Auditra
About
An MCP server for WordPress plugin audits
Details
- Author
- mwstech
- Categories
- Productivity, Other
Jump to
Setup
Install Auditra in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/mwstech/auditra
Follow the installation instructions in the repository README, then restart your MCP client.
- Assess plugin vulnerabilities— Ask "which of my plugins are vulnerable?" and get answers grounded in live WPVulnerability data via the MCP server.
- Identify option table bloat— Ask what's bloating yourwp_optionstable and get attribution back to owning plugins with confidence levels.
- Discover orphaned plugin data— Ask what deleted plugins left behind, with the server mapping leftover options, tables, and hooks to their original owners.
- Inventory the plugin estate— Ask for a full plugin inventory with site context, autoloaded options, cron jobs, and database table details in one response.
- Check plugin lifecycle support— Ask whether your plugins' PHP, MySQL, or MariaDB requirements are still supported, using bundled lifecycle data.
A WordPress plugin that turns the site it is installed on into a read-onlyMCPserver, so any MCP-capable AI client (Claude custom connectors, and others) can inspect and reason about that site's plugin estate in plain language.
Ask "which of my plugins are vulnerable?", "what's bloating my options table?", or "what did deleted plugins leave behind?" — and get answers grounded in the actual state of the site.
Three layers inside one plugin, one REST route, no runtime dependencies:
- Transport—POST /wp-json/auditra/v1/mcp/{token}speaking MCP over JSON-RPC 2.0 (plain JSON responses, stateless). Both protocol generations are served, decided per request: revision2026-07-28(per-request metadata,server/discover,Mcp-*header validation) and theinitialize-handshake revisions2025-11-25/2025-06-18/2025-03-26. Token-in-path auth behind a swappable interface, Origin validation, rate limiting, failed-auth logging.
- Collectors— read WordPress directly: inventory, site context, autoloaded options, cron, database tables, content-feature usage, and a three-tier attribution engine that maps options/tables/hooks back to owning plugins with explicit confidence levels (high= curated,medium= derived, or visibly unattributed).
- Enrichment— two external services, wordpress.org and WPVulnerability, both keyless, both cached, both degrading silently with per-source coverage reporting and progressive backoff (15 min → 24 h) on failures. Support lifecycle dates for PHP, MySQL and MariaDB are not fetched at all: they ship inincludes/data/lifecycle.json, compiled from each vendor's published policy.
Nine tools; every response carries_meta(totals, truncation, sources unavailable, timestamps) and stays within a 20 KB budget. The server reportsfacts, never verdicts— scoring and advice are deliberately absent, because that's the AI client's job. The full design record lives indocs/DECISIONS.md.
- Tools → Auditrain wp-admin: enable the endpoint, generate a token, copy the connection URL.
- In Claude:Settings → Connectors → Add custom connector, paste the URL (must behttps://).
- Ask questions. Start with "what can you tell me about this site's plugins?"
The site must be publicly reachable over HTTPS with pretty permalinks enabled. Clients on revision2026-07-28get a 24-hour freshness hint ontools/list, so a tool added by a plugin update appears within a day on its own; older revisions have no expiry signal, so reconnect the connector after updating to pick up new tools.
The easiest genuinely useful contribution is a pull request againstincludes/data/prefix-overrides.json— the curated map from plugin slugs to the option/table prefixes they actually use (Contact Form 7 →wpcf7_). Every entry improves attribution accuracy for every user. SeeCONTRIBUTING.md.
composer install # dev-only: PHPCS + WordPress Coding Standards (pinned) composer lint php tests/mcp-client.php https://example.com/wp-json/auditra/v1/mcp/{token}
tests/mcp-client.phpis the CLI harness that exercises the endpoint without an AI client in the loop;tests/seed-conditions.shbuilds a deliberately messy test site (andteardown-conditions.shreverses it exactly). CI runs a PHP lint matrix (7.4–8.4), PHPCS, and a grep gate that fails the build if any write operation ever appears in the plugin code.
SeeSECURITY.mdfor the supported versions and how to report a vulnerability privately.
A free WordPress plugin that turns your site into a governed MCP server: 153 abilities that are all off until you switch them on, bound to a least-privilege WordPress user, with every call audited.
Works the tickets of the self hosted Simple Support System helpdesk for Concrete CMS: read a ticket with its comments, reply, change its state, manage attachments.
Access WordPress.com feeds, notifications, tags, and manage blogs within Claude Desktop.
Connects Claude to WordPress sites to create posts and manage sites using the WordPress REST API.
A personality-based MCP server for WordPress, providing role-appropriate tools for content management.
Lightweight WordPress MCP server with 42 tools. Token-optimized responses reduce REST API verbosity by 95%+. Posts, pages, users, plugins, themes, media, taxonomies, comments.
Manage WordPress sites and create content with AI-generated featured images.
Manage WordPress sites via the REST API. Enables AI assistants to handle content, posts, and site configurations.
A secure bridge between AI assistants and WordPress, enabling site management and content operations through natural language.
The most secure MCP Server for WordPress with built-in Undo
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
