wordpress/php-ai-client

Risky to adopt despite strong maintenance and WordPress backing: the package is actively developed, licensed, and clearly documented, but its name signal says it borrows the identity of the much more downloaded wordpress/php-mcp-schema package. Verify that this is the package you intended before installing it.

Latest 1.5.0

Packagist

48%

Total Score

Maintainer Stability

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package is flagged as borrowing the identity of wordpress/php-mcp-schema, which has far more monthly downloads, and it is not described as a fork or integration. Under this signal, consumers may most likely have intended the lookalike package instead.

Dangerous workflows

One of three workflows uses pull_request_target, which can require careful review because it handles untrusted pull-request context. No untrusted checkout or script injection was detected, limiting the concern.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning tooling is a modest transparency and maintenance concern, not evidence that the package is unsafe.

Security policy

The repository has no security policy. For an SDK that communicates with external AI providers, this leaves vulnerability-reporting expectations less clear.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

WordPress AI Team

Direct Dependencies

Dependency	Last Release	Score
nyholm/psr7 Version ^1.8	—	—
psr/http-client Version ^1.0	—	—
php-http/httplug Version ^2.0	—	—
psr/http-factory Version ^1.0	—	—
psr/http-message Version ^1.0 \|\| ^2.0	—	—