WP HealthKit

com.wphealthkitPublished by wphealthkit.comOfficial publisherv0.6.4Updated Oct 24, 2026

Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs WP HealthKit security audits on WordPress plugins and themes, returning findings, grades, fix prompts and bulk risk summaries.

What you can do
  • Trigger audits of wp.org plugins by slug, of a local plugin ZIP, or of every ZIP in a directory in batches
  • Poll audit status and read full reports, grades and risk levels
  • List findings with severity and category filters and pagination
  • Fetch AI-ready fix prompts grouped by severity for a coding assistant
  • Look up an existing plugin's grade and findings count without spending an audit
  • Check monthly usage and quota, and flag findings as false positives
When to use it
Useful when reviewing WordPress plugins for security before installing or shipping them, when you want audit findings turned into fix prompts inside a coding assistant, or when you need to bulk-screen a directory of plugin ZIPs.
Requirements
A WP HealthKit API key supplied as the WPHK_API_KEY environment variable, obtained from the provider's dashboard. Runs either as a remote endpoint or locally via npx with Node.js. OAuth authentication is declared. An optional WPHK_API_URL variable can point at a self-hosted or staging instance.
Before you install
The API key is a secret passed in the environment; keep it out of shared config files. Audits consume a monthly quota tied to your tier, so bulk runs can use it up. Local ZIP and directory paths are sent to the service for scanning. Flagging a finding submits a report to the WP HealthKit team for review.

Installation

In SourceWeft

  1. Open WP HealthKit in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.wphealthkit%2Fmcp-server/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "wp-healthkit": {
      "type": "http",
      "url": "https://mcp.wphealthkit.com/mcp"
    }
  }
}

README

@wphealthkit/mcp-server v0.4.0

An MCP (Model Context Protocol) server that gives AI assistants direct access to WP HealthKit's plugin audit API. Once configured, tools like Claude Desktop, Claude Code, and Cursor can trigger security audits, retrieve findings, fetch AI-ready fix prompts, bulk-audit entire plugin directories, and flag false positives — all without leaving the chat interface.

Setup

Required environment variable

WPHK_API_KEY=your_api_key_here

Get your API key from wphealthkit.com/dashboard.

Claude Desktop

Add the following to your claude_desktop_config.json (usually at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

json
{  "mcpServers": {    "wphealthkit": {      "command": "npx",      "args": ["-y", "@wphealthkit/mcp-server"],      "env": {        "WPHK_API_KEY": "your_api_key_here"      }    }  }}

Claude Code

Add to your project's .mcp.json:

json
{  "mcpServers": {    "wphealthkit": {      "command": "npx",      "args": ["-y", "@wphealthkit/mcp-server"],      "env": {        "WPHK_API_KEY": "your_api_key_here"      }    }  }}

Cursor

Open Cursor Settings > MCP > Add Server and use:

json
{  "wphealthkit": {    "command": "npx",    "args": ["-y", "@wphealthkit/mcp-server"],    "env": {      "WPHK_API_KEY": "your_api_key_here"    }  }}

Available tools

ToolDescription
audit_pluginTrigger a security audit for a wp.org plugin by slug. Returns an audit ID.
audit_plugin_zipTrigger an audit from a local ZIP file. Returns an audit ID.
audit_plugins_bulkAudit all plugin ZIP files in a local directory. Submits in batches of 10, streams results as each completes, and prints a final summary with risk breakdown and links to top findings.
get_reportPoll the status and full results of an audit by its ID.
get_findingsGet paginated findings, with optional filters for severity and category.
get_fix_promptGet AI-ready fix prompts for an audit's findings, batched by severity.
check_pluginLook up a plugin's security grade, risk level, and findings count from the directory.
list_usageCheck your current usage — audits used this month, tier, and limits.
flag_findingFlag a finding as a false positive. The report goes to the WP HealthKit team for review; confirmed patterns result in a scanner rule update that prevents that pattern in all future audits.

Tool reference

audit_plugin

Triggers a security audit for any plugin hosted on wp.org.

Parameters

ParameterTypeRequiredDescription
slugstringYesThe wp.org plugin slug (e.g. "contact-form-7").
enginesstring[]NoAudit engines to run. Defaults to all engines.

Example

javascript
audit_plugin({ slug: "contact-form-7" })// Returns: { auditId: "abc-123", status: "queued" }

audit_plugin_zip

Triggers an audit from a local ZIP file. Useful for plugins not on wp.org or pre-release builds.

Parameters

ParameterTypeRequiredDescription
pathstringYesAbsolute path to the ZIP file on disk.
enginesstring[]NoAudit engines to run. Defaults to all engines.

Example

javascript
audit_plugin_zip({ path: "/Users/me/plugins/my-plugin.zip" })// Returns: { auditId: "def-456", status: "queued" }

audit_plugins_bulk

Audits all plugin ZIP files in a local directory. Submissions are batched in groups of 10. Results stream as each audit completes, and a final summary table is printed with a risk breakdown and links to top findings.

Parameters

ParameterTypeRequiredDescription
directorystringYesAbsolute path to the directory containing plugin ZIPs.
enginesstring[]NoAudit engines to run (e.g. ["performance"]). Defaults to all engines.
patternstringNoGlob pattern to match files. Defaults to "*.zip".

Example

javascript
audit_plugins_bulk({ directory: "/Users/me/plugins", engines: [] })

Output

Results stream to the conversation as each plugin completes. Once all audits finish, the tool prints a summary table:

Plugin                  Risk      Findings   Report----------------------  --------  ---------  ----------------------------------------my-plugin.zip           CRITICAL  14         https://wphealthkit.com/report/abc-123another-plugin.zip      LOW       2          https://wphealthkit.com/report/def-456legacy-plugin.zip       HIGH      7          https://wphealthkit.com/report/ghi-789
Summary: 3 plugins audited — 1 CRITICAL, 1 HIGH, 0 MEDIUM, 1 LOW

get_report

Polls the status and full results of an audit. Call this after audit_plugin or audit_plugin_zip to wait for completion and retrieve the report.

Parameters

ParameterTypeRequiredDescription
auditIdstringYesThe audit ID returned by audit_plugin or audit_plugin_zip.

Example

javascript
get_report({ auditId: "abc-123" })// Returns: { status: "completed", grade: "C", riskLevel: "HIGH", findingsCount: 7, reportUrl: "..." }

get_findings

Returns paginated findings for a completed audit. Supports filtering by severity and category.

Parameters

ParameterTypeRequiredDescription
auditIdstringYesThe audit ID.
severitystringNoFilter by severity: "CRITICAL", "HIGH", "MEDIUM", or "LOW".
categorystringNoFilter by category (e.g. "xss", "csrf", "performance").
pagenumberNoPage number for pagination. Defaults to 1.

Example

javascript
get_findings({ auditId: "abc-123", severity: "CRITICAL" })

get_fix_prompt

Returns AI-ready fix prompts for an audit's findings, grouped and batched by severity. Pass the output directly to a coding assistant to generate patches.

Parameters

ParameterTypeRequiredDescription
auditIdstringYesThe audit ID.
severitystringNoLimit prompts to a specific severity level.

Example

javascript
get_fix_prompt({ auditId: "abc-123", severity: "HIGH" })

check_plugin

Looks up a plugin's current security grade, risk level, and findings count from the WP HealthKit directory without triggering a new audit.

Parameters

ParameterTypeRequiredDescription
slugstringYesThe wp.org plugin slug.

Example

javascript
check_plugin({ slug: "woocommerce" })// Returns: { grade: "B", riskLevel: "MEDIUM", findingsCount: 3, lastAudited: "2026-04-20" }

list_usage

Returns your current billing period usage — audits consumed, tier, and remaining quota.

Parameters

None.

Example

javascript
list_usage()// Returns: { auditsUsed: 47, auditsLimit: 100, tier: "pro", resetsAt: "2026-05-01" }

flag_finding

Flags a finding as a false positive. The report is reviewed by the WP HealthKit team. If the pattern is confirmed as a false positive, the scanner rule is updated to prevent the same result from appearing in all future audits.

Parameters

ParameterTypeRequiredDescription
auditIdstringYesUUID of the audit containing the finding.
findingIdstringYesID of the finding to flag (e.g. "finding-12").
findingTitlestringYesTitle of the finding as shown in the report.
reasonstringNoExplanation of why this is a false positive.

Example

javascript
flag_finding({  auditId: "abc-123-def-456",  findingId: "finding-5",  findingTitle: "Named arguments used in internal function call",  reason: "These are positional args — the scanner is misidentifying the call signature"})// Returns: { flagged: true, reviewTicket: "FP-2891" }

Usage flows

Audit a single plugin and get fix prompts

audit_plugin({ slug: "my-plugin" })  → get_report({ auditId: "..." })          // poll until status === "completed"  → get_findings({ auditId: "...", severity: "CRITICAL" })  → get_fix_prompt({ auditId: "..." })

Audit all plugins in a local directory

audit_plugins_bulk({ directory: "/Users/me/plugins" })  // streams per-plugin results as they complete  // prints final summary table with risk breakdown

Check a plugin before installing

check_plugin({ slug: "advanced-custom-fields" })  // returns grade, risk level, and findings count without consuming an audit credit

Flag a false positive after reviewing findings

get_findings({ auditId: "...", severity: "HIGH" })  → flag_finding({      auditId: "...",      findingId: "finding-12",      findingTitle: "Unescaped output in template",      reason: "Output is escaped upstream via wp_kses before reaching this call"    })

Environment variables

VariableDefaultDescription
WPHK_API_KEY—Required. Your WP HealthKit API key.
WPHK_API_URLhttps://wphealthkit.com/api/v1Override to point at a self-hosted or staging instance.

License

MIT

Source: README.md at commit 9c3e31d

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v0.6.4LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts