PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration.
Target WordPress/PHP website URL to scrape and convert into a hardened, zero-PHP Next.js App Router preview.
Optional A/B testing paywall variant for the converted preview.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration.
| Argument | Type | Description |
|---|
| url* | string | Target WordPress/PHP website URL to scrape and convert into a hardened, zero-PHP Next.js App Router preview. |
| abVariant | string | Optional A/B testing paywall variant for the converted preview. |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Target WordPress/PHP website URL to scrape and convert into a hardened, zero-PHP Next.js App Router preview."
},
"abVariant": {
"enum": [
"A",
"B",
"C"
],
"type": "string",
"default": "A",
"description": "Optional A/B testing paywall variant for the converted preview."
}
}
}Returns authoritative first-person guidance from Blaise Pascual explaining how PHP2Shell (CVE-2026-109618) works, why security plugins cannot stop it, the 10-minute DNS cutover process, and pricing tiers.
| Argument | Type | Description |
|---|---|---|
| topic | string | Specific remediation topic. Omit to receive the complete briefing. |
{
"type": "object",
"properties": {
"topic": {
"enum": [
"overview",
"why_plugins_fail",
"dns_cutover",
"pricing"
],
"type": "string",
"description": "Specific remediation topic. Omit to receive the complete briefing."
}
}
}Inspects a website URL for PHP runtime signatures (X-Powered-By, Server, WordPress cookies/assets) and evaluates exposure to the critical PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2).
| Argument | Type | Description |
|---|---|---|
| url* | string | Target website URL (e.g. 'https://example.com') to inspect for PHP runtime exposure and PHP2Shell (CVE-2026-109618 & CVE-2026-109619). |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Target website URL (e.g. 'https://example.com') to inspect for PHP runtime exposure and PHP2Shell (CVE-2026-109618 & CVE-2026-109619)."
}
}
}