# WordPress Plugin Auditor MCP for AI Agents AI Agent Connect

> WordPress Plugin Auditor lets your AI agent securely list and audit all installed plugins on your WordPress site. It identifies inactive plugins, checks versions for security sweeps, and helps generate maintenance reports without needing full admin access. It's a read-only tool designed for site owners who need to maintain security and organization across multiple sites without the manual work of checking every dashboard.

## Overview
- **Category:** developer-tools
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_6NO6SJRqFYgqs1qAeGt02kNvIMNmxzKE61orCG8A/ai-agent-connect
- **Tags:** plugin-management, security-audit, maintenance, vulnerability-scanning, site-health

## Description

This Connector gives your AI agent the ability to securely list and audit all installed plugins on a WordPress site. Managing dozens of WordPress sites for clients is a constant headache. You need to know what's running, what's outdated, and what's just taking up space without logging into every single dashboard and clicking through menus. By using this, you can ask your agent to provide status reports or security sweeps across your entire portfolio in seconds. It uses WordPress Application Passwords, so it stays strictly read-only. Your agent can see plugin names, versions, and statuses, but it can't deactivate or delete anything. It's a clean way to handle maintenance without the risk of manual errors or sharing your master credentials with an external tool. You can find this in the Vinkius catalog to plug it into your existing workflow and get audits done instantly. It handles the tedious data collection so you can focus on high-level site strategy and security. Instead of a manual audit that takes an hour, you get a clean list of facts that you can share with clients immediately. This setup removes the need for you to keep a manual spreadsheet of every plugin version. It keeps your records current without you having to lift a finger.

## Tools

### audit_wordpress_plugins
This tool returns the name, version, author, and status for every plugin on the site. Use it to quickly identify outdated software or find inactive plugins that need to be removed.

## Prompt Examples

**Prompt:** 
```
Which plugins on my site are currently inactive?
```

**Response:** 
```
I've checked your WordPress site. You have 15 plugins installed total. Here are the 3 that are currently inactive:

| Plugin Name | Version | Author |
| :--- | :--- | :--- |
| Hello Dolly | 1.7.2 | WordPress |
| Classic Editor | 1.6.3 | WordPress |
| Akismet | 3.0.1 | Akismet Inc |

I'd recommend deleting these if you aren't using them to improve security.
```

**Prompt:** 
```
Give me a summary of all my active plugins for a client report.
```

**Response:** 
```
Here is the active plugin list for your report:

**Active Plugins:**
- WooCommerce (v8.2.0)
- Yoast SEO (v20.8.1)
- WP Rocket (v4.15.0)
- Contact Form 7 (v5.8.2)

All plugins appear to be up to date based on the current versions.
```

**Prompt:** 
```
Are there any plugins on my site that might be a security risk because they're inactive?
```

**Response:** 
```
I found 4 inactive plugins. While they aren't running, they still exist in your files. Deleting them is the best way to shrink your attack surface. Would you like me to list their names again?
```

## Capabilities

### List all installed plugins
Get a complete inventory of every plugin currently on your WordPress site.

### Check plugin versions
Identify which plugins are running on older versions to spot potential vulnerabilities.

### Identify inactive plugins
Spot plugins that aren't doing anything but are still taking up space and posing risks.

### Retrieve plugin authors
See who developed each plugin to help verify the source of your installed software.

### Pull plugin statuses
Get a clear view of which plugins are active and which are sitting idle.

## Use Cases

### Security Audit
A dev asks the agent to find inactive plugins on a site to see if they should be deleted to improve security.

### Client Reporting
An agency owner generates a list of active plugins and versions for a monthly maintenance summary for a client.

### Site Migration
A developer checks the current plugin list to ensure all necessary tools are accounted for before moving a site.

### Vulnerability Check
A security pro asks the agent to find specific versions of a plugin known to have bugs in the wild.

## Benefits

- Stop sharing master admin passwords by using scoped Application Passwords for your AI agent.
- Get instant security sweeps to find inactive plugins that could be exploited.
- Generate accurate maintenance reports for clients based on live site data.
- Identify outdated plugins across your entire portfolio in one single request.
- Reduce manual work by letting your agent handle the plugin inventory check.

## How It Works

The bottom line is you get a live, read-only inventory of your WordPress plugin ecosystem without opening a single browser tab.

1. Generate a WordPress Application Password in your site's user profile.
2. Provide those credentials to your AI client via the Vinkius connection.
3. Ask the agent to list or audit your plugins.

## Frequently Asked Questions

**Can the WordPress Plugin Auditor delete any plugins?**
No, this Connector is strictly read-only. It can list and audit your plugins but cannot deactivate, delete, or install new ones.

**Does WordPress Plugin Auditor require my main admin password?**
No. It's designed to use WordPress Application Passwords, which give your AI agent scoped access without sharing your master credentials.

**How does WordPress Plugin Auditor help with security?**
It lets you quickly identify inactive plugins that might be vulnerable or taking up space, allowing you to clean up the site.

**Can I use WordPress Plugin Auditor for multiple sites?**
Yes. You can connect it to different sites to run audits and gather maintenance data across your entire portfolio.

**What specific info does WordPress Plugin Auditor provide?**
It retrieves the name, version, author, and active/inactive status for every plugin on the site.

**Is WordPress Plugin Auditor safe for my site?**
Yes, because it uses read-only permissions. Your AI agent can see the data but cannot make any changes to your site's configuration.

**Can the AI install or delete plugins with this tool?**
No. This Connector only calls the `GET` endpoint for plugins. It cannot modify your site's plugin configuration.