wordpress/php-mcp-schema

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because that trigger can run with elevated repository context. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Repo bus factorcaution

All two recent commits came from one contributor, creating a concentrated maintenance dependency. The WordPress organizational backing provides some compensation, but no second recent contributor is shown.

Repo commit activitycaution

There were two commits in the last three months from one active maintainer. Recent work is present, but the low volume gives only limited evidence of sustained maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a process gap, though it does not by itself indicate unsafe package health.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap for a package intended for dependency use.