MCP Server

The Model Context Protocol (MCP) is an open standard that lets AI assistants call external tools and access reference documents during a conversation. The WP HealthKit MCP server exposes your audit pipeline as callable tools, curated developer guides as readable resources, and security review workflows as pre-configured prompts — all accessible without leaving your AI editor.

9 tools for auditing plugins, fetching reports, and managing your usage.

Resources are reference documents your AI can read as context. Unlike tools (which perform actions), resources are pulled into the conversation to inform the AI's answers. Say “use the security bible to review this code” and the AI fetches the full guide automatically.

Five guides are bundled in the package and available offline. The top-findings resource is fetched live from the WP HealthKit database.

Prompts are pre-configured review workflows. Select them from your AI tool's prompt picker, provide the required arguments, and get a structured analysis without writing the prompt yourself.

1. 1Get an API key from Settings → API Keys (Pro plan or higher required).
2. 2Add the server to your AI tool's MCP config file. For Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json. For Cursor: ~/.cursor/mcp_servers.json. For Windsurf: ~/.codeium/windsurf/mcp_config.json.
3. 3Add the WP HealthKit server entry and replace the placeholder key:

{
  "mcpServers": {
    "wphealthkit": {
      "command": "npx",
      "args": ["-y", "@wphealthkit/mcp-server@latest"],
      "env": {
        "WPHK_API_KEY": "your-key-here"
      }
    }
  }
}

For Claude Code, pass the key inline:

WPHK_API_KEY=whk_live_your_key claude --mcp-server npx @wphealthkit/mcp-server

Reload or restart your AI tool to activate the server.

Once connected, try these in Claude, Cursor, or Windsurf:

• “Audit the contact-form-7 plugin and show me any critical security issues.”
• “Check the risk level of woocommerce in the WP HealthKit directory.”
• “Fetch the findings for audit abc123 grouped by severity.”
• “Generate a fix prompt for my latest audit so I can paste it into Claude.”
• “Audit every ZIP in ~/Downloads/plugins and give me a risk summary.”
• “Flag finding-5 on audit abc123 as a false positive — it's a standard WP API call.”
• “Use the security bible to review this plugin code for issues.”
• “Run a wp.org pre-flight check on my plugin before I submit it.”
• “What are the most common security findings this month across WordPress plugins?”

Audits all plugin ZIP files in a local directory in one command. Plugins are submitted in batches of 10, results stream as each audit completes, and a final summary shows the risk breakdown with links to each report.

Found 14 ZIPs. Submitting in 2 batches of 10/4.

Batch 1/2 — submitting 10 plugins…
  ✓ my-ecommerce-plugin    HIGH      231 findings   (2m 14s)
  ✓ my-membership-plugin   HIGH      148 findings   (2m 31s)
  ...

───────────────────────────────────────
 Bulk audit complete — 14 plugins in 12m
───────────────────────────────────────
 HIGH       9 plugins
 MEDIUM     4 plugins
 LOW        1 plugin