ModelsAtlas
Explore
Atlas / MCP servers / kfuras / notipo-app

notipo-appBLOCK

mcp/kfuras/notipo-app
MCP server by kfuras · ai agents · blog · claude · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Open-source WordPress publishing for writers, developers, and AI agents. MCP server, REST API, and CLI. Hosted SaaS at notipo.com.

Verdict
BLOCK
Grade
D
Trust score
64 /100
Exposed tools
13 6r · 6w · 1d
Transport
stdio · streamable-http
License
AGPL-3.0
Stars
4
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Open-source WordPress publishing for AI agents — MCP server, REST API, and CLI. Or sync from Notion.

Point your agent (Claude, Cursor, ChatGPT, n8n, any HTTP client) at Notipo and it publishes to your self-hosted WordPress — no plugin required. Notipo handles the full pipeline: markdown → Gutenberg conversion, image hosting in your WordPress media library, AI- or Unsplash-generated featured images, and Rank Math / Yoast / SEOPress / AIOSEO metadata applied automatically on publish.

[](LICENSE) [](https://www.npmjs.com/package/notipo) [](https://notipo.com) [](https://notipo.com/docs/api/mcp)

Two ways to publish to WordPress

1. From Notion

Connect Notion, change a page status to Post to Wordpress or Publish, and Notipo handles the rest — markdown extraction, image caching to WP media library, featured image generation, SEO metadata via Rank Math / Yoast / SEOPress / AIOSEO.

2. From an AI agent, REST API, CLI, or n8n workflow

Notipo exposes a Model Context Protocol (MCP) server with 13 tools for AI agents, plus a REST API and a CLI. Claude Desktop, Cursor, Windsurf, Claude Code, ChatGPT — any MCP-compatible agent can publish posts end-to-end.

# CLI: publish a post end-to-end
npm install -g notipo
notipo posts create --title "Why Every Dev Should Have a Blog" --publish

# REST API: one call runs the full pipeline
curl -X POST https://app.notipo.com/api/posts/create \
-H "X-API-Key: $NOTIPO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"title":"Hello","body":"## Intro\n\nMarkdown in, WordPress out.","publish":true}'
// MCP: drop into Claude Desktop co
Read from source at commit 6ee976d82836OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add shared --env API_KEY=${API_KEY} --env BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} --env BETTER_AUTH_URL=${BETTER_AUTH_URL} --env ENCRYPTION_KEY=${ENCRYPTION_KEY} -- npx -y @notipo/[email protected]
claude-desktop
{
  "mcpServers": {
    "shared": {
      "command": "npx",
      "args": [
        "-y",
        "@notipo/[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "BETTER_AUTH_SECRET": "${BETTER_AUTH_SECRET}",
        "BETTER_AUTH_URL": "${BETTER_AUTH_URL}",
        "ENCRYPTION_KEY": "${ENCRYPTION_KEY}"
      }
    }
  }
}
03

Exposed tools (13)

6 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
create_postwrite
delete_postdestructive
direct_publishwrite
get_jobread
get_postwrite
get_settingsread
list_categoriesread
list_jobsread
list_postsread
list_tagsread
publish_postwrite
sync_nowwrite
update_postwrite
04

Trust audit

BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (7 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (18)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
apps/api/src/lib/url-validation.ts:27
if (hostname === "localhost" || hostname === "metadata.google.internal") {
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
apps/api/src/lib/url-validation.ts:32
if (hostname === "169.254.169.254" || hostname === "metadata.google.internal") {
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
.env.example:3
DATABASE_URL=postgresql://notipo:localdev@localhost:5432/notipo
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
docker-compose.dev.yml:32
DATABASE_URL: postgresql://notipo:localdev@postgres:5432/notipo
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
apps/api/prisma/seed.ts:105
console.log(`  API key: ${apiKey}`);
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_post
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/api/tests/routes/auth.test.ts:13
const { buildApp } = await import("../../src/app.js");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/api/tests/services/markdown-to-gutenberg.test.ts:2
import { convertMarkdownToGutenberg } from "../../src/services/markdown-to-gutenberg.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/api/tests/services/notion-to-markdown.test.ts:2
import { convertNotionBlocksToMarkdown } from "../../src/services/notion-to-markdown.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/web/src/app/layout.tsx:1
import "../../sentry.client.config";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/api/package.json
@fastify/cors, @fastify/multipart, @fastify/rate-limit, @fastify/sensible, @fastify/static, @modelcontextprotocol/sdk, @notionhq/client, @notipo/shared
Why it matters. 35 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/web/package.json
@notipo/shared, @posthog/react, @sentry/nextjs, @stripe/react-stripe-js, @stripe/stripe-js, better-auth, class-variance-authority, clsx
Why it matters. 23 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
sharp, turbo
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/cli/package.json
@types/node, typescript
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/shared/package.json
typescript
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
.claude/CLAUDE.md:269
Catalogs run periodic health-checks against a live endpoint and store a credential to do so. Never give one a personal admin or owner key. Create a dedicated tenant via `POST /api/admin/tenants` and h
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:35
Notipo's web dashboard moved from a single API key pasted into the browser to a proper account system built on [better-auth](https://better-auth.com) — email/password and **Sign in with Google**, firs
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:190
Notipo now exposes a Model Context Protocol server at `POST /api/mcp` so Claude Desktop, Cursor, and custom AI agents can manage posts directly. Streamable HTTP transport, stateless, authenticated wit
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 6ee976d82836full audit observations/trust-audit/mcp-server/kfuras__notipo-app.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-116ee976d82836BLOCKD64first audit
06

Questions

What is the notipo-app MCP server?

Open-source WordPress publishing for writers, developers, and AI agents. MCP server, REST API, and CLI. Hosted SaaS at notipo.com.

What tools does notipo-app expose?

13 in total: 6 read-only, 6 that write, and 1 that can delete or overwrite (delete_post). Every one is listed on this page with its risk.

Is notipo-app safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (64/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does notipo-app need?

It reads API_KEY, BETTER_AUTH_SECRET, BETTER_AUTH_URL, ENCRYPTION_KEY, GOOGLE_CLIENT_SECRET, NEXT_PUBLIC_POSTHOG_KEY, NOTION_TOKEN, NOTIPO_API_KEY, POSTHOG_API_KEY, SEED_API_KEY, SEED_OWNER_PASSWORD and WP_APP_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does notipo-app run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @notipo/shared at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (6ee976d82836), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement