wp2shell-2026.',
+                        },
+                        deep_scan: {
+                            type: 'boolean',
+                            default: false,
+                            description: 'Inspect uploads and must-use plugin paths with strict file, time, symlink and result limits.',
+                        },
+                    },
+                },
+                readOnlyHint: true,
+            },
+            {
+                name: 'wordpress_update_core_security',
+                description: 'Update WordPress core to an exact, catalog-approved security release on the current release branch. Requires a recent recoverable backup, then explicit two-step approval. The first call returns respira_approval_required and an approval_token; repeat the same arguments with that token. The result verifies the running version, REST/frontend boot and official checksums. WordPress core has no automatic rollback, and the receipt says so.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        advisory_id: {
+                            type: 'string',
+                            description: 'Reviewed security advisory ID, currently wordpress-wp2shell-2026.',
+                        },
+                        target_version: {
+                            type: 'string',
+                            description: 'Exact approved patch version on the current branch: 6.8.6, 6.9.5 or 7.0.2 for wp2shell.',
+                        },
+                        backup_confirmed: {
+                            type: 'boolean',
+                            description: 'True only after the operator confirms a recent recoverable backup exists.',
+                        },
+                        approval_token: {
+                            type: 'string',
+                            description: 'Approval token returned by the first blocked call. Echo it unchanged on the second call.',
+                        },
+                    },
+                    required: ['advisory_id', 'target_version', 'backup_confirmed'],
+                },
+                idempotentHint: true,
+            },
             // Accessibility tools
             {
                 name: 'wordpress_list_accessibility_scans',
@@ -7014,6 +7062,15 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
                 return await client.analyzeAEO(args.page_id);
             case 'wordpress_check_structured_data':
                 return await client.checkStructuredData(args.page_id);
+            case 'wordpress_run_security_audit':
+                return await client.runSecurityAudit(args.advisory_ids || [], args.deep_scan === true);
+            case 'wordpress_update_core_security':
+                return await client.updateCoreSecurity({
+                    advisoryId: args.advisory_id,
+                    targetVersion: args.target_version,
+                    backupConfirmed: args.backup_confirmed === true,
+                    approvalToken: args.approval_token,
+                });
             // Accessibility
             case 'wordpress_list_accessibility_scans':
                 return await client.listAccessibilityScans({
@@ -7630,12 +7687,26 @@ Allowlist: css, scss, less, json. PHP / JS theme writes are intentionally out of
             // Widget shortcuts and Bricks tools — dynamic dispatch.
             default: {
                 // Check if this is a Bricks deep tool.
-                const bricksResult = await dispatchBricksTool(name, args, (method, path, body) => this.currentSite.callRestV2(method, path, body));
+                //
+                // `client` (resolved above via resolveClient(args), the whole switch
+                // statement's site_id-aware client) — NOT this.currentSite, which is
+                // only the globally active site. Every case above this default: uses
+                // `client.callRestV2`; this fallback used `this.currentSite!` instead,
+                // so any respira_*_bricks_typography (and every other tool that only
+                // resolves here, e.g. the rest of bricks-tools.ts / elementor-tools.ts)
+                // silently ignored a supplied site_id and read/wrote the active site
+                // instead — while still reporting the requested site_id back in the
+                // response, since that came from `args`, not from which site actually
+                // executed the call. Reported by E.M. (wellnessist) 2026-07-29: a
+                // `respira_update_bricks_typography` call with site_id set to site B
+                // (site A active) overwrote site A's global variables/theme styles,
+                // a cross-site write with no rollback for either store.
+                const bricksResult = await dispatchBricksTool(name, args, (method, path, body) => client.callRestV2(method, path, body));
                 if (bricksResult !== null) {
                     return bricksResult;
                 }
-                // Check if this is an Elementor deep tool.
-                const elementorResult = await dispatchElementorTool(name, args, (method, path, body) => this.currentSite.callRestV2(method, path, body));
+                // Check if this is an Elementor deep tool. Same site_id fix as above.
+                const elementorResult = await dispatchElementorTool(name, args, (method, path, body) => client.callRestV2(method, path, body));
                 if (elementorResult !== null) {
                     return elementorResult;
                 }