Skip to content

Releases: teamchrisfromthelc/local-wp-mcp

Release list

v1.0.2

v1.0.2 Latest
Latest

Choose a tag to compare

View all tags
@chrisfromthelc chrisfromthelc released this 11 Mar 05:53
v1.0.2
f07da05

Fixes a false positive in the shell metacharacter defense that rejected legitimate HTML/JSON content in WP-CLI argument values (e.g., --post_content=<h2>Hello</h2>).

What changed

  • Removed overly strict shell metacharacter check from validateArgs() — argument values passed via spawn() are array elements with no shell interpretation, so <, >, {, } etc. are safe
  • The metacharacter check remains on the command string in isCommandAllowed() where it's appropriate
  • Updated tests to confirm HTML, JSON, and special characters are allowed in arg values

Install / upgrade

npx -y @chrisfromthelc/local-wp-mcp@1.0.2 --setup
Assets 2
Loading

v1.0.1

v1.0.1

Choose a tag to compare

View all tags
@chrisfromthelc chrisfromthelc released this 11 Mar 02:32
v1.0.1
c18d70c

First full release of @chrisfromthelc/local-wp-mcp — an MCP server providing WP-CLI, MySQL, and filesystem access for Local by Flywheel WordPress sites.

Highlights

  • 10 MCP tools: WP-CLI execution, MySQL queries, file read/write/search, site listing
  • Security-first: spawn() only (no exec()), shell metacharacter rejection, blocked dangerous flags, TOCTOU-safe file operations, symlink-aware path validation, restricted env inheritance
  • Plugin CLI support: Automatically detects read-only plugin commands (WooCommerce, ACF, Yoast, etc.) via verb matching — no configuration needed
  • Write protection: All write operations (WP-CLI, MySQL, filesystem) require explicit opt-in via environment variables
  • Multi-agent support: Setup instructions for Claude Code, Claude Desktop, Cursor, VS Code (GitHub Copilot), and Windsurf
  • 357 tests across 5 test suites with ESLint and TypeScript strict mode

Install

npx -y @chrisfromthelc/local-wp-mcp --setup

See the README for manual setup and other agents.

Loading