Atlas / MCP servers / bobgod / WeChat Publisher

WeChat PublisherBLOCK

mcp/bobgod/wechat-publisher

微信公众号MCP服务

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
2 1r · 1w · 0d
Transport
stdio
License
MIT
Stars
59
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://badge.fury.io/js/wechat-publisher-mcp) [](https://opensource.org/licenses/MIT) [](https://github.com/your-username/wechat-publisher-mcp/actions)

📖 目录

  • 🎯 项目概述
  • ✨ 核心特性
  • 📦 安装
  • 🔧 配置
  • 🚀 新手快速开始
  • 🚀 使用方法
  • 🛠️ API 工具
  • 📋 示例
  • 🔧 高级配置
  • 🐛 故障排除
  • 🧪 测试
  • 🤝 贡献
  • 📄 许可证
  • 🔗 相关链接
  • 🙏 致谢

🎯 项目概述

这是一个独立的MCP(Model Context Protocol)服务,专门用于微信公众号文章的自动发布。支持任何兼容MCP协议的AI工具调用,包括Claude Desktop、Cursor、Continue等。

🎉 最新更新:已修复MCP SDK兼容性问题,支持最新版本的Claude Desktop和Cursor!

✨ 核心特性

  • 🚀 即插即用:标准MCP协议,一键集成到任何AI工具
  • 📝 智能转换:自动将Markdown转换为微信公众号优化HTML
  • 🖼️ 封面处理:自动上传和处理封面图片
  • 👀 预览模式:支持预览和正式发布两种模式
  • 📊 状态查询:实时查询文章发布状态和数据统计
  • 🔧 错误处理:完善的错误提示和解决建议
  • 📱 移动优化:针对微信公众号移动端阅读体验优化

📦 安装

注意:目前该包尚未发布到npm registry,请使用源码安装方式。

方式一:源码安装(推荐)

# 1. 克隆仓库
git clone https://github.com/your-username/wechat-publisher-mcp.git
cd wechat-publisher-mcp

# 2. 安装依赖
npm install

# 3. 配置微信公众号密钥
# ⚠️ 重要安全提示:请勿将真实的AppID和AppSecret提交到代码仓库!
cp examples/wechat-config.example.js examples/wechat-config.js
# 编辑 examples/wechat-config.js,填入您的真实密钥

# 4. 创建全局链接
npm link

# 5. 验证安装
wechat-publisher-mcp --help

安全配置说明

⚠️ 重要:为了保护您的微信公众号安全,请务必正确配置密钥!

  1. 复制配置示例文件:
cp examples/wechat-config.example.js examples/wechat-config.js
  1. 编辑配置文件,填入您的真实密钥:
// examples/wechat-config.js
export const wechatConfig = {
appId: 'your_real_appid_here',        // 替换为您的真实AppID
appSecret: 'your_real_appsecret_here' // 替换为您的真实AppSecret
};
  1. 在代码中引用配置:
import { wechatConfig } from './examples/wechat-config.js';
const { appId, appSecr
Read from source at commit f7d18060d3f6OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add wechat-publisher-mcp -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "wechat-publisher-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

1 read · 1 write · 0 destructive.

ToolRiskDescription
wechat_publish_articlewrite
wechat_query_statusread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
scripts/setup.sh:231
echo "   请尝试: sudo npm link"
Why it matters. asks for elevated privileges
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, axios, canvas, express, form-data, winston, zod, eslint
Why it matters. 9 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha f7d18060d3f6full audit observations/trust-audit/mcp-server/bobgod__wechat-publisher.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08f7d18060d3f6BLOCKD69first audit
06

Questions

What is the WeChat Publisher MCP server?

微信公众号MCP服务

What tools does WeChat Publisher expose?

2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is WeChat Publisher safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does WeChat Publisher need?

No credential environment variables were found in its source, so it appears to need none.

How does WeChat Publisher run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as wechat-publisher-mcp at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (f7d18060d3f6), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement