Skip to content

WP Update Radar

by updates.utilityhouse.xyz · remote · no sign-in to list tools · v1.0.1 · published by xyz.utilityhouse.updates

WordPress plugin release signals from public support threads, with evidence and explicit unknowns.

Changes · 2
CompareRegistry entry

2 tools: 2 change things.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http wp-update-radar https://updates.utilityhouse.xyz/mcp/registry

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnwp_update_radar_check_many

    The server marks "wp_update_radar_check_many" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "wp_update_radar_check_many" says "update": a word for a change.

    What this check looks for
  • Warnwp_update_radar_check

    The server marks "wp_update_radar_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "wp_update_radar_check" says "update": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

2 tools

Changes things 2Claude Code: ask
  • wp_update_radar_checkReports what wordpress.org's public support forum says about one plugin release, compared with the releases before it, counted the same way on both sides.1 finding

    Why it is in this group

    • The name "wp_update_radar_check" says "update": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "wp_update_radar_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "wp_update_radar_check" says "update": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Reports what wordpress.org's public support forum says about one plugin release, compared with the releases before it, counted the same way on both sides. It does not answer whether an update is safe: nothing here can see your site, your theme, your premium plugins or your PHP version. `state` is what the evidence supports doing, `signal` is only what was observed: HOLD elevated public signal for this release WAIT above this plugin's own normal, or the window is still open GUARDED_ROLLOUT no elevated public signal — roll out somewhere low-stakes first NOT_ENOUGH_EVIDENCE too little was attributable to judge; a gap here, NOT a finding about the release, and not a reason to reassure anyone The legacy `verdict` field keeps its five strings (known-bad / wait / update-now / too-new / insufficient-data) for clients that already read it. Use it before applying a plugin update, or when someone asks whether a specific version broke anything. Not a security advisory and not a CVE lookup: it reports what other site owners are saying, which is a different question from whether a release is vulnerable. wordpress.org plugins only — premium and paid plugins have no public forum to read, and themes are out of scope. Covers the most-installed plugins; one outside that set returns an error rather than a guess.

    Annotations the server declares

    • title: Check a WordPress plugin release
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • wp_update_radar_check_manyAnswers: which of this site's plugin updates are risky right now?1 finding

    Why it is in this group

    • The name "wp_update_radar_check_many" says "update": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "wp_update_radar_check_many" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "wp_update_radar_check_many" says "update": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Answers: which of this site's plugin updates are risky right now? Prefer this over the single check whenever there is more than one plugin to look at — a whole site's plugin list costs one call here instead of one call each. Same five verdicts as the single check (known-bad, wait, update-now, too-new, insufficient-data), per item and independent: a plugin that is not indexed reports its own error and the rest still answer. Returns a count of each verdict, so the risky ones can be found without reading every row. Up to 25 plugins per call; more than that is reported, not silently cut. `insufficient-data` means this service does not know, which is not the same as safe. Not a security advisory and not a CVE lookup: it reports what other site owners are saying, which is a different question from whether a release is vulnerable. wordpress.org plugins only — premium plugins have no public forum to read, and themes are out of scope.

    Annotations the server declares

    • title: Check multiple WordPress plugin releases
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http wp-update-radar https://updates.utilityhouse.xyz/mcp/registry

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__wp-update-radar__wp_update_radar_check_many",
      "mcp__wp-update-radar__wp_update_radar_check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as wp-update-radar. Review it before you use it.