# WP HealthKit (npm · @wphealthkit/mcp-server)

Security audits for WordPress plugins and themes — 62 verification layers, fix plans and SBOMs.

- Trust score: 74/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-15

## Components

- remote · `mcp.wphealthkit.com`: 33/100, [markdown](https://verifymcp.io/servers/com-wphealthkit-mcp-server/mcp.md), [page](https://verifymcp.io/servers/com-wphealthkit-mcp-server/mcp)
- npm · `@wphealthkit/mcp-server`: 74/100 (this document), [markdown](https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server.md), [page](https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@wphealthkit/mcp-server`
- Version: `0.6.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-15.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 88/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1327 tokens (~69/item across 19 items; 13 tools + 6 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add com-wphealthkit-mcp-server -- npx -y @wphealthkit/mcp-server
```

### Codex

```bash
codex mcp add com-wphealthkit-mcp-server -- npx -y @wphealthkit/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-wphealthkit-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@wphealthkit/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-wphealthkit-mcp-server --command npx --arg -y --arg @wphealthkit/mcp-server
```

### Hermes

```yaml
mcp_servers:
  com-wphealthkit-mcp-server:
    command: "npx"
    args: ["-y", "@wphealthkit/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "com-wphealthkit-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@wphealthkit/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-15 (score 74, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-11 (score 71, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-08 (score 70, +32)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: pass

### 2026-08-07 (score 38)

First indexed and scored.

## MCP tools (13)

### `audit_plugin` (~103 tokens)

Trigger a security audit for a WordPress plugin by its wp.org slug. Optionally pass engines: ['performance'] for extended performance analysis (+1 token). Submits to the job queue and polls until complete (up to 20 minutes). Returns the full audit summary.

Input parameters:

- `engines` (array): Optional extra engines. ['performance'] adds performance analysis (+1 token).
- `slug` (string, required): The wp.org plugin slug (e.g. 'contact-form-7')

### `audit_plugin_zip` (~117 tokens)

Audit a WordPress plugin from a local ZIP file. Provide the absolute or relative path to the .zip file. Submits to the job queue and polls until complete (up to 20 minutes). Returns the full audit summary.

Input parameters:

- `engines` (array): Optional extra engines. ['performance'] adds server load, caching, and asset loading analysis (+1 token).
- `file_path` (string, required): Absolute or relative path to the plugin .zip file (e.g. './my-plugin.zip' or '/Users/me/plugins/my-plugin.zip')

### `audit_plugins_bulk` (~112 tokens)

Audit all plugin ZIP files in a local directory. Submits in batches of 10 via the job queue, streams results as each audit completes, and prints a summary table. Useful for auditing an entire plugin suite at once.

Input parameters:

- `directory` (string, required): Absolute path to a folder containing plugin .zip files
- `engines` (array): Optional extra engines. ['performance'] adds performance analysis (+1 token per plugin).
- `pattern` (string): Extension filter in the form *.ext (default: '*.zip')

### `get_job_status` (~63 tokens)

Check the status of a queued or in-progress audit job. Returns status (queued/processing/complete/failed), queue position, progress, and the audit result when complete.

Input parameters:

- `jobId` (string, required): The job UUID returned by audit_plugin or audit_plugin_zip

### `get_report` (~45 tokens)

Get the status and results of a completed audit by its audit ID. Use get_job_status to check a job's progress instead.

Input parameters:

- `auditId` (string, required): The audit UUID

### `get_findings` (~87 tokens)

Get paginated findings from an audit, optionally filtered by severity or category.

Input parameters:

- `auditId` (string, required): The audit UUID
- `category` (string): Filter by finding category
- `limit` (number): Max results (default 50)
- `offset` (number): Pagination offset
- `severity` (string): Filter: CRITICAL, HIGH, MEDIUM, or LOW

### `get_fix_prompt` (~36 tokens)

Get AI-ready fix prompts for an audit's findings, batched by severity.

Input parameters:

- `auditId` (string, required): The audit UUID

### `get_fix_plan` (~106 tokens)

Get the full Fix Plan for an audit — every finding with impact, remediation guidance, test steps, confidence, and agent-safety flags. Premium-tier audits may include refactorPlan: systemic refactor plans that eliminate a whole class of bug in one coordinated change (do those first). JSON (default) or Markdown.

Input parameters:

- `auditId` (string, required): The audit UUID
- `format` (string): Output format: 'json' (default) or 'md' for Markdown

### `check_plugin` (~42 tokens)

Look up a plugin's latest security grade, risk level, and findings count from the WP HealthKit directory.

Input parameters:

- `slug` (string, required): The wp.org plugin slug

### `list_usage` (~23 tokens)

Check your current usage — audits used this month, tier, and limits.

### `flag_finding` (~105 tokens)

Flag a specific finding in an audit as a false positive. The report goes to the WP HealthKit team for review — confirmed patterns result in a scanner rule update preventing this finding in future audits.

Input parameters:

- `auditId` (string, required): The audit UUID
- `findingId` (string, required): The finding ID (e.g. 'finding-12')
- `findingTitle` (string, required): The title of the finding
- `reason` (string): Why this finding is a false positive

### `generate_sbom` (~76 tokens)

Generate a CycloneDX or SPDX Software Bill of Materials (SBOM) for a completed audit. Required for EU Cyber Resilience Act (CRA) compliance. Returns the SBOM JSON.

Input parameters:

- `auditId` (string, required): UUID of the completed audit
- `format` (string): SBOM format (default: cyclonedx)

### `get_telemetry_stats` (~96 tokens)

Get aggregated telemetry statistics for a plugin — active installs, version distribution, WP/PHP version breakdown, locale spread, error rates, and daily trend. Requires that your API key is scoped to the plugin or you have a verified plugin claim.

Input parameters:

- `period` (string): Stats period (default: 30d)
- `slug` (string, required): The WordPress plugin slug (e.g. 'my-plugin', 'woocommerce')

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server#diagnostics

## Score history

- 2026-08-15: 74
- 2026-08-14: 71
- 2026-08-13: 71
- 2026-08-12: 71
- 2026-08-11: 71
- 2026-08-10: 70
- 2026-08-09: 70
- 2026-08-08: 70
- 2026-08-07: 38

## Links

- npm package: https://www.npmjs.com/package/@wphealthkit/mcp-server
- Socket report: https://socket.dev/npm/package/@wphealthkit/mcp-server
- Repository: https://github.com/BuiltByGo/wphealthkit-mcp
- Website: https://wphealthkit.com/docs/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/com-wphealthkit-mcp-server/wphealthkit-mcp-server