ModelsAtlas
Explore
Atlas / MCP servers / msrbuilds / Elementor

ElementorBLOCK

mcp/msrbuilds/elementor
MCP server by msrbuilds · elementor · mcp server · wordpress · Audited 2026-09-29
⚑ Report / re-scanSource ↗

WordPress plugin that turns Elementor & WordPress into an MCP server. 500+ AI-ready tools for building, editing, and managing page designs programmatically.

Verdict
BLOCK
Grade
D
Trust score
67 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
GPL-2.0
Stars
726
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MCP Tools for WordPress & Page Builders

[](https://github.com/msrbuilds/elementor-mcp/releases) [](LICENSE) [](https://php.net) [](https://wordpress.org) [](https://emcptools.com/docs/tools/overview/) [](CONTRIBUTING.md) [](https://github.com/msrbuilds/elementor-mcp/issues) [](https://github.com/msrbuilds/elementor-mcp)

[Docs](https://emcptools.com/docs/) · [Integrations](https://emcptools.com/integrations/) · [Changelog](https://emcptools.com/changelog) · [Pro](https://emcptools.com/pricing)

Turn your WordPress site into something an AI agent can actually operate.

EMCP Tools is a WordPress plugin that exposes your site as [MCP](https://modelcontextprotocol.io/) tools, so Claude, Cursor, and any other MCP client can build Elementor pages, write content, manage plugins and users, audit performance and security, and drive the plugins you already run. It builds on the WordPress MCP Adapter, which ships bundled.

EMCP Pro, 25% off for the GitHub community: use code `MSRGIT` at [emcptools.com/pricing](https://emcptools.co
Read from source at commit 3e00f64b76e6OBSERVED · 2026-09-29
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add emcp-proxy -- npx -y @msrbuilds/[email protected]
claude-desktop
{
  "mcpServers": {
    "emcp-proxy": {
      "command": "npx",
      "args": [
        "-y",
        "@msrbuilds/[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
emcp_list_sitesreadList the WordPress sites this proxy can connect to, and which one is active. Use emcp_use_site to switch.
emcp_use_sitereadSwitch the active WordPress site for subsequent tool calls. Pass the site alias from emcp_list_sites.
04

Trust audit

BLOCKgrade D · trust 67/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (6 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
includes/class-filesystem-guard.php:94
'.netrc',
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
includes/class-filesystem-guard.php:95
'id_rsa',
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
includes/class-filesystem-guard.php:96
'id_ed25519',
Why it matters. touches a credential store
MEDIUMInventory / provenance · inv.binary · CWE-1104
includes/vendors/fremius/languages/freemius-cs_CZ.mo
freemius-cs_CZ.mo
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
includes/vendors/fremius/languages/freemius-da_DK.mo
freemius-da_DK.mo
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
includes/vendors/fremius/languages/freemius-de_DE.mo
freemius-de_DE.mo
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
includes/vendors/fremius/languages/freemius-es_ES.mo
freemius-es_ES.mo
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
includes/vendors/fremius/languages/freemius-fr_FR.mo
freemius-fr_FR.mo
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.hidden_file · CWE-1104
.freemius.env.example
.freemius.env.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitmodules
.gitmodules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/e2e/admin-subtabs.test.cjs:8
const source = fs.readFileSync(path.join(__dirname, '../../assets/js/admin.js'), 'utf8');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/e2e/bricks-landing.php:30
$artifact = __DIR__ . '/../../bricks-json/forma-landing.json';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/e2e/bricks-landing.php:32
$state_file = __DIR__ . '/../../bricks-json/forma-state.json';
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
CHANGELOG.md:567
- **`web_fetch` is SSRF-guarded.** The fetch runs on your server, so every URL (and **every redirect hop**, followed manually rather than by the HTTP client) is validated first: `http(s)` only, no emb
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
AGENTS.md:73
**5. OAuth loopback fix.** A CLI app registers `http://localhost:PORT` and returns on `http://127.0.0.1:PORT`. `EMCP_Tools_OAuth_Util::is_loopback_host()` now treats `localhost`/`127.0.0.1`/`::1` as o
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/McpbBuilderTest.php:56
$m = $this->manifest( 'http://192.168.1.10:8080' );
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/KIRKI-INTEGRATION.md:9
3. Implement native draft creation, graph editing, responsive styles, staged saves, publication and version restoration. Require fresh content hashes, native full access and WordPress capabilities.
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/OXYGEN-INTEGRATION.md:56
as native full access. Global writes also require `edit_theme_options`.
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
CHANGELOG.md:653
- **WordPress Users tools (beyond Elementor, domain 5).** Four MCP tools for safe user management: `list-users` and `get-user` (read; admin-gated, never expose passwords/auth data) plus `create-user`
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
readme.txt:614
* Added: WordPress Users tools (beyond Elementor, domain 5). Four MCP tools for safe user management: list-users and get-user (read; admin-gated, never expose passwords/auth data) plus create-user and
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
AGENTS.md:83
**Prior status: v3.7.0 (tagged) — the Sandbox Blocks + Agent Project Memory release.** Two Pro features: (1) **Gutenberg Block authoring in the Sandbox** — the Sandbox parent page is now a 3-card over
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
AGENTS.md:91
**Phase 2 (v3.13.0, BUILT + live-validated) — connector + migration.** A **Migrate** sub-tab pushes this site to a live server without a manual upload. The source (Pro) streams the `.emcp` to a standa
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:74
- New: **Agents can inspect a page's public front-end HTML** (#132). The read-only `get-page-html` tool accepts a same-origin URL or published post ID (defaulting to the front page), returns theme and
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/OTTER-INTEGRATION.md:19
Credentials, payment execution, form submission records, remote template sync and WooCommerce template assignment are outside this integration. WooCommerce block schemas can be discovered and authored
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-09-29 · audit v0.4.1 · source sha 3e00f64b76e6full audit observations/trust-audit/mcp-server/msrbuilds__elementor.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-293e00f64b76e6BLOCKD67first audit
06

Questions

What is the Elementor MCP server?

WordPress plugin that turns Elementor & WordPress into an MCP server. 500+ AI-ready tools for building, editing, and managing page designs programmatically.

What tools does Elementor expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Elementor safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (67/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Elementor need?

No credential environment variables were found in its source, so it appears to need none.

How does Elementor run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @msrbuilds/emcp-proxy at 1.11.0.

How current is this page?

The grade is for one exact copy of the source (3e00f64b76e6), read on 2026-09-29. The repository is watched and re-audited when it changes.

Advertisement