# WP HealthKit

**Category:** 🔒 Security  
**Repository:** https://github.com/BuiltByGo/wphealthkit-mcp  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/wp-healthkit-2

## Description
Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "wp-healthkit": {
    "command": "npx",
    "args": ["-y","wp-healthkit-2"]
  }
}
```

## Documentation & README

# @wphealthkit/mcp-server v0.4.0

An MCP (Model Context Protocol) server that gives AI assistants direct access to WP HealthKit's plugin audit API. Once configured, tools like Claude Desktop, Claude Code, and Cursor can trigger security audits, retrieve findings, fetch AI-ready fix prompts, bulk-audit entire plugin directories, and flag false positives — all without leaving the chat interface.

## Setup

### Required environment variable

```
WPHK_API_KEY=your_api_key_here
```

Get your API key from [wphealthkit.com/dashboard](https://wphealthkit.com/dashboard).

### Claude Desktop

Add the following to your `claude_desktop_config.json` (usually at `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):

```json
{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}
```

### Claude Code

Add to your project's `.mcp.json`:

```json
{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}
```

### Cursor

Open Cursor Settings > MCP > Add Server and use:

```json
{
  "wphealthkit": {
    "command": "npx",
    "args": ["-y", "@wphealthkit/mcp-server"],
    "env": {
      "WPHK_API_KEY": "your_api_key_here"
    }
  }
}
```

---

## Available tools

| Tool | Description |
|---|---|
| `audit_plugin` | Trigger a security audit for a wp.org plugin by slug. Returns an audit ID. |
| `audit_plugin_zip` | Trigger an audit from a local ZIP file. Returns an audit ID. |
| `audit_plugins_bulk` | Audit all plugin ZIP files in a local directory. Submits in batches of 10, streams results as each completes, and prints a final summary with risk breakdown and links to top findings. |
| `get_report` | Poll the status and full results of an audit by its ID. |
| `get_findings` | Get paginated findings, with optional filters for severity and category. |
| `get_fix_prompt` | Get AI-ready fix prompts for an audit's findings, batched by severity. |
| `check_plugin` | Look up a plugin's security grade, risk level, and findings count from the directory. |
| `list_usage` | Check your current usage — audits used this month, tier, and limits. |
| `flag_finding` | Flag a finding as a false positive. The report goes to the WP HealthKit team for review; confirmed patterns result in a scanner rule update that prevents that pattern in all future audits. |

---

## Tool reference

### `audit_plugin`

Triggers a security audit for any plugin hosted on wp.org.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `slug` | `string` | Yes | The wp.org plugin slug (e.g. `"contact-form-7"`). |
| `engines` | `string[]` | No | Audit engines to run. Defaults to all engines. |

**Example**

```javascript
audit_plugin({ slug: "contact-form-7" })
// Returns: { auditId: "abc-123", status: "queued" }
```

---

### `audit_plugin_zip`

Triggers an audit from a local ZIP file. Useful for plugins not on wp.org or pre-release builds.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `path` | `string` | Yes | Absolute path to the ZIP file on disk. |
| `engines` | `string[]` | No | Audit engines to run. Defaults to all engines. |

**Example**

```javascript
audit_plugin_zip({ path: "/Users/me/plugins/my-plugin.zip" })
// Returns: { auditId: "def-456", status: "queued" }
```

---

### `audit_plugins_bulk`

Audits all plugin ZIP files in a local directory. Submissions are batched in groups of 10. Results stream as each audit completes, and a final summary table is printed with a risk breakdown and links to top findings.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `directory` | `string` | Yes | Absolute path to the directory containing plugin ZIPs. |
| `engines` | `string[]` | No | Audit engines to run (e.g. `["performance"]`). Defaults to all engines. |
| `pattern` | `string` | No | Glob pattern to match files. Defaults to `"*.zip"`. |

**Example**

```javascript
audit_plugins_bulk({ directory: "/Users/me/plugins", engines: [] })
```

**Output**

Results stream to the conversation as each plugin completes. Once all audits finish, the tool prints a summary table:

```
Plugin                  Risk      Findings   Report
----------------------  --------  ---------  ----------------------------------------
my-plugin.zip           CRITICAL  14         https://wphealthkit.com/report/abc-123
another-plugin.zip      LOW       2          https://wphealthkit.com/report/def-456
legacy-plugin.zip       HIGH      7          https://wphealthkit.com/report/ghi-789

Summary: 3 plugins audited — 1 CRITICAL, 1 HIGH, 0 MEDIUM, 1 LOW
```

---

### `get_report`

Polls the status and full results of an audit. Call this after `audit_plugin` or `audit_plugin_zip` to wait for completion and retrieve the report.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `auditId` | `string` | Yes | The audit ID returned by `audit_plugin` or `audit_plugin_zip`. |

**Example**

```javascript
get_report({ auditId: "abc-123" })
// Returns: { status: "completed", grade: "C", riskLevel: "HIGH", findingsCount: 7, reportUrl: "..." }
```

---

### `get_findings`

Returns paginated findings for a completed audit. Supports filtering by severity and category.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `auditId` | `string` | Yes | The audit ID. |
| `severity` | `string` | No | Filter by severity: `"CRITICAL"`, `"HIGH"`, `"MEDIUM"`, or `"LOW"`. |
| `category` | `string` | No | Filter by category (e.g. `"xss"`, `"csrf"`, `"performance"`). |
| `page` | `number` | No | Page number for pagination. Defaults to `1`. |

**Example**

```javascript
get_findings({ auditId: "abc-123", severity: "CRITICAL" })
```

---

### `get_fix_prompt`

Returns AI-ready fix prompts for an audit's findings, grouped and batched by severity. Pass the output directly to a coding assistant to generate patches.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `auditId` | `string` | Yes | The audit ID. |
| `severity` | `string` | No | Limit prompts to a specific severity level. |

**Example**

```javascript
get_fix_prompt({ auditId: "abc-123", severity: "HIGH" })
```

---

### `check_plugin`

Looks up a plugin's current security grade, risk level, and findings count from the WP HealthKit directory without triggering a new audit.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `slug` | `string` | Yes | The wp.org plugin slug. |

**Example**

```javascript
check_plugin({ slug: "woocommerce" })
// Returns: { grade: "B", riskLevel: "MEDIUM", findingsCount: 3, lastAudited: "2026-04-20" }
```

---

### `list_usage`

Returns your current billing period usage — audits consumed, tier, and remaining quota.

**Parameters**

None.

**Example**

```javascript
list_usage()
// Returns: { auditsUsed: 47, auditsLimit: 100, tier: "pro", resetsAt: "2026-05-01" }
```

---

### `flag_finding`

Flags a finding as a false positive. The report is reviewed by the WP HealthKit team. If the pattern is confirmed as a false positive, the scanner rule is updated to prevent the same result from appearing in all future audits.

**Parameters**

| Parameter | Type | Required | Description |
|---|---|---|---|
| `auditId` | `string` | Yes | UUID of the audit containing the finding. |
| `findingId` | `string` | Yes | ID of the finding to flag (e.g. `"finding-12"`). |
| `findingTitle` | `string` | Yes | Title of the finding as shown in the report. |
| `reason` | `string` | No | Explanation of why this is a false positive. |

**Example**

```javascript
flag_finding({
  auditId: "abc-123-def-456",
  findingId: "finding-5",
  findingTitle: "Named arguments used in internal function call",
  reason: "These are positional args — the scanner is misidentifying the call signature"
})
// Returns: { flagged: true, reviewTicket: "FP-2891" }
```

---

## Usage flows

### Audit a single plugin and get fix prompts

```
audit_plugin({ slug: "my-plugin" })
  → get_report({ auditId: "..." })          // poll until status === "completed"
  → get_findings({ auditId: "...", severity: "CRITICAL" })
  → get_fix_prompt({ auditId: "..." })
```

### Audit all plugins in a local directory

```
audit_plugins_bulk({ directory: "/Users/me/plugins" })
  // streams per-plugin results as they complete
  // prints final summary table with risk breakdown
```

### Check a plugin before installing

```
check_plugin({ slug: "advanced-custom-fields" })
  // returns grade, risk level, and findings count without consuming an audit credit
```

### Flag a false positive after reviewing findings

```
get_findings({ auditId: "...", severity: "HIGH" })
  → flag_finding({
      auditId: "...",
      findingId: "finding-12",
      findingTitle: "Unescaped output in template",
      reason: "Output is escaped upstream via wp_kses before reaching this call"
    })
```

---

## Environment variables

| Variable | Default | Description |
|---|---|---|
| `WPHK_API_KEY` | — | Required. Your WP HealthKit API key. |
| `WPHK_API_URL` | `https://wphealthkit.com/api/v1` | Override to point at a self-hosted or staging instance. |

---

## License

MIT