hooks
Resolve WordPress hook or filter names to registered listeners and entry points, revealing public attack surface through wp_ajax and REST routes.
Instructions
WordPress hook/filter dispatch - the string-named action/filter coupling a call graph CANNOT see (add_action/add_filter/register_rest_route/do_action/apply_filters).
name= a hook/action/filter name or REST route -> its in-repo listeners + fire sites.name= a symbol -> the hooks it's registered on (the high-confidence callback->hook direction: "register_routes fires on rest_api_init").entry_points=Trueor emptyname-> the public attack surface: every wp_ajax_* / wp_ajax_nopriv_* / register_rest_route callback, with UNAUTH flagged.
Blind spots (honest): dynamic/interpolated hook names, closures, and variable callbacks (call_user_func($x)) cannot be resolved and are not edges.
This tool - NOT the edges_hook count - is the source of truth for whether
WordPress coupling was captured. edges_hook: 0 is normal for a pure-listener
plugin (its callbacks are fired by WP core / the REST framework, not by its own
do_action), and REST routes never contribute to that count by design. If a hook
seems missing, check here first.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| root | No | . | |
| entry_points | No |