Is the WP HealthKit MCP server free to use?

Yes. WP HealthKit is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

Is the WP HealthKit MCP server free to use?

Yes. WP HealthKit is listed on AllMCPs as a free, open Model Context Protocol server you can install into Claude Desktop, Cursor, or any MCP-compatible client.

WP HealthKit

Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Install Config Generator

Choose your client

claude_desktop_config.json

{
  "mcpServers": {
    "wp-healthkit-2": {
      "command": "npx",
      "args": [
        "-y",
        "wp-healthkit-2"
      ]
    }
  }
}

💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Documentation Overview

@wphealthkit/mcp-server v0.4.0

An MCP (Model Context Protocol) server that gives AI assistants direct access to WP HealthKit's plugin audit API. Once configured, tools like Claude Desktop, Claude Code, and Cursor can trigger security audits, retrieve findings, fetch AI-ready fix prompts, bulk-audit entire plugin directories, and flag false positives — all without leaving the chat interface.

Setup

Required environment variable

Code

WPHK_API_KEY=your_api_key_here

Get your API key from wphealthkit.com/dashboard.

Claude Desktop

Add the following to your claude_desktop_config.json (usually at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

config.json

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Claude Code

Add to your project's .mcp.json:

config.json

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Cursor

Open Cursor Settings > MCP > Add Server and use:

config.json

{
  "wphealthkit": {
    "command": "npx",
    "args": ["-y", "@wphealthkit/mcp-server"],
    "env": {
      "WPHK_API_KEY": "your_api_key_here"
    }
  }
}

Available tools

Tool	Description
`audit_plugin`	Trigger a security audit for a wp.org plugin by slug. Returns an audit ID.
`audit_plugin_zip`	Trigger an audit from a local ZIP file. Returns an audit ID.
`audit_plugins_bulk`	Audit all plugin ZIP files in a local directory. Submits in batches of 10, streams results as each completes, and prints a final summary with risk breakdown and links to top findings.
`get_report`	Poll the status and full results of an audit by its ID.
`get_findings`	Get paginated findings, with optional filters for severity and category.
`get_fix_prompt`	Get AI-ready fix prompts for an audit's findings, batched by severity.
`check_plugin`	Look up a plugin's security grade, risk level, and findings count from the directory.
`list_usage`	Check your current usage — audits used this month, tier, and limits.
`flag_finding`	Flag a finding as a false positive. The report goes to the WP HealthKit team for review; confirmed patterns result in a scanner rule update that prevents that pattern in all future audits.

Tool reference

`audit_plugin`

Triggers a security audit for any plugin hosted on wp.org.

Parameters

Parameter	Type	Required	Description
`slug`	`string`	Yes	The wp.org plugin slug (e.g. `"contact-form-7"`).
`engines`	`string[]`	No	Audit engines to run. Defaults to all engines.

Example

javascript

audit_plugin({ slug: "contact-form-7" })
// Returns: { auditId: "abc-123", status: "queued" }

`audit_plugin_zip`

Triggers an audit from a local ZIP file. Useful for plugins not on wp.org or pre-release builds.

Parameters

Parameter	Type	Required	Description
`path`	`string`	Yes	Absolute path to the ZIP file on disk.
`engines`	`string[]`	No	Audit engines to run. Defaults to all engines.

Example

javascript

audit_plugin_zip({ path: "/Users/me/plugins/my-plugin.zip" })
// Returns: { auditId: "def-456", status: "queued" }

`audit_plugins_bulk`

Audits all plugin ZIP files in a local directory. Submissions are batched in groups of 10. Results stream as each audit completes, and a final summary table is printed with a risk breakdown and links to top findings.

Parameters

Parameter	Type	Required	Description
`directory`	`string`	Yes	Absolute path to the directory containing plugin ZIPs.
`engines`	`string[]`	No	Audit engines to run (e.g. `["performance"]`). Defaults to all engines.
`pattern`	`string`	No	Glob pattern to match files. Defaults to `"*.zip"`.

Example

javascript

audit_plugins_bulk({ directory: "/Users/me/plugins", engines: [] })

Output

Results stream to the conversation as each plugin completes. Once all audits finish, the tool prints a summary table:

Code

Plugin                  Risk      Findings   Report
----------------------  --------  ---------  ----------------------------------------
my-plugin.zip           CRITICAL  14         https://wphealthkit.com/report/abc-123
another-plugin.zip      LOW       2          https://wphealthkit.com/report/def-456
legacy-plugin.zip       HIGH      7          https://wphealthkit.com/report/ghi-789

Summary: 3 plugins audited — 1 CRITICAL, 1 HIGH, 0 MEDIUM, 1 LOW

`get_report`

Polls the status and full results of an audit. Call this after audit_plugin or audit_plugin_zip to wait for completion and retrieve the report.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID returned by `audit_plugin` or `audit_plugin_zip`.

Example

javascript

get_report({ auditId: "abc-123" })
// Returns: { status: "completed", grade: "C", riskLevel: "HIGH", findingsCount: 7, reportUrl: "..." }

`get_findings`

Returns paginated findings for a completed audit. Supports filtering by severity and category.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID.
`severity`	`string`	No	Filter by severity: `"CRITICAL"`, `"HIGH"`, `"MEDIUM"`, or `"LOW"`.
`category`	`string`	No	Filter by category (e.g. `"xss"`, `"csrf"`, `"performance"`).
`page`	`number`	No	Page number for pagination. Defaults to `1`.

Example

javascript

get_findings({ auditId: "abc-123", severity: "CRITICAL" })

`get_fix_prompt`

Returns AI-ready fix prompts for an audit's findings, grouped and batched by severity. Pass the output directly to a coding assistant to generate patches.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID.
`severity`	`string`	No	Limit prompts to a specific severity level.

Example

javascript

get_fix_prompt({ auditId: "abc-123", severity: "HIGH" })

`check_plugin`

Looks up a plugin's current security grade, risk level, and findings count from the WP HealthKit directory without triggering a new audit.

Parameters

Parameter	Type	Required	Description
`slug`	`string`	Yes	The wp.org plugin slug.

Example

javascript

check_plugin({ slug: "woocommerce" })
// Returns: { grade: "B", riskLevel: "MEDIUM", findingsCount: 3, lastAudited: "2026-04-20" }

`list_usage`

Returns your current billing period usage — audits consumed, tier, and remaining quota.

Parameters

None.

Example

javascript

list_usage()
// Returns: { auditsUsed: 47, auditsLimit: 100, tier: "pro", resetsAt: "2026-05-01" }

`flag_finding`

Flags a finding as a false positive. The report is reviewed by the WP HealthKit team. If the pattern is confirmed as a false positive, the scanner rule is updated to prevent the same result from appearing in all future audits.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	UUID of the audit containing the finding.
`findingId`	`string`	Yes	ID of the finding to flag (e.g. `"finding-12"`).
`findingTitle`	`string`	Yes	Title of the finding as shown in the report.
`reason`	`string`	No	Explanation of why this is a false positive.

Example

javascript

flag_finding({
  auditId: "abc-123-def-456",
  findingId: "finding-5",
  findingTitle: "Named arguments used in internal function call",
  reason: "These are positional args — the scanner is misidentifying the call signature"
})
// Returns: { flagged: true, reviewTicket: "FP-2891" }

Usage flows

Audit a single plugin and get fix prompts

Code

audit_plugin({ slug: "my-plugin" })
  → get_report({ auditId: "..." })          // poll until status === "completed"
  → get_findings({ auditId: "...", severity: "CRITICAL" })
  → get_fix_prompt({ auditId: "..." })

Audit all plugins in a local directory

Code

audit_plugins_bulk({ directory: "/Users/me/plugins" })
  // streams per-plugin results as they complete
  // prints final summary table with risk breakdown

Check a plugin before installing

Code

check_plugin({ slug: "advanced-custom-fields" })
  // returns grade, risk level, and findings count without consuming an audit credit

Flag a false positive after reviewing findings

Code

get_findings({ auditId: "...", severity: "HIGH" })
  → flag_finding({
      auditId: "...",
      findingId: "finding-12",
      findingTitle: "Unescaped output in template",
      reason: "Output is escaped upstream via wp_kses before reaching this call"
    })

Environment variables

Variable	Default	Description
`WPHK_API_KEY`	—	Required. Your WP HealthKit API key.
`WPHK_API_URL`	`https://wphealthkit.com/api/v1`	Override to point at a self-hosted or staging instance.

License

MIT

Related MCP Servers

View all in Security View all alternatives

Frequently Asked Questions about WP HealthKit

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "wp-healthkit": { "command": "npx", "args": ["-y", "WP HealthKit"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/wp-healthkit-2?style=directory)](https://allmcps.com/mcp/wp-healthkit-2)

HTML Embed

<a href="https://allmcps.com/mcp/wp-healthkit-2"><img src="https://allmcps.com/api/badge/wp-healthkit-2?style=directory" alt="WP HealthKit on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

AllMCPs Server

The official MCP server for AllMCPs.com - submit and manage tools directly from your AI. The open directory for MCP servers. Connect Claude, Cursor, Windsurf, and AI agents to databases, tools, files, and APIs. Explore 3,181+ servers. AllMCPs is the premier, open directory for discovering, evaluating, and installing Model Context Protocol (MCP) servers to equip AI agents and LLMs with real-world superpowers.

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge.

Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to WP HealthKit →Install in Claude Desktop Install in Cursor Install in VS Code

WP HealthKit

Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Install Config Generator

Choose your client

claude_desktop_config.json

{
  "mcpServers": {
    "wp-healthkit-2": {
      "command": "npx",
      "args": [
        "-y",
        "wp-healthkit-2"
      ]
    }
  }
}

💡 Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)

Documentation Overview

@wphealthkit/mcp-server v0.4.0

Setup

Required environment variable

Code

WPHK_API_KEY=your_api_key_here

Get your API key from wphealthkit.com/dashboard.

Claude Desktop

Add the following to your claude_desktop_config.json (usually at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

config.json

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Claude Code

Add to your project's .mcp.json:

config.json

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Cursor

Open Cursor Settings > MCP > Add Server and use:

config.json

{
  "wphealthkit": {
    "command": "npx",
    "args": ["-y", "@wphealthkit/mcp-server"],
    "env": {
      "WPHK_API_KEY": "your_api_key_here"
    }
  }
}

Available tools

Tool	Description
`audit_plugin`	Trigger a security audit for a wp.org plugin by slug. Returns an audit ID.
`audit_plugin_zip`	Trigger an audit from a local ZIP file. Returns an audit ID.
`audit_plugins_bulk`	Audit all plugin ZIP files in a local directory. Submits in batches of 10, streams results as each completes, and prints a final summary with risk breakdown and links to top findings.
`get_report`	Poll the status and full results of an audit by its ID.
`get_findings`	Get paginated findings, with optional filters for severity and category.
`get_fix_prompt`	Get AI-ready fix prompts for an audit's findings, batched by severity.
`check_plugin`	Look up a plugin's security grade, risk level, and findings count from the directory.
`list_usage`	Check your current usage — audits used this month, tier, and limits.
`flag_finding`	Flag a finding as a false positive. The report goes to the WP HealthKit team for review; confirmed patterns result in a scanner rule update that prevents that pattern in all future audits.

Tool reference

`audit_plugin`

Triggers a security audit for any plugin hosted on wp.org.

Parameters

Parameter	Type	Required	Description
`slug`	`string`	Yes	The wp.org plugin slug (e.g. `"contact-form-7"`).
`engines`	`string[]`	No	Audit engines to run. Defaults to all engines.

Example

javascript

audit_plugin({ slug: "contact-form-7" })
// Returns: { auditId: "abc-123", status: "queued" }

`audit_plugin_zip`

Triggers an audit from a local ZIP file. Useful for plugins not on wp.org or pre-release builds.

Parameters

Parameter	Type	Required	Description
`path`	`string`	Yes	Absolute path to the ZIP file on disk.
`engines`	`string[]`	No	Audit engines to run. Defaults to all engines.

Example

javascript

audit_plugin_zip({ path: "/Users/me/plugins/my-plugin.zip" })
// Returns: { auditId: "def-456", status: "queued" }

`audit_plugins_bulk`

Parameters

Parameter	Type	Required	Description
`directory`	`string`	Yes	Absolute path to the directory containing plugin ZIPs.
`engines`	`string[]`	No	Audit engines to run (e.g. `["performance"]`). Defaults to all engines.
`pattern`	`string`	No	Glob pattern to match files. Defaults to `"*.zip"`.

Example

javascript

audit_plugins_bulk({ directory: "/Users/me/plugins", engines: [] })

Output

Results stream to the conversation as each plugin completes. Once all audits finish, the tool prints a summary table:

Code

Plugin                  Risk      Findings   Report
----------------------  --------  ---------  ----------------------------------------
my-plugin.zip           CRITICAL  14         https://wphealthkit.com/report/abc-123
another-plugin.zip      LOW       2          https://wphealthkit.com/report/def-456
legacy-plugin.zip       HIGH      7          https://wphealthkit.com/report/ghi-789

Summary: 3 plugins audited — 1 CRITICAL, 1 HIGH, 0 MEDIUM, 1 LOW

`get_report`

Polls the status and full results of an audit. Call this after audit_plugin or audit_plugin_zip to wait for completion and retrieve the report.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID returned by `audit_plugin` or `audit_plugin_zip`.

Example

javascript

get_report({ auditId: "abc-123" })
// Returns: { status: "completed", grade: "C", riskLevel: "HIGH", findingsCount: 7, reportUrl: "..." }

`get_findings`

Returns paginated findings for a completed audit. Supports filtering by severity and category.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID.
`severity`	`string`	No	Filter by severity: `"CRITICAL"`, `"HIGH"`, `"MEDIUM"`, or `"LOW"`.
`category`	`string`	No	Filter by category (e.g. `"xss"`, `"csrf"`, `"performance"`).
`page`	`number`	No	Page number for pagination. Defaults to `1`.

Example

javascript

get_findings({ auditId: "abc-123", severity: "CRITICAL" })

`get_fix_prompt`

Returns AI-ready fix prompts for an audit's findings, grouped and batched by severity. Pass the output directly to a coding assistant to generate patches.

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	The audit ID.
`severity`	`string`	No	Limit prompts to a specific severity level.

Example

javascript

get_fix_prompt({ auditId: "abc-123", severity: "HIGH" })

`check_plugin`

Looks up a plugin's current security grade, risk level, and findings count from the WP HealthKit directory without triggering a new audit.

Parameters

Parameter	Type	Required	Description
`slug`	`string`	Yes	The wp.org plugin slug.

Example

javascript

check_plugin({ slug: "woocommerce" })
// Returns: { grade: "B", riskLevel: "MEDIUM", findingsCount: 3, lastAudited: "2026-04-20" }

`list_usage`

Returns your current billing period usage — audits consumed, tier, and remaining quota.

Parameters

None.

Example

javascript

list_usage()
// Returns: { auditsUsed: 47, auditsLimit: 100, tier: "pro", resetsAt: "2026-05-01" }

`flag_finding`

Parameters

Parameter	Type	Required	Description
`auditId`	`string`	Yes	UUID of the audit containing the finding.
`findingId`	`string`	Yes	ID of the finding to flag (e.g. `"finding-12"`).
`findingTitle`	`string`	Yes	Title of the finding as shown in the report.
`reason`	`string`	No	Explanation of why this is a false positive.

Example

javascript

flag_finding({
  auditId: "abc-123-def-456",
  findingId: "finding-5",
  findingTitle: "Named arguments used in internal function call",
  reason: "These are positional args — the scanner is misidentifying the call signature"
})
// Returns: { flagged: true, reviewTicket: "FP-2891" }

Usage flows

Audit a single plugin and get fix prompts

Code

audit_plugin({ slug: "my-plugin" })
  → get_report({ auditId: "..." })          // poll until status === "completed"
  → get_findings({ auditId: "...", severity: "CRITICAL" })
  → get_fix_prompt({ auditId: "..." })

Audit all plugins in a local directory

Code

audit_plugins_bulk({ directory: "/Users/me/plugins" })
  // streams per-plugin results as they complete
  // prints final summary table with risk breakdown

Check a plugin before installing

Code

check_plugin({ slug: "advanced-custom-fields" })
  // returns grade, risk level, and findings count without consuming an audit credit

Flag a false positive after reviewing findings

Code

get_findings({ auditId: "...", severity: "HIGH" })
  → flag_finding({
      auditId: "...",
      findingId: "finding-12",
      findingTitle: "Unescaped output in template",
      reason: "Output is escaped upstream via wp_kses before reaching this call"
    })

Environment variables

Variable	Default	Description
`WPHK_API_KEY`	—	Required. Your WP HealthKit API key.
`WPHK_API_URL`	`https://wphealthkit.com/api/v1`	Override to point at a self-hosted or staging instance.

License

MIT

Related MCP Servers

View all in Security View all alternatives

Frequently Asked Questions about WP HealthKit

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "wp-healthkit": { "command": "npx", "args": ["-y", "WP HealthKit"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/wp-healthkit-2?style=directory)](https://allmcps.com/mcp/wp-healthkit-2)

HTML Embed

<a href="https://allmcps.com/mcp/wp-healthkit-2"><img src="https://allmcps.com/api/badge/wp-healthkit-2?style=directory" alt="WP HealthKit on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

27Quality signal: Emerging · 27/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership8/20

Documentation & tools11/30

Adoption & activity1/15

Community engagement0/10

★ Featured

AllMCPs Server

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to get the verified badge.

Free dofollow backlink: after claiming, verify your product site and place a dofollow AllMCPs badge — we recheck it stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to WP HealthKit →Install in Claude Desktop Install in Cursor Install in VS Code