WordPress DevDocsSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your AI coding assistant a verified WordPress hook database instead of letting it guess.
wp-devdocs-mcp is a local MCP server that indexes every action, filter, block registration, and JS API call from WordPress, WooCommerce, Gutenberg, or any plugin you work with. It gives AI tools like Claude Code a verified database to search and validate against instead of relying on training data.
Works with Claude Code, Cursor, Windsurf, and any MCP-compatible client.
Why This Exists
AI coding assistants are changing how we build WordPress plugins. Tools like Claude Code, Cursor, and Windsurf can scaffold entire plugins in minutes — but they all share the same blind spot: hook names come from training data, not from the actual source code.
Most of the time this works fine. Models like Claude Sonnet nail common hooks almost every time. But "most of the time" isn't good enough when you're shipping production code, and not every model is Claude Sonnet. Across the landscape of LLMs doing code generation today:
- Some models invent hooks that don't exist —
woocommerce_email_after_order_detailssounds right but isn't real - Some use deprecated namespaces —
wp.editor.InspectorControlsinstead ofwp.blockEditor.InspectorControls - Most miss newer hooks — suggesting
pre_get_postsfor WooCommerce order queries when HPOS useswoocommerce_order_list_table_prepare_items_query_args - Parameters get mixed up — wrong argument count or order in callback signatures
- No model knows your custom plugins — private or proprietary hooks are invisible to every model's training data
The core issue is simple: we can't rely 100% on any model to produce correct WordPress hook names from memory alone. Even the bes
c9d00ffc9408OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wp-devdocs-mcp --env GEMINI_API_KEY=${GEMINI_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"wp-devdocs-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}"
}
}
}
}Exposed tools (9)
8 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_doc | read | Get the full content of a WordPress documentation page by its ID (numeric) or slug. Returns the complete markdown content along with metadata. |
get_hook_context | read | Get full surrounding code context for a specific WordPress hook. Provide a hook ID (from search results) or exact hook name. Returns the code window around the hook, including the enclosing function, docblock, and parameters. |
get_theme_json_property | read | Get the full spec for a specific theme.json property path. Accepts global paths (e.g. |
list_docs | read | List available WordPress documentation pages, optionally filtered by type, category, or source. Returns titles and slugs grouped by category. Use search_docs for full-text search or get_doc to read a specific page. Tip: filter by category for complete listings — unfiltered results may be truncated. |
search_block_apis | read | Search WordPress block registrations and JavaScript API usages (wp.blocks.*, wp.editor.*, wp.blockEditor.*, etc.) across all indexed sources. |
search_docs | read | Search WordPress official documentation (handbooks, REST API docs, WP-CLI reference, block editor guides, etc.) using full-text search. Returns BM25-ranked results. Use get_doc to retrieve full content for a specific result. |
search_hooks | read | Search WordPress hooks (actions/filters) across all indexed sources using full-text search. Returns BM25-ranked results with file locations, parameters, and descriptions. |
search_theme_json_properties | write | Search valid theme.json property paths so you can stop guessing block-theme keys. Returns BM25-ranked paths with descriptions and value origin (enum / boolean / css_length / css_color / css_keyword / preset_ref:{type} / string / object / array / alias). Use this BEFORE writing any theme.json file. |
validate_hook | read | Check if a WordPress hook name is valid (exists in indexed sources). Returns VALID, NOT_FOUND, or REMOVED status with similar suggestions when not found. Use this to prevent hook name hallucination. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
import { CACHE_DIR } from '../../constants.js';import { CACHE_DIR } from '../../constants.js';} from '../../db/sqlite.js';
import { CACHE_DIR } from '../../constants.js';import { getDoc } from '../../db/sqlite.js';@modelcontextprotocol/sdk, better-sqlite3, commander, dotenv, fast-glob, simple-git, zod, @anthropic-ai/sdk
Gates applied: no_behavioural_pass.
c9d00ffc9408full audit observations/trust-audit/mcp-server/pluginslab__wordpress-devdocs.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | c9d00ffc9408 | SAFE | B | 89 | first audit |
Questions
What tools does WordPress DevDocs expose?
9 in total: 8 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is WordPress DevDocs safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does WordPress DevDocs need?
It reads GEMINI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does WordPress DevDocs run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as wp-devdocs-mcp at 1.2.0.
How current is this page?
The grade is for one exact copy of the source (c9d00ffc9408), read on 2026-10-07. The repository is watched and re-audited when it changes.