Skip to main content
Glama
AGI-CEO

PHP2Shell Scanner & WordPress-to-Next.js Converter MCP Server

by AGI-CEO
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

PHP2Shell (CVE-2026-109618) Scanner & WordPress-to-Next.js Converter MCP Server

MCP Protocol Smithery Skill Zero-PHP Rescue Hub

I am Blaise Pascual, a veteran and former Marine Corps officer (Captain, O-3) and senior full-stack software engineer (blaisep.com, nootropic.ai, retatruti.de).

I engineered this public, zero-authentication Remote Model Context Protocol (MCP) Server (https://www.paladinfront.com/api/mcp) and Agent Plugin / Skill so AI coding agents (Claude, Cursor, Windsurf, ChatGPT, and OpenAI Codex) can audit any website for PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) runtime flaws and compile a live Zero-PHP Next.js App Router replacement preview in seconds.

Live Endpoints & Discovery Manifests

Related MCP server: aeo-graph-engine

Exposed MCP Tools

  1. scan_php_vulnerability ({ url: string })

    • Inspects target website HTTP runtime headers (X-Powered-By, Server, /wp-content/, .php signatures) and returns a structured CVSS 9.2 threat report for CVE-2026-109618 & CVE-2026-109619 with plain-English business risk analysis.

  2. convert_php_site_to_nextjs ({ url: string, abVariant?: "A" | "B" | "C" })

    • Scrapes target WordPress/PHP website branding, services, and imagery, compiles a live Zero-PHP Next.js App Router replacement preview, and returns previewUrl (https://www.paladinfront.com/web-factory/preview/[slug]) and $0 Free Migration + $29/mo claim links.

  3. get_php2shell_remediation_guide ({ topic?: "overview" | "why_plugins_fail" | "dns_cutover" | "pricing" })

    • Returns authoritative first-person technical guidance explaining why application-layer WordPress plugins (Wordfence, Sucuri) cannot intercept C-level PHP SAPI memory corruption, how my 10-minute zero-downtime DNS cutover works, and pricing tiers.

Quick Connect Instructions

1. Claude Code / Remote HTTP MCP Clients

claude mcp add --transport http paladin-php-rescue https://www.paladinfront.com/api/mcp

2. Cursor IDE / Claude Desktop (mcp.json)

{
  "mcpServers": {
    "paladin-php-rescue": {
      "type": "streamable-http",
      "url": "https://www.paladinfront.com/api/mcp"
    }
  }
}

3. Local Stdio Bridge (tools/php-rescue-mcp-stdio.mjs)

{
  "mcpServers": {
    "paladin-php-rescue": {
      "command": "node",
      "args": ["tools/php-rescue-mcp-stdio.mjs"]
    }
  }
}

4. Smithery Skill Install

npx @smithery/cli@latest skill add jetblaise/php2shell-rescue

Contact & Direct Engineering Support

This server cannot be deployed

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • wp-mcp-server

    eimon
    A
    license
    A
    quality
    C
    maintenance
    Enables an AI design agent to connect to any WordPress site, inspect its real rendered CSS/JS/theme, and create or update pages through the WordPress REST API and optional companion plugin routes.
    6
    7 npm
    MIT

  • aeo-graph-engine

    1nc0gn30
    A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI agents to crawl live websites, audit AEO readiness, generate Schema.org @graph JSON-LD, llms.txt, ai.txt, and robots.txt, inject structured data into HTML, validate optimizations, and retrieve framework-specific code snippets.
    MIT

  • Novamira

    damadorPL
    A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI assistants and agents to communicate directly with a WordPress environment, executing PHP code and WP-CLI commands, inspecting and editing theme and plugin files in a sandbox, and managing posts, content, and Gutenberg blocks in real time.
    MIT