wxgzh-mcp

微信公众号草稿创建与管理技能，支持图片上传、创建草稿、发布等操作。需配置 AppID、AppSecret、白名单 IP。

Security Scan

The skill's code mostly matches its WeChat-draft-management description, but there are several coherence and operational concerns (missing Dockerfile, undeclared credentials in registry metadata, and a network service exposure) that merit caution before installing.

Purpose & Capability

The code and SKILL.md implement WeChat Official Account draft and media management as advertised (token, upload, create/list/delete/publish drafts). However the registry metadata claims no required credentials/env vars while the runtime requires a config.json containing AppID and AppSecret — the skill expects sensitive credentials but did not declare them in the registry metadata.

Instruction Scope

Runtime instructions stay within the stated purpose (use WeChat APIs, upload images, create drafts). The SKILL.md also instructs querying a public IP service (api.ipify.org) to set a WeChat whitelist — this is expected for WeChat API use. One oddity: docker-compose is provided but SKILL.md primarily shows pip-based local runs; the compose file would mount host config and uploads, which is reasonable but increases surface area.

Install Mechanism

The package is instruction-only (no automated install spec), with a requirements.txt listing fastmcp and requests (expected). However docker-compose.yml references building the image from '.' but no Dockerfile is present in the repository manifest — attempting docker-compose build will likely fail. The inclusion of docker-compose (and a mount of config.json and uploads) without a Dockerfile or clear build instructions is an operational inconsistency.

Credentials

The skill legitimately needs AppID and AppSecret for the WeChat API and expects them in a plaintext config.json or via WECHAT_MCP_CONFIG env var (docker-compose sets this). That access is proportionate to the purpose. Note: registry metadata did not declare required credentials; also the secrets are stored in a config file that the docker-compose mounts from the host (read-only) — users should ensure the file is protected and not placed in a shared location.

Persistence & Privilege

The code runs an MCP server (FastMCP) and docker-compose exposes port 8765. While the skill does not set always: true or modify other skills, starting a network service on the host/container increases attack surface and could expose the tool remotely if deployed without firewalling. This is expected for an MCP service but worth explicit attention.

What to consider before installing

This skill appears to implement the advertised WeChat draft and media features, but review these before installing: 1) Provide AppID/AppSecret only via a secure config.json and do not store the file in an unsecured/shared folder; the registry metadata did not declare these credentials so verify config handling. 2) The repo includes docker-compose.yml but no Dockerfile in the manifest — docker-compose build may fail; ask the author for the Dockerfile or use the pip-based instructions in README/SKILL.md instead. 3) Running this will start a FastMCP server and (per compose) expose port 8765 — run inside an isolated environment or restrict network access. 4) Verify the fastmcp package source and version before installing (supply-chain risk). 5) If you must run it, do so in a container/VM with limited privileges, keep config.json protected, and avoid mounting host directories with sensitive data.

wxgzh-mcp · 微信公众号草稿管理技能

功能列表

工具	说明
get_access_token	获取 Access Token
upload_thumb	上传封面图
upload_image	上传正文图片
create_draft	创建草稿文章
list_drafts	获取草稿列表
delete_draft	删除草稿
publish_draft	发布草稿（需认证账号）

文件结构

wxgzh-mcp/
├── SKILL.md              # 本说明文件
├── README.md             # 详细使用指南
├── config.json           # 配置文件（用户填写）
├── src/
│   ├── main.py           # 技能入口
│   ├── config.py         # 配置管理
│   ├── wechat_api.py     # 微信 API 封装
│   └── tools/
│       ├── token.py      # Token 工具
│       ├── media.py      # 媒体上传工具
│       └── draft.py       # 草稿管理工具
├── docker-compose.yml     # Docker 部署
└── requirements.txt       # Python 依赖

快速开始

第一步：配置白名单

本机 IP（用于 API 调用）需要加入微信公众号白名单。

查询本机 IP： 访问 https://api.ipify.org 或联系管理员获取。

添加白名单：

1. 登录 微信公众平台
2. 设置与开发 → 基本配置
3. IP 白名单 → 添加 IP

第二步：填写配置

在 config.json 中填入你的公众号信息：

{
  "app_id": "wx1234567890abcdef",
  "app_secret": "你的AppSecret",
  "proxy": null
}

第三步：安装依赖并测试

cd wxgzh-mcp
pip install -r requirements.txt

# 测试 Token 获取
python -c "from src.wechat_api import WeChatAPI; api = WeChatAPI(); print(api.get_access_token())"

第四步：创建草稿

from src.wechat_api import WeChatAPI

api = WeChatAPI()

# 上传封面图（需先准备图片）
thumb_result = api.upload_thumb("封面图路径.jpg")
thumb_media_id = thumb_result["media_id"]

# 创建草稿
result = api.add_draft(
    title="文章标题",
    content="<p>正文内容 HTML</p>",
    author="作者名",
    thumb_media_id=thumb_media_id,
    digest="摘要"
)

draft_media_id = result["media_id"]
print(f"草稿创建成功: {draft_media_id}")

常见问题

错误 40164：IP 不在白名单

• 解决方案：参见第一步「配置白名单」

错误 45003：标题/作者超出限制

• 标题最多 64 字符
• 作者最多 8 字符

错误 48001：API 未授权

• 个人订阅号无法使用群发 API
• 草稿功能正常，可手动发布

注意事项

• Access Token 有效期 2 小时，模块自动缓存
• 图片格式支持 JPG、PNG，大小限制 2MB
• 封面图必须先上传获取 media_id 才能创建草稿