wp-code-review

This MCP server (wp-code-review) provides a lightweight way to fetch WordPress development guidelines, apply code validation rules, and perform security checks against a configurable external set of guidelines. It exposes three main tools: get_guidelines to fetch guidelines by category, validate_code to check code against the configured standards, and security_check to scan for common security issues. Once running, you can query or use Cursor to interact with these capabilities, enabling you to pull the latest guidelines from your hosted source and automatically validate your codebase according to those rules.

Prerequisites:

• Node.js v18+ installed
• Access to a host/CI where you’ll run the MCP server

Step-by-step:

1. Clone the repository:

git clone https://github.com/miniOrangeDev/wp-code-review-mcp-server.git
cd wp-code-review-mcp

2. Install dependencies and build:

npm install
npm run build

3. Host your guidelines:

• Place your guidelines under a web-accessible URL, for example: https://yourdomain.com/guidelines/
• Ensure the server will serve:
  • https://yourdomain.com/guidelines/guidelines.md
  • https://yourdomain.com/guidelines/validation-rules.md
  • https://yourdomain.com/guidelines/security-rules.md

4. Configure Cursor to point to your built MCP server:

{
  "mcpServers": {
    "wp-code-review-mcp": {
      "command": "node",
      "args": ["/path/to/wp-code-review-mcp-server/build/index.js"],
      "env": {
        "GUIDELINES_URL": "https://yourdomain.com/guidelines"
      }
    }
  }
}

Replace /path/to/wp-code-review-mcp-server with the actual path to your project (e.g., /home/wp-code-review-mcp-server).

5. Start testing in Cursor:

• Open a PHP file in Cursor
• Ask the AI: "Check this code for security issues: class mo_Test {}" to verify that the MCP server is connected and functioning.

Tips and notes:

• The server is designed to fetch guidelines from an external URL; set GUIDELINES_URL to the base URL hosting your guidelines files.
• After updating guidelines files, the MCP server will automatically use the updated rules without a restart (per the readme).
• If the MCP server isn’t visible in Cursor, restart Cursor to re-detect the local MCP server.
• Ensure your guidelines endpoints return the expected md files: guidelines.md, validation-rules.md, and security-rules.md.
• For production deployments, consider serving guidelines over HTTPS and securing access to the hosted resources.
• You can customize or expand guidelines by editing the sample-guidelines content in the repository; rebuild as needed.