WP HealthKit MCP server

@wphealthkit/mcp-server v0.4.0

An MCP (Model Context Protocol) server that gives AI assistants direct access to WP HealthKit's plugin audit API. Once configured, tools like Claude Desktop, Claude Code, and Cursor can trigger security audits, retrieve findings, fetch AI-ready fix prompts, bulk-audit entire plugin directories, and flag false positives — all without leaving the chat interface.

Setup

Required environment variable

WPHK_API_KEY=your_api_key_here

Get your API key from wphealthkit.com/dashboard.

Claude Desktop

Add the following to your claudedesktopconfig.json (usually at ~/Library/Application Support/Claude/claudedesktopconfig.json on macOS):

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Claude Code

Add to your project's .mcp.json:

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": {
        "WPHK_API_KEY": "your_api_key_here"
      }
    }
  }
}

Cursor

Open Cursor Settings > MCP > Add Server and use:

{
  "wphealthkit": {
    "command": "npx",
    "args": ["-y", "@wphealthkit/mcp-server"],
    "env": {
      "WPHK_API_KEY": "your_api_key_here"
    }
  }
}

Available tools

Tool reference

audit_plugin

Triggers a security audit for any plugin hosted on wp.org.

Parameters

Example

audit_plugin({ slug: "contact-form-7" })
// Returns: { auditId: "abc-123", status: "queued" }

auditpluginzip

Triggers an audit from a local ZIP file. Useful for plugins not on wp.org or pre-release builds.

Parameters

Example

audit_plugin_zip({ path: "/Users/me/plugins/my-plugin.zip" })
// Returns: { auditId: "def-456", status: "queued" }

auditpluginsbulk

Audits all plugin ZIP files in a local directory. Submissions are batched in groups of 10. Results stream as each audit completes, and a final summary table is printed with a risk breakdown and links to top findings.

Parameters

Shortened. The full README is on GitHub.