Atlas / MCP servers / elementor / @elementor/angie-sdk

@elementor/angie-sdkSAFE

mcp/elementor/angie-sdk

Add Angie Chat Anywhere

Verdict
SAFE
Grade
B
Trust score
86 /100
Exposed tools
13 9r · 4w · 0d
Transport
streamable-http
License
—
Stars
28
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Based on MCP version: 1.20.1

An SDK for extending Angie AI Assistant capabilities.

This SDK enables you to create custom MCP servers that Angie can discover and use to run your plugin features.

Table of Contents

  • Background
  • How It Works
  • Supported MCP Features
  • Installation
  • Quick Start
  • Async Registration
  • Triggering Angie with Prompts
  • MCP Server Example
  • Adding Instructions to MCP Servers
  • Registering Tools
  • Tool Annotations
  • Handling Tool Calls
  • Best Practices
  • Remote SSE and HTTP Streamable MCP servers
  • Error Handling
  • Changelog
  • Demo Plugin
  • Embedded Angie in any web page
  • Debugging & Testing
  • FAQ

Background

Angie is a WordPress AI Assistant that can perform almost any task on a WordPress website.

Angie is fully extensible, so plugin developers can easily integrate their own features, allowing Angie to use and control them.

Angie is built on an MCP-based architecture, enabling you to create custom MCP servers that expose your plugin's capabilities for Angie to access.

To learn about MCP:

The SDK was designed specifically to address these issues:

  1. Run MCP in the Browser

The SDK allows you to run an MCP server as a JavaScript module in the browser, so there is no need for creating a

Read from source at commit c0d2ac73ab78OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add angie-sdk -- npx -y @elementor/[email protected]
claude-desktop
{
  "mcpServers": {
    "angie-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@elementor/[email protected]"
      ]
    }
  }
}
03

Exposed tools (13)

9 read · 4 write · 0 destructive.

ToolRiskDescription
analyze-page-seoread
apply-csswrite
close-chatread
get-invoice-statusreadLook up the status of an invoice by ID.
list-catalog-itemsreadList recent product titles.
manage-post-typeswrite
my-toolread
propose-cssread
read-textarearead
run-fireworkswrite
search-help-articlesreadSearch help center articles by query.
security-checkread
update-textareawrite
04

Trust audit

SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (12)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.hidden_file · CWE-1104
example/angie-demo-plugin/.wp-env.json
.wp-env.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
demo/load-sidebar-v1-demo/host.js:1
import { AngieMcpSdk } from '../../dist/index.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
demo/load-sidebar-v2-css-mcp-app/host.js:1
import { AngieMcpSdk, LAYOUT_SIDEBAR, McpAppDisplayMode, getAngieIframe } from '../../dist/index.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
demo/load-sidebar-v2-floating-chat/host.js:1
import { AngieMcpSdk, LAYOUT_FLOATING_CHAT } from '../../dist/index.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
demo/load-sidebar-v2-full-config/host.js:1
import { AngieMcpSdk, LAYOUT_SIDEBAR } from '../../dist/index.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
demo/load-sidebar-v2-multi-instance/host.js:1
import { AngieMcpSdk, LAYOUT_FLOATING_CHAT, LAYOUT_SIDEBAR } from '../../dist/index.js';
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/videoproof-ci.yml:38
if curl -fsS http://127.0.0.1:8080/demo/load-sidebar-v2-full-config/ >/dev/null; then
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.github/workflows/videoproof-ci.yml:64
VIDEO_PROOF_URL: http://127.0.0.1:8080/demo/load-sidebar-v2-full-config/
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
example/angie-demo-plugin/package.json
@modelcontextprotocol/sdk, fireworks-js, zod, typescript, vite, @wordpress/env
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@elementor/angie-logger, @elementor/oidc-auth, @eslint/js, @types/jest, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint
Why it matters. 18 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-12 · audit v0.4.1 · source sha c0d2ac73ab78full audit observations/trust-audit/mcp-server/elementor__angie-sdk.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12c0d2ac73ab78SAFEB86first audit
06

Questions

What is the @elementor/angie-sdk MCP server?

Add Angie Chat Anywhere

What tools does @elementor/angie-sdk expose?

13 in total: 9 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @elementor/angie-sdk safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does @elementor/angie-sdk need?

No credential environment variables were found in its source, so it appears to need none.

How does @elementor/angie-sdk run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @elementor/angie-sdk at 1.8.0.

How current is this page?

The grade is for one exact copy of the source (c0d2ac73ab78), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement