by
macronimous
0 (0 reviews)
Auditra
MCP server for WordPress plugin audits
Auditra ranks #62,742 among WordPress.org plugins with 0+ active installations, is #3,514 of 4,596 in the Security category, and was last updated Aug 18, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7.0.6 (Current: 7.1.2)
v1.0.0
Current Version v1.0.0
Updated 1 month ago
Last Update on 18 Aug, 2026
Refreshed 8 hours ago
Last Refreshed on
#3,514 of 4,596 in Security
Rank
#62,742
—
No change
Active Installs
0+
-100%
KW Avg Position
N/A
—
No change
Downloads
126
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
43,002
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 9 more installs to reach 10+
Rank Changes
Current
#62,742
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.0
- Last Updated
- Aug 18, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.0.6
- PHP Version
- 7.4 or higher
- Author
- macronimous
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,760
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,009
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about Auditra
Any MCP client supporting remote servers over HTTP. Transport is Streamable HTTP with a single application/json response (no SSE), JSON-RPC 2.0, stateless — no session ID is issued and none ever was. Both MCP protocol generations are supported, decided per request with no server-side state. Clients speaking revision 2026-07-28 send per-request metadata and may call server/discover; the server validates the MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers against the request body and rejects disagreement outright. Clients speaking 2025-11-25, 2025-06-18, or 2025-03-26 use the initialize handshake exactly as before, including notifications/initialized (202, empty body) and ping. Nothing was dropped; the server was stateless from the first release, so the new revision's model is the one this plugin always had. Clients on 2026-07-28 receive a 24-hour freshness hint on the tool list, so a tool added by a plugin update appears within a day without reconnecting. Older clients cache the tool list with no expiry signal, so on those, reconnect after upgrading the plugin.
A bearer token in the URL path: POST /wp-json/auditra/v1/mcp/{token}. Generated from random_bytes(32), hex encoded, compared with hash_equals, stored in a non-autoloaded option. permission_callback returns true and authentication happens inside the handler so error shapes stay under the plugin's control: 404 when the endpoint is disabled, 401 on a bad token, 429 past the rate limit (60/min per IP, filterable via auditra_rate_limit). No OAuth — token-in-path is the permanent design.
Tools are auto-discovered from includes/mcp/tools/: one file per tool, each declaring its own name, description, and JSON Schema. Filters: auditra_rate_limit, auditra_http_timeout, and auditra_vulnerability_provider — the last swaps the vulnerability data source for any class implementing the provider interface, which is one file (see CONTRIBUTING.md). Attribution accuracy comes from includes/data/prefix-overrides.json, a curated slug-to-prefix map that takes pull requests — the easiest useful contribution.
The endpoint is disabled by default, token-authenticated, rate-limited, and structurally incapable of writing to your site. What it exposes when enabled is described honestly in the section above — read it and decide. Failed authentication attempts are logged on the settings page.
No. It does nothing on normal page loads. Work happens only when your AI client asks a question, and expensive lookups are cached (external data for 12–24 hours, disk scans for a day).
Because the cache is empty and the first call fills it. On a 45-plugin site the first list_plugins takes around 8 seconds and about 20 MB, because it looks every plugin up against wordpress.org and the vulnerability database and fetches release-cycle data, all in one request. Every call after that answers from cache in about 0.2 seconds until the data expires. This is expected behaviour rather than a fault, and it costs your visitors nothing: the work happens inside your client's request, not on a page load. If your MCP client gives up on the first call, ask again — the second one is fast.
A vulnerability is a bug in a release. A supply-chain audit is the other kind of problem: someone with publishing rights on the plugin shipped a version the original author did not write, usually after buying or hijacking the plugin. These are reported separately and never mixed into the CVE list, because they mean different things and carry no CVE or severity score. Verdicts are malicious (attacker-supplied code confirmed in the affected versions), suspicious (changes consistent with a compromise, unconfirmed), and cleaned (compromised, later fixed in a clean release — which says nothing about a site still running an affected version). Where an audit publishes its range as a repository revision rather than a version number, the entry is still reported, marked as undetermined rather than quietly dropped. These verdicts are WPVulnerability's, not Auditra's. They are reproduced exactly as published, identified by audit ID and publication date. Auditra does not analyse plugin code, reaches no independent conclusion about any plugin or its authors, and neither endorses nor disputes a verdict. It reports that an audit exists, what it says, and whether your installed version falls inside the range it names. A supply-chain verdict is a serious accusation by a third party about someone else's software. Attribute it to its source, and take any question about a specific verdict — its evidence, its accuracy, or its removal — to WPVulnerability at https://www.wpvulnerability.net/ rather than to us or to the plugin's author.
Because scores would be invented. Auditra reports measurable facts — versions, dates, sizes, counts, published CVEs — and leaves judgment to the model reading them, which can weigh actual context instead of applying a formula.
No, and the tool is deliberately narrow about this. zero_content_usage means exactly one thing: the plugin registers shortcodes, blocks, or post types and none appear in post content. A plugin registering no content features at all is reported as not measurable, never as unused — hooks, filters, admin screens, REST endpoints, and template code are all invisible to content scanning. Counts also scan post_content only, so a shortcode living in a widget, an option, or a theme template counts zero while appearing on every page.
Not properly in v1. It operates on the individual site it runs on; managing it on a network requires a network administrator. Full network support may come later.
