Gerasimos

sudowp

SudoWP Radar is a runtime security auditor for the WordPress 6.9 Abilities API. It scans every registered ability across all active plugins and themes, applying a rule engine that detects the vulnerability patterns most likely to be exploited in production.
What it audits:
<ul>
<li>Open and weak permissions — abilities with no permission_callback, or one that allows any authenticated user through.</li>
<li>Missing or loose input schemas — abilities that accept unconstrained string inputs, creating potential injection vectors for path traversal, SSRF, and similar attacks.</li>
<li>REST overexposure — abilities marked show_in_rest with no or open permission control, accessible to unauthenticated callers.</li>
<li>MCP overexposure — abilities marked meta.mcp.public = true with a weak or null permission callback are directly callable by any connected AI agent. Flagged as CRITICAL.</li>
<li>Orphaned callbacks — execute_callbacks that reference functions no longer loaded, often left behind by deactivated plugins.</li>
<li>Namespace collisions — duplicate ability names where the last registration silently overwrites the first, potentially downgrading the permission model.</li>
<li>AI prompt filter bypass (WP 7.0+) — callbacks on wp_ai_client_prevent_prompt that unconditionally return false, disabling the AI prompt prevention gate sitewide. Flagged as HIGH.</li>
<li>AI REST overexposure (WP 7.0+) — REST endpoints that call wp_ai_client_prompt() with no or weak permission callbacks. Flagged as CRITICAL or HIGH.</li>
<li>AI missing version gate (WP 7.0+) — plugins that call wp_ai_client_prompt() without a function_exists compatibility check, causing fatal errors on WP < 7.0. Flagged as MEDIUM.</li>
<li>Hosting-injected ability (WP 7.0+) — abilities registered by hosting-provider auto-installed plugins with REST exposure, without explicit site administrator consent. Flagged as HIGH. Requires premium vendor slug list.</li>
<li>Connector key in database (WP 7.0+) — AI connector API keys stored as plaintext in the WordPress database via the WP 7.0 Connectors API, rather than as environment variables or PHP constants. Flagged as HIGH.</li>
</ul>
How it works:
SudoWP Radar reads the live abilities registry after all plugins and themes have loaded. It applies static rules to each ability and returns a structured findings report with severity ratings (Critical, High, Medium, Low) and actionable remediation guidance. A risk score from 0-100 summarises the overall exposure of the site.
Security model:
<ul>
<li>Requires the <code>radar_run_audit</code> capability (granted to site administrators by default).</li>
<li>All audit requests are nonce-gated. No public-facing endpoints.</li>
<li>Audit findings are stored in user meta, not global options.</li>
<li>Rate-limited to one audit per 30 seconds per user.</li>
</ul>
Optional premium extension (SudoWP Pro):
The free plugin is a fully functional standalone security auditor. An optional premium add-on extends it with SudoWP Vulnerability Dataset matching (CVE references, CVSS scores, patch guidance), scheduled audits with email alerts, multi-site dashboard aggregation, and report export. None of these are required to use the core auditing features.
SudoWP Radar is a complement to static analysis tools. It audits the live, runtime state of your site — what is actually registered and executing — not just what is declared in code.
<h3>External Services</h3>
When an API key is configured, SudoWP Radar connects to the SudoWP vulnerability 
dataset API (api.sudowp.com) to retrieve patch availability information for 
registered WordPress abilities.
No data is transmitted without an API key being explicitly entered by the site 
administrator. When no key is present, the plugin makes zero external network 
requests.
Data sent to the API: the ability name being looked up and your API key. 
No personal data, no site URL, no user data is transmitted.
API key registration: https://sudowp.com/get-api-key/ 
Terms of service: https://sudowp.com/tos/ 
Privacy policy: https://sudowp.com/privacy-policy/
<h3>Premium Extension Filters</h3>
SudoWP Radar exposes four WordPress filters so a premium plugin can extend 
the audit engine without modifying core plugin files.
<h4>radar_dataset_enabled</h4>
Controls whether dataset lookups run during an audit. Return true to activate.
Parameters: 
 $enabled (bool) — default false. 
 Returns: 
 bool
Example:
<pre><code>add_filter( 'radar_dataset_enabled', function ( bool $enabled ): bool {
 return true; // Enable dataset lookups.
} );
</code></pre>
<h4>radar_dataset_findings</h4>
Inject Finding objects from a vulnerability dataset for a specific ability. 
Called once per ability during an audit. Non-Finding return values are stripped.
Parameters: 
 $findings (array) — current Finding[] for this ability, default []. 
 $ability (array) — ability data array from Scanner (name, meta, callbacks, etc.). 
 Returns: 
 Finding[]
Note: register with accepted_args=2 to receive both parameters.
Example:
<pre><code>add_filter(
 'radar_dataset_findings',
 function ( array $findings, array $ability ): array {
 if ( str_starts_with( $ability['name'], 'my-plugin/' ) ) {
 $findings[] = new \SudoWP\Radar\Finding(
 ability_name: $ability['name'],
 severity: \SudoWP\Radar\Finding::SEVERITY_CRITICAL,
 vuln_class: \SudoWP\Radar\Finding::VULN_DATASET_MATCH,
 message: 'Known vulnerable ability pattern detected (CVE-2026-1234).',
 recommendation: 'Update my-plugin to version 2.1.0 or later.',
 is_premium: true,
 );
 }
 return $findings;
 },
 10,
 2
);
</code></pre>
<h4>radar_dataset_status</h4>
Override the dataset status array displayed in the admin UI.
Parameters: 
 $status (array) — default status with keys: 
 enabled (bool) — false in free version. 
 label (string) — UI display string. 
 last_updated (string|null) — ISO 8601 date or null. 
 total_entries (int) — 0 in free version. 
 Returns: 
 array (same shape as input)
Example:
<pre><code>add_filter( 'radar_dataset_status', function ( array $status ): array {
 return [
 'enabled' => true,
 'label' => 'SudoWP Vulnerability Dataset: Connected. 4,821 entries.',
 'last_updated' => '2026-03-08',
 'total_entries' => 4821,
 ];
} );
</code></pre>
<h4>radar_audit_findings</h4>
Modify the complete findings array after all rules and dataset lookups have run. 
Use this to add cross-ability findings, re-score existing findings, or suppress 
false positives. Called once per full audit run.
Parameters: 
 $findings (array) — complete Finding[] from the full audit. 
 $abilities (array) — all ability data arrays scanned during this audit. 
 Returns: 
 Finding[]
Note: register with accepted_args=2 to receive both parameters.
Example:
<pre><code>add_filter(
 'radar_audit_findings',
 function ( array $findings, array $abilities ): array {
 // Example: promote medium findings to high for a high-risk site.
 return array_map( function ( $finding ) {
 if ( $finding->severity === \SudoWP\Radar\Finding::SEVERITY_MEDIUM ) {
 return new \SudoWP\Radar\Finding(
 ability_name: $finding->ability_name,
 severity: \SudoWP\Radar\Finding::SEVERITY_HIGH,
 vuln_class: $finding->vuln_class,
 message: $finding->message,
 recommendation: $finding->recommendation,
 context: $finding->context,
 is_premium: $finding->is_premium,
 );
 }
 return $finding;
 }, $findings );
 },
 10,
 2
);
</code></pre>

SudoWP Radar

Security auditor for the WordPress Abilities API. Scans registered abilities for permission, schema, and exposure risks.

Azizul Hasan

AtlasAiDev

AI Agent Hub is the most complete AI integration plugin for WordPress. It provides 80+ abilities across 10 modules, a built-in MCP (Model Context Protocol) server for AI agent connectivity, AI experiments directly in the Gutenberg block editor, role-based access control, JWT authentication, a workflow builder, and full WooCommerce support.
<h4>Highlights</h4>
<ul>
<li>80+ registered abilities covering posts, pages, media, users, custom post types, REST API discovery, site diagnostics, WordPress settings, WooCommerce, and AI-powered content analysis.</li>
<li>11 independently toggleable modules – enable only what you need.</li>
<li>Error Debugger – Monitor PHP errors in real time, receive email alerts with a one-click fix command, and fix errors directly from your AI assistant via MCP (Pro).</li>
<li>AI Experiments in the Block Editor – Generate excerpts, feature images, and more directly from the post editor with multi-provider AI support.</li>
<li>Built-in MCP server – expose abilities as tools, resources, and prompts to AI agents over JSON-RPC 2.0.</li>
<li>External Abilities – automatically discovers and integrates abilities from WordPress core and third-party plugins via the Abilities API.</li>
<li>JWT authentication – secure MCP and REST API access with token-based auth.</li>
<li>Workflow builder – combine abilities into reusable workflows from the admin dashboard or the post editor meta box.</li>
<li>Multi-provider AI – connect OpenAI, Google Gemini, or Anthropic Claude via the WordPress AI Client.</li>
<li>Role-based access control – assign abilities per WordPress role so each MCP connection only exposes what that user is allowed to use.</li>
<li>Backward compatible – bundles the WordPress Abilities API and MCP Adapter as vendor dependencies, so it works on WordPress 6.8+ (not just 6.9+ where these APIs ship in core).</li>
</ul>
<h4>AI Agent Hub Pro</h4>
Unlock the full power of AI Agent Hub with <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>:
<ul>
<li>Unlimited Workflows – Create unlimited MCP workflows (free: 3 max).</li>
<li>T/R/P Access Modes – Granular per-ability Tool/Resource/Prompt toggles for fine-grained MCP control.</li>
<li>Advanced AI Experiments – Templates library, batch generation mode, explain AI reasoning, generation history, and keyboard shortcuts.</li>
<li>Workflow Prompt Builders – 6 pre-built prompt builder workflows (SEO Audit, Content Brief, Site Overview, and more).</li>
<li>External Abilities – Discover and expose third-party plugin abilities via the Abilities API.</li>
<li>Per-Ability RBAC – Assign individual abilities (not just modules) to each WordPress role.</li>
<li>MCP Fix Command – Error emails include a ready-to-paste MCP command that lets your AI assistant read, analyse, and fix the error with one paste — automatic backup included.</li>
<li>Webhook Notifications – Send error alerts to Slack, Discord, or a custom webhook.</li>
<li>Backups Manager – All AI-applied fixes are backed up automatically; restore any backup with one click.</li>
<li>Priority Support – Direct support from the development team.</li>
</ul>
<a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">Upgrade to Pro</a>
<h4>Modules</h4>
Each module can be independently enabled or disabled from the AI Agent Hub dashboard.
<h4>1. AI Content Steward (8 abilities)</h4>
AI-powered content analysis, generation, and improvement for posts and pages.
<h4>2. Posts Manager (13 abilities)</h4>
Full CRUD for WordPress posts, categories, and tags.
<h4>3. Pages Manager (5 abilities)</h4>
CRUD operations for WordPress pages.
<h4>4. Media Manager (7 abilities)</h4>
Upload, update, and manage media files.
<h4>5. Users Manager (7 abilities)</h4>
Search, create, and manage WordPress users.
<h4>6. Custom Post Types Manager (6 abilities)</h4>
CRUD operations for any registered custom post type.
<h4>7. REST API Tools (3 abilities)</h4>
Discover and execute any WordPress REST API endpoint dynamically.
<h4>8. Site Info & Diagnostics (4 abilities)</h4>
View site info, plugins, themes, and users at a glance.
<h4>9. Settings Manager (3 abilities)</h4>
View and update WordPress site settings.
<h4>10. AI Store Manager – WooCommerce (24 abilities)</h4>
Full WooCommerce management through AI. Requires WooCommerce to be active.
<ul>
<li>Products: search, get, add, update, delete.</li>
<li>Product categories: list, add, update, delete.</li>
<li>Product tags: list, add, update, delete.</li>
<li>Product brands: list, add, update, delete.</li>
<li>Orders: search.</li>
<li>Reports: coupons totals, customers totals, orders totals, products totals, reviews totals, sales.</li>
</ul>
<h4>11. Error Debugger</h4>
Monitor PHP errors in real time and fix them faster. Works out of the box — no configuration required to start tracking errors.
Free features: 
* Real-time PHP error tracking grouped by file and message. 
* Email notifications for errors in plugins and themes — configurable recipient, severity levels, and rate limit. 
* Fix Command in every email — a pre-filled text snippet you can paste into any AI assistant to get fix instructions. 
* Admin dashboard widget showing the last 5 errors and a 24-hour error count. 
* Debug log scanner catches errors that occur before the plugin loads (e.g. fatal parse errors during activation).
Pro features (requires AI Agent Hub Pro): 
* MCP Fix Command — paste directly into Claude Desktop, Cursor, or any connected MCP client. The AI reads the file, suggests a fix, creates a backup, and applies it. 
* Webhook notifications — send error alerts to Slack, Discord, or a custom URL. 
* Backups Manager — all AI-applied fixes are backed up; restore any backup with one click. 
* Extended error sources — monitor WordPress Core, MU-Plugins, and Drop-ins in addition to plugins and themes.
<h4>Coming Soon</h4>
<ul>
<li>AI Support Desk – Summarize comment threads, suggest reply drafts, categorize support requests.</li>
<li>AI Automation Recipes / Workflows – Rule-based AI automations triggered by WordPress events.</li>
</ul>
<h4>AI Experiments in the Block Editor</h4>
AI Agent Hub adds AI-powered experiment panels directly into the WordPress block editor:
<ul>
<li>Excerpt Generation – Generate SEO-friendly excerpts from post content with one click. Appears in the post sidebar excerpt panel.</li>
<li>Image Generation – Generate AI feature images from post content. Integrated into the Featured Image panel.</li>
</ul>
With <a href="https://atlasaidev.com/ai-agent-hub-pro/" rel="nofollow ugc">AI Agent Hub Pro</a>, experiments gain advanced features: prompt templates library, batch generation mode, “Explain This Generation” reasoning, generation history, and keyboard shortcuts.
<h4>Error Debugger</h4>
The Error Debugger module monitors PHP errors on your WordPress site and helps you fix them faster.
How it works:
<ol>
<li>Enable the Error Debugger module from the AI Agent Hub dashboard.</li>
<li>Optionally enable Email Notifications and configure the recipient address, severity levels, and rate limit.</li>
<li>When a PHP error occurs in a plugin or theme, an email is sent with full error details and a How to Fix block.</li>
<li>Copy the fix command from the email and paste it into your AI assistant to get step-by-step fix instructions.</li>
</ol>
Free fix flow: 
Copy the pre-filled text from the email → paste into ChatGPT, Claude, Gemini, or any AI chat → the AI explains the error and how to fix it.
Pro fix flow (MCP): 
Copy the MCP command block from the email → paste into Claude Desktop, Cursor, or any MCP client connected to your site → the AI reads the file, suggests a fix, creates a backup, and applies it automatically.
Admin dashboard widget: 
When the Error Debugger module is active, a “AI Agent Hub — Recent Errors” widget appears on the WordPress admin dashboard showing the last 5 errors and a 24-hour error count. You can disable the widget from the Error Debugger settings without disabling the module.
<h4>Connecting AI Agents via MCP</h4>
AI Agent Hub includes a built-in MCP (Model Context Protocol) server that lets external AI agents interact with your WordPress site. The MCP endpoint is:
<pre><code>https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Any MCP-compatible AI client can connect and use all enabled abilities as tools, resources, and prompts.
<h4>Post Editor Meta Box</h4>
On every post and page edit screen, the AI Content Steward meta box provides:
<ul>
<li>Provider selection (Auto, OpenAI, Gemini, Claude).</li>
<li>Ability checkboxes to select which analyses to run.</li>
<li>Editable prompt preview that updates as you select abilities.</li>
<li>One-click workflow execution.</li>
<li>Save workflows for reuse.</li>
</ul>
<h3>Connecting AI Agents</h3>
<h4>Claude Desktop</h4>
Claude Desktop supports MCP servers natively. To connect it to your WordPress site:
Step 1: Generate a JWT token
Send a POST request to your site to get a JWT token:
<pre><code>curl -X POST "https://your-site.com/wp-json/jwt-auth/v1/token" -H "Content-Type: application/json" -d "{\"username\":\"your-username\",\"password\":\"your-password\",\"expires_in\":2592000}"
</code></pre>
This returns a token valid for 30 days (2592000 seconds). Copy the <code>token</code> value from the response.
Step 2: Configure Claude Desktop
Open the Claude Desktop config file:
<ul>
<li>Windows: <code>%APPDATA%\Claude\claude_desktop_config.json</code></li>
<li>macOS: <code>~/Library/Application Support/Claude/claude_desktop_config.json</code></li>
</ul>
Add this MCP server entry:
<pre><code>{
 "mcpServers": {
 "wordpress": {
 "command": "npx",
 "args": [
 "-y",
 "@anthropic-ai/mcp-wordpress-remote@latest",
 "--url",
 "https://your-site.com/wp-json/awfah_mcp/mcp"
 ],
 "env": {
 "JWT_TOKEN": "paste-your-jwt-token-here"
 }
 }
 }
}
</code></pre>
Step 3: Restart Claude Desktop
After saving the config, restart Claude Desktop. All enabled abilities will appear as tools. You can then ask Claude to manage posts, pages, media, users, settings, and WooCommerce from natural language.
<h4>Claude Code (CLI)</h4>
Claude Code can also connect to MCP servers. Add the server using:
<pre><code>claude mcp add wordpress -- npx -y @anthropic-ai/mcp-wordpress-remote@latest --url https://your-site.com/wp-json/awfah_mcp/mcp
</code></pre>
Then set the JWT token as an environment variable before running Claude Code:
<pre><code>export JWT_TOKEN="paste-your-jwt-token-here"
</code></pre>
<h4>Cursor / Windsurf / Other MCP Clients</h4>
Any editor or AI tool that supports MCP can connect. The setup is similar:
<ol>
<li>Generate a JWT token (see above).</li>
<li>Point the MCP client to: <code>https://your-site.com/wp-json/awfah_mcp/mcp</code></li>
<li>Use the <code>@anthropic-ai/mcp-wordpress-remote</code> transport package, or configure your client’s native MCP settings with the URL and JWT token.</li>
<li>The authentication header format is: <code>Authorization: Bearer <your-jwt-token></code></li>
</ol>
<h4>Postman / API Testing</h4>
You can test the MCP endpoint directly using Postman or any HTTP client. The MCP protocol uses JSON-RPC 2.0 over HTTP.
Step 1: Initialize a session
Send a POST request to <code>https://your-site.com/wp-json/awfah_mcp/mcp</code> with:
<ul>
<li>Header: <code>Authorization: Bearer <your-jwt-token></code></li>
<li>Header: <code>Content-Type: application/json</code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “id”: 1, 
 “method”: “initialize”, 
 “params”: { 
 “protocolVersion”: “2024-11-05”, 
 “capabilities”: {}, 
 “clientInfo”: { “name”: “postman”, “version”: “1.0” } 
 } 
}</li>
</ul>
Copy the <code>Mcp-Session-Id</code> header from the response.
Step 2: Send initialized notification
Send a POST with the session ID header:
<ul>
<li>Header: <code>Mcp-Session-Id: <session-id-from-step-1></code></li>
<li>Body: 
{ 
 “jsonrpc”: “2.0”, 
 “method”: “notifications/initialized” 
}</li>
</ul>
Step 3: Call a tool
Now you can call any ability as a tool:
<pre><code>{
 "jsonrpc": "2.0",
 "id": 2,
 "method": "tools/call",
 "params": {
 "name": "awfah-site-get-site-info",
 "arguments": {}
 }
}
</code></pre>
Note: In MCP tool names, the <code>/</code> in ability IDs is replaced with <code>-</code>. So <code>awfah-site/get-site-info</code> becomes <code>awfah-site-get-site-info</code>.
<h4>JWT Token Management</h4>
AI Agent Hub provides three JWT endpoints:
<ul>
<li>Generate token: <code>POST /wp-json/jwt-auth/v1/token</code> – Pass <code>username</code>, <code>password</code>, and optional <code>expires_in</code> (seconds, min 3600, max 2592000).</li>
<li>List tokens: <code>GET /wp-json/jwt-auth/v1/tokens</code> – List all active tokens (requires authentication).</li>
<li>Revoke token: <code>POST /wp-json/jwt-auth/v1/revoke</code> – Revoke a specific token (requires authentication).</li>
</ul>
Tokens are signed with HS256 using a per-site secret key stored in the <code>awfah_jwt_secret_key</code> option. Each token includes the user ID, issued-at time, expiration, and a unique JTI.
<h4>Role-Based MCP Access</h4>
AI Agent Hub provides role-based access control for MCP connections. This means different WordPress users see different abilities depending on their role.
How it works:
<ol>
<li>An administrator configures which abilities each WordPress role can access via the Access Control tab in the AI Agent Hub dashboard.</li>
<li>When an AI client connects via MCP, it authenticates as a specific WordPress user (using JWT or Application Password).</li>
<li>The plugin checks that user’s role and only exposes the abilities assigned to that role.</li>
<li>The AI client can only see and execute the allowed abilities — everything else is hidden.</li>
</ol>
Example scenarios:
<ul>
<li>Administrator — Full access to all 80+ abilities including post CRUD, site settings, user management, media, WooCommerce, and content analysis.</li>
<li>Editor — Content-focused abilities only (e.g. analyze posts, generate excerpts, suggest titles, focus keywords). No access to site settings, user management, or destructive operations.</li>
<li>Author / Contributor — Can be fully restricted or given a minimal subset of abilities as configured by the site admin.</li>
</ul>
Setting up role-based access:
<ol>
<li>Go to the AI Agent Hub dashboard in WordPress admin.</li>
<li>Click the Access Control tab.</li>
<li>Select a role from the dropdown.</li>
<li>Check or uncheck abilities to grant or revoke access for that role.</li>
<li>Click Save. Changes take effect immediately for all MCP connections using that role.</li>
</ol>
Multiple MCP connections:
You can create multiple MCP connections in your AI client config, each authenticating as a different WordPress user. For example:
<ul>
<li>A “full-access” connection using an administrator account.</li>
<li>A “content-only” connection using an editor account.</li>
</ul>
This lets you switch between permission levels depending on the task at hand.
<h4>Application Passwords (Alternative)</h4>
If you prefer not to use JWT, you can also authenticate with WordPress Application Passwords (available in WordPress 5.6+):
<ol>
<li>Go to Users > Profile > Application Passwords.</li>
<li>Create a new application password.</li>
<li>Use Basic Auth with your username and the application password.</li>
</ol>
However, JWT is recommended for MCP connections as it avoids sending credentials with every request.

MCP Server & AI Experiments – WooCommerce Compatible

AI-powered WordPress hub: 80+ abilities, MCP server, block editor AI experiments, RBAC, JWT auth, and workflows.

SudoWP Radar vs MCP Server & AI Experiments – WooCommerce Compatible