Wphealthkit MCP server
{
"mcpServers": {
"wphealthkit": {
"command": "npx",
"args": [
"-y",
"@wphealthkit/mcp-server@latest"
],
"env": {
"WPHK_API_KEY": "<wphk_api_key>",
"WPHK_API_URL": "https://..."
}
}
}
}{
"mcpServers": {
"wphealthkit": {
"command": "npx",
"args": [
"-y",
"@wphealthkit/mcp-server@latest"
],
"env": {
"WPHK_API_KEY": "<wphk_api_key>",
"WPHK_API_URL": "https://..."
}
}
}
}{
"mcpServers": {
"wphealthkit": {
"command": "npx",
"args": [
"-y",
"@wphealthkit/mcp-server@latest"
],
"env": {
"WPHK_API_KEY": "<wphk_api_key>",
"WPHK_API_URL": "https://..."
}
}
}
}{
"servers": {
"wphealthkit": {
"command": "npx",
"args": [
"-y",
"@wphealthkit/mcp-server@latest"
],
"env": {
"WPHK_API_KEY": "${input:wphk_api_key}",
"WPHK_API_URL": "${input:wphk_api_url}"
}
}
},
"inputs": [
{
"id": "wphk_api_key",
"type": "promptString",
"description": "Wphk api key",
"password": true
},
{
"id": "wphk_api_url",
"type": "promptString",
"description": "Wphk api url",
"password": true
}
]
}{
"mcpServers": {
"wphealthkit": {
"command": "npx",
"args": [
"-y",
"@wphealthkit/mcp-server@latest"
],
"env": {
"WPHK_API_KEY": "<wphk_api_key>",
"WPHK_API_URL": "https://..."
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @wphealthkit/mcp-serverversion 0.6.2
What it does
An MCP server that connects Claude and other AI assistants to WP HealthKit's WordPress plugin and theme security audit API. Developers use it to trigger audits, retrieve findings, get AI-ready fix prompts, and bulk-audit plugin directories without leaving their chat interface.
- Audit a WordPress plugin from wp.org or a local ZIP file to identify security vulnerabilities across 62 verification layers.
- Bulk-audit all plugins in a directory, get risk-level summaries and top findings grouped by severity.
- Retrieve AI-ready fix prompts for audit findings batched by severity level, then use them in coding workflows to address issues.
Tools this server exposes
| Tool | Does |
|---|---|
| audit_plugin | Trigger a security audit for a plugin by its wp.org slug, optionally specifying which audit engines to run. |
| audit_plugin_zip | Trigger a security audit from a local ZIP file, useful for unpublished or pre-release plugins. |
| audit_plugins_bulk | Audit all plugin ZIP files in a directory, batch submissions in groups of 10, and stream results with a final risk breakdown summary. |
| get_report | Poll the status and full results of a completed audit by its ID. |
| get_findings | Retrieve paginated findings from an audit, with optional filtering by severity and category. |
| get_fix_prompt | Get AI-ready fix prompts for an audit's findings, batched by severity level. |
| check_plugin | Look up a plugin's security grade, risk level, and findings count from the WordPress directory. |
| list_usage | Check current usage statistics including audits used this month, tier level, and account limits. |
| flag_finding | Flag a finding as a false positive for review by the WP HealthKit team; confirmed patterns update scanner rules for all future audits. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.