wpscan-mcp

An MCP server (TypeScript) that exposes a few tools for the WPScan (wpscan.com) API v3.

Requirements

• Node.js >= 18

• A WPScan API token

Related MCP server: CVE-Search MCP Server

Setup

Node.js

npm install

Set your token:

export WPSCAN_API_TOKEN="..."

Build & run:

npm run build
node dist/index.js

Bun

Install dependencies and compile:

bun install
bun run compile

Set your token:

export WPSCAN_API_TOKEN="..."

Run:

./wpscan-mcp

If, for some reason, compilation does not work:

bun install
bun run build
export WPSCAN_API_TOKEN="..."
bun run dist/index.js

Type generation (optional)

This project can generate TypeScript types directly from the WPScan OpenAPI spec:

# Node.js:
npm run generate-types

# Bun:
bun run generate-types

Notes:

• The OpenAPI spec is fetched from https://wpscan.com/docs/api/v3/v3.yml/.

MCP tools

• wpscan_plugin_lookup

  • Args: { slug: string, version?: string }

• wpscan_theme_lookup

  • Args: { slug: string, version?: string }

• wpscan_core_lookup

  • Args: { version: number }

  • Note: WPScan expects the WordPress version with dots removed (e.g. 6.4.2 → 642).

• wpscan_lookup_vuln

  • Args: { wpvdbId: string } (e.g. WPVDB-ID-12345)

Usage with an MCP client

This server uses stdio transport.

Example: Claude Desktop config

Add a server entry to your Claude Desktop MCP config (path varies by OS). Example:

{
  "mcpServers": {
    "wpscan": {
      "command": "node",
      "args": ["/path/to/wpscan-mcp/dist/index.js"],
      "env": {
        "WPSCAN_API_TOKEN": "YOUR_TOKEN_HERE"
      }
    }
  }
}

Then restart the client so it picks up the new MCP server.

Example: VSCode

Bun

Create .vscode/mcp.json:

{
  "servers": {
    "wpscan": {
      "type": "stdio",
      "command": "${workspaceFolder}/wpscan-mcp",
      "args": [],
      "env": {
        "WPSCAN_API_TOKEN": "YOUR_TOKEN_HERE"
      }
    }
  }
}

Node.js

{
  "servers": {
    "wpscan": {
      "type": "stdio",
      "command": "node",
      "args": ["${workspaceFolder}/dist/index.js"],
      "env": {
        "WPSCAN_API_TOKEN": "YOUR_TOKEN_HERE"
      }
    }
  }
}

Tool call examples

• Plugin lookup:

{ "slug": "woocommerce" }

• Theme lookup (specific version):

{ "slug": "astra", "version": "4.6.3" }

• Core lookup (WordPress 6.4.2 → 642):

{ "version": 642 }

• Vulnerability lookup:

{ "wpvdbId": "WPVDB-ID-12345" }