Query scan results, manage sites, and investigate vulnerabilities through Claude, ChatGPT, Cursor, or any MCP-compatible client.
Get your MCP key from the WPSec dashboard, then add the config below to your AI client.
claude mcp add wpsec \
--transport sse \
--url https://mcp.wpsec.com/sse \
--header "Authorization: Bearer mcp_YOUR_SECRET_HERE"{
"mcpServers": {
"wpsec": {
"type": "sse",
"url": "https://mcp.wpsec.com/sse",
"headers": {
"Authorization": "Bearer mcp_YOUR_SECRET_HERE"
}
}
}
}# Add a new MCP server in Cursor settings: Name: WPSec Type: SSE URL: https://mcp.wpsec.com/sse Headers: Authorization: Bearer mcp_YOUR_SECRET_HERE
# In your Custom GPT configuration: 1. Go to Configure → Actions → Create new action 2. Set Authentication to Bearer Token 3. Enter your MCP secret as the token 4. Server URL: https://mcp.wpsec.com/sse
Transport: SSE URL: https://mcp.wpsec.com/sse Header: Authorization: Bearer mcp_YOUR_SECRET_HERE # Endpoints: # GET /sse → event stream # POST /messages/ → JSON-RPC messages
| Tool | Description | Scope |
|---|---|---|
| wpsec_list_sites | List all your registered sites | read |
| wpsec_get_site_status | Check if a site is secure, vulnerable, or errored | read |
| wpsec_get_scan_report | Full report with vulnerabilities, plugins, and themes | read |
| wpsec_get_scan_history | Recent scans and their statuses | read |
| wpsec_search_vulnerabilities | Search vulnerabilities across all sites | read |
| wpsec_check_plugin | Check a plugin for known vulnerabilities | read |
| wpsec_check_wordpress | Check a WordPress version for known vulnerabilities | read |
| wpsec_trigger_scan | Queue a new security scan | write |
| wpsec_add_site | Register a new site for monitoring | write |
| wpsec_pause_site | Pause automatic scanning | write |
| wpsec_resume_site | Resume scanning | write |
| wpsec_configure_webhook | Set webhook URL for scan notifications | write |
Go to wpsec.com/account/api.php → MCP Access Keys → Create MCP Key
Read — view scans and reports. Write — also trigger scans, add sites, manage webhooks.
Format: mcp_xxxxxxxx_.... Shown once — it's hashed and cannot be retrieved.
Per-user limit across all tools.
Per-site rate limit for trigger_scan.
shop.example.com has issues. Want the full report?