Auditra WordPress MCP
Auditra is a free, open-source WordPress plugin that turns a WordPress site into a read-only MCP (Model Context Protocol) server. It allows AI assistants like Claude to query and analyze detailed information about all plugins installed on the site, including those that are deleted or forgotten. The plugin provides nine read-only tools covering plugin inventory, vulnerability matching against exact installed versions, supply-chain audits, support lifecycle for PHP/database/WordPress, health signals, autoloaded data weight, cron events, custom database tables, and usage of shortcodes and blocks. This data enables AI clients to answer plain-English questions about plugin security, residual data, and performance overhead. Each WordPress site with Auditra installed acts as its own MCP server, with no intermediary service or account required. The plugin communicates only with the public WordPress.org plugin API and WPVulnerability, sending only plugin slugs and version strings; no content, user data, or telemetry leaves the site. End-of-life dates for PHP, MySQL, and MariaDB are embedded in the plugin, compiled from vendor policies, to avoid third-party fetches. Auditra supports both current and previous MCP protocol generations and caches data after the first query for faster subsequent responses. Auditra is deliberately read-only: it contains no code that writes plugin state, and its build fails if any such call is added. It reports facts and thresholds rather than verdicts, leaving reasoning to the AI client. It also does not measure per-plugin runtime cost, instead providing proxy metrics like autoload bytes, cron counts, and table sizes. When a data source is unreachable, the plugin explicitly states which plugins went unchecked, avoiding false "clean" results. The plugin requires WordPress 6.0 or later and PHP 7.4 or later.
- Category
- Open Source
- Pricing
- Free
Problem solved
The default WordPress plugins screen only shows name, version, and description, leaving site owners unaware of vulnerabilities, orphaned database tables, leftover cron jobs, autoload weight, and supply-chain risks from long-removed plugins. Auditra solves this by exposing a comprehensive read-only dataset through an MCP server, allowing AI assistants to uncover hidden plugin residue, security issues, and performance drains that would otherwise go unnoticed.
Use cases
- Audit installed plugins for known vulnerabilities matched to your exact versions
- Identify orphaned database tables and cron events left by deleted plugins
- Measure autoloaded data weight per plugin to improve page load performance
- Check supply-chain risks by detecting plugins with changed ownership or compromised update channels
- Ask AI assistants natural language questions about plugin health and residual data
- Assess WordPress, PHP, and database end-of-life status for upgrade planning
Audience
- Developers
- Business Users
Pros
- Read-only design ensures no changes to WordPress state
- Data stays on your server; only plugin slugs and versions are sent to public APIs
- Comprehensive audit data: vulnerabilities, orphaned tables, cron, autoload weight
- Works with any MCP client including Claude
- Caches data for fast subsequent queries
Cons
- Cannot modify plugins or fix issues directly
- Does not measure per-plugin runtime performance
- Requires WordPress 6.0+ and PHP 7.4+
- Initial query may be slow while caches are filled
- Relies on external APIs for vulnerability data (may be unreachable)
Official website: https://www.macronimous.com/free-tools/auditra
Canonical LambdaBase page: https://www.lambdabase.com/tools/auditra-wordpress-mcp