hackerdogs/wpscan-mcp repository overview

⁠

⁠WPScan MCP Server

MCP server wrapper for Wpscan⁠ — WordPress security scanner.

⁠What is Wpscan?

Wpscan (wpscan) is a security tool that provides: WordPress security scanner.

See wpscanteam/wpscan⁠ for full documentation.

No API keys required — Wpscan runs locally inside the Docker container.

Summary. MCP server wrapper for Wpscan⁠ — WordPress security scanner.

Tools:

• run_wpscan — Run wpscan with the given arguments. Returns structured JSON output.

⁠Tools Reference

⁠run_wpscan

Run wpscan with the given arguments. Returns structured JSON output.

{
  "raw": "wpscan output will appear here"
}

⁠Example Prompts

Here are example prompts you can use with Claude (or any MCP client) when this tool is connected:

• "Run wpscan with --help to see all available options."
• "Use wpscan to scan the target 192.168.1.1."
• "What options does wpscan support? Show me its help output."
• "Run wpscan against example.com with default settings."
• "Execute wpscan with verbose output enabled."
• "Use the wpscan tool to analyze the target and report findings."

⁠Deploy

⁠Docker Compose (recommended)

docker-compose up -d

⁠Docker Run (stdio mode)

docker run -i --rm hackerdogs/wpscan-mcp:latest

⁠Docker Run (HTTP streamable mode)

docker run -d -p 8220:8220 \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_PORT=8220 \
  hackerdogs/wpscan-mcp:latest

⁠MCP Client Configuration

⁠Stdio mode (default)

Add to your Claude Desktop or Cursor MCP config:

{
  "mcpServers": {
    "wpscan-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT", "hackerdogs/wpscan-mcp:latest"],
      "env": {
        "MCP_TRANSPORT": "stdio"
      }
    }
  }
}

⁠HTTP mode (streamable-http)

First, start the server using Docker Compose or docker run with HTTP mode (see Deploy⁠ above), then point your MCP client at the running server:

{
  "mcpServers": {
    "wpscan-mcp": {
      "url": "http://localhost:8220/mcp"
    }
  }
}

⁠Environment Variables

⁠Installing in Hackerdogs

The fastest way to get started is through Hackerdogs⁠:

1. Log in to your Hackerdogs account.
2. Go to the Tools Catalog.
3. Search for the tool by name (e.g. "nuclei", "naabu", "julius").
4. Expand the tool card and click Install — you're ready to go.

1. Vendor API key required? Add your key in the config environment variable field before clicking Install. Your key will be encrypted at rest.
2. Enable / Disable the tool anytime from the Enabled Tools page.
3. Need to update a key or parameter? Go to My Tools → toggle Show Decrypted Values → edit → Save.

⁠Build

docker build -t hackerdogs/wpscan-mcp:latest .

⁠Testing

⁠Automated tests

./test.sh

⁠Test directly with Docker

1. Start the server in HTTP mode:

docker run -d --rm --name wpscan-mcp-test -p 8220:8220 \
  -e MCP_TRANSPORT=streamable-http \
  hackerdogs/wpscan-mcp:latest

2. Initialize the MCP session:

SESSION_ID=$(curl -s -D - -X POST http://localhost:8220/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"0.1"}}}' \
  2>&1 | grep -i mcp-session-id | awk '{print $2}' | tr -d '\r\n')

curl -s -X POST http://localhost:8220/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","method":"notifications/initialized"}'

3. Call a tool:

curl -s -X POST http://localhost:8220/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"run_wpscan","arguments":{"arguments":"--help"}}}'

4. Clean up:

docker stop wpscan-mcp-test

⁠Running the tool directly (bypassing MCP)

You can run the WPScan CLI in the same container by overriding the entrypoint to scan WordPress sites for themes, plugins, and vulnerabilities without starting the MCP server.

Scan a WordPress URL:

docker run -i --rm --entrypoint wpscan hackerdogs/wpscan-mcp:latest --url https://example.com

Enumerate plugins and themes:

docker run -i --rm --entrypoint wpscan hackerdogs/wpscan-mcp:latest --url https://example.com --enumerate p,t

Show help:

docker run -i --rm --entrypoint wpscan hackerdogs/wpscan-mcp:latest --help