claudeus_wp_users__list_app_passwords

What claudeus_wp_users__list_app_passwords does on Claudeus WordPress MCP

AI agents call claudeus_wp_users__list_app_passwords to retrieve information from Claudeus WordPress MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why claudeus_wp_users__list_app_passwords is rated Low

This is a Read operation—it retrieves and queries application password metadata. However, the severity is elevated to 'high' because application passwords are sensitive authentication credentials. Exposing a list of valid app passwords and their usage patterns gives an attacker reconnaissance data for potential credential compromise, impersonation attacks, or lateral movement within WordPress.

From the tool's definition Tool name contains 'list' and description states 'List all application passwords for a user. Shows all active application passwords and when they were last used.' This is a retrieval operation with no modification.

The rule that runs claudeus_wp_users__list_app_passwords safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Claudeus WordPress MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For claudeus_wp_users__list_app_passwords, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "claudeus_wp_users__list_app_passwords": {}
  }
}

Questions about claudeus_wp_users__list_app_passwords