AI coding agents

Make your agent audit before it ships

More WordPress code is written by agents this year than by hand. The wphk-audit skill puts WP HealthKit inside the loop — your agent audits its own work, applies the Fix Plan itself, and checks update safety before touching anything.

Get the skill MCP server docs

Claude Code

# In your project's .claude/skills/wphk-audit/SKILL.md — or grab it:
curl https://wphealthkit.com/skills/wphk-audit/SKILL.md \
  -o .claude/skills/wphk-audit/SKILL.md --create-dirs

# Then configure the MCP server (claude_desktop_config.json or .mcp.json):
{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": { "WPHK_API_KEY": "whk_live_your_key" }
    }
  }
}

Cursor

# .cursor/mcp.json (or Settings → MCP):
{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server"],
      "env": { "WPHK_API_KEY": "whk_live_your_key" }
    }
  }
}

# .cursor/rules/wphk-audit.mdc — point it at the skill:
# https://wphealthkit.com/skills/wphk-audit/SKILL.md

No API key? Agents can still audit

The skill includes an anonymous path — deterministic-only audits with no key, limited to 2/day. Results are public, so the agent is instructed to warn you first. Free accounts get unlimited private scans plus one full AI audit.

Get a free API key in Settings → API keys

What the skill enforces

The agent audits before it says 'done' — not after you ask
Fix Plan applied severity-first, with test-after-fix steps followed
Anonymous path available with no key (public reports; the agent must warn you)
Update-safety verdicts before any plugin update (safe / caution / risky)
False positives flow back through the FP loop — the fleet gets smarter
No silent suppressions, no shipping around CRITICAL/HIGH findings