Paladin Front PHP Rescue & Zero-PHP Migration MCP

io.github.AGI-CEOPublished by GitHub account AGI-CEOv1.0.0Updated Oct 30, 2026

PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that scans a website for PHP runtime signatures and a claimed PHP vulnerability, and generates a Next.js replacement preview.

What you can do
  • Scan a site URL for PHP runtime headers, WordPress assets and .php signatures, returning a structured threat report for the named CVEs.
  • Scrape a WordPress or PHP site's branding, headings, services and images and compile a hosted Next.js App Router preview with claim links.
  • Retrieve first-person guidance on the vulnerability, why plugins reportedly cannot stop it, DNS cutover steps and pricing tiers.
When to use it
When you want a quick automated check of whether a site appears to run PHP or WordPress and is presented as exposed to the named PHP2Shell CVEs, or when you want a generated Next.js preview of an existing WordPress site as a starting point for a migration.
Requirements
A remote streamable HTTP endpoint; no authentication, environment variables or headers are declared. The README also documents an optional local Node.js stdio bridge and a Smithery CLI install. Network access to the vendor site is needed.
Before you install
The server is run by a commercial vendor and its tools return marketing content, pricing tiers and claim links, so treat results as sales material rather than independent audit. The scan inspects third-party sites you name, and the converter scrapes their content and images and hosts a preview. The named CVEs and CVSS score are asserted by the vendor and are not corroborated in the listing.

Installation

In SourceWeft

  1. Open Paladin Front PHP Rescue & Zero-PHP Migration MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.AGI-CEO%2Fpaladin-php-rescue-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "paladin-front-php-rescue-zero-php-migrat": {
      "type": "http",
      "url": "https://www.paladinfront.com/api/mcp"
    }
  }
}

README

PHP2Shell (CVE-2026-109618) Scanner & WordPress-to-Next.js Converter MCP Server

[MCP Protocol] [Smithery Skill] [Zero-PHP Rescue Hub]

I am Blaise Pascual, a veteran and former Marine Corps officer (Captain, O-3) and senior full-stack software engineer (blaisep.com, nootropic.ai, retatruti.de).

I engineered this public, zero-authentication Remote Model Context Protocol (MCP) Server (https://www.paladinfront.com/api/mcp) and Agent Plugin / Skill so AI coding agents (Claude, Cursor, Windsurf, ChatGPT, and OpenAI Codex) can audit any website for PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) runtime flaws and compile a live Zero-PHP Next.js App Router replacement preview in seconds.

Live Endpoints & Discovery Manifests

Exposed MCP Tools

  1. scan_php_vulnerability ({ url: string })
    • Inspects target website HTTP runtime headers (X-Powered-By, Server, /wp-content/, .php signatures) and returns a structured CVSS 9.2 threat report for CVE-2026-109618 & CVE-2026-109619 with plain-English business risk analysis.
  2. convert_php_site_to_nextjs ({ url: string, abVariant?: "A" | "B" | "C" })
    • Scrapes target WordPress/PHP website branding, services, and imagery, compiles a live Zero-PHP Next.js App Router replacement preview, and returns previewUrl (https://www.paladinfront.com/web-factory/preview/[slug]) and $0 Free Migration + $29/mo claim links.
  3. get_php2shell_remediation_guide ({ topic?: "overview" | "why_plugins_fail" | "dns_cutover" | "pricing" })
    • Returns authoritative first-person technical guidance explaining why application-layer WordPress plugins (Wordfence, Sucuri) cannot intercept C-level PHP SAPI memory corruption, how my 10-minute zero-downtime DNS cutover works, and pricing tiers.

Quick Connect Instructions

1. Claude Code / Remote HTTP MCP Clients

bash
claude mcp add --transport http paladin-php-rescue https://www.paladinfront.com/api/mcp

2. Cursor IDE / Claude Desktop (mcp.json)

json
{  "mcpServers": {    "paladin-php-rescue": {      "type": "streamable-http",      "url": "https://www.paladinfront.com/api/mcp"    }  }}

3. Local Stdio Bridge (tools/php-rescue-mcp-stdio.mjs)

json
{  "mcpServers": {    "paladin-php-rescue": {      "command": "node",      "args": ["tools/php-rescue-mcp-stdio.mjs"]    }  }}

4. Smithery Skill Install

bash
npx @smithery/cli@latest skill add jetblaise/php2shell-rescue

Contact & Direct Engineering Support

Source: README.md at commit 5303091

Tools

3

scan_php_vulnerability

Inspects a website URL for PHP runtime signatures (X-Powered-By, Server, WordPress cookies/assets) and evaluates exposure to the critical PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2).

Parametersurlrequired

convert_php_site_to_nextjs

Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration.

ParametersurlrequiredabVariant

get_php2shell_remediation_guide

Returns authoritative first-person guidance from Blaise Pascual explaining how PHP2Shell (CVE-2026-109618) works, why security plugins cannot stop it, the 10-minute DNS cutover process, and pricing tiers.

Parameterstopic

Version history

1
  1. v1.0.0LatestOct 22, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts