Paladin Front PHP Rescue & Zero-PHP Migration MCP
PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.
Should I use this
Quality & Safety
Findings (1)
- LOWTool 'get_php2shell_remediation_guide' name length outside 3-30 rangein get_php2shell_remediation_guide
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"php-rescue-mcp": {
"url": "https://paladinfront.com/api/mcp"
}
}
}Remote endpoints
https://paladinfront.com/api/mcpstreamable-httpWhat it can do
Tool inventory
Tools (3)
⚪scan_php_vulnerability(url)
Inspects a website URL for PHP runtime signatures (X-Powered-By, Server, WordPress cookies/assets) and evaluates exposure to the critical PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2).
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "Target website URL (e.g. 'https://example.com') to inspect for PHP runtime exposure and PHP2Shell (CVE-2026-109618 & CVE-2026-109619)."
}
},
"required": [
"url"
]
}⚪convert_php_site_to_nextjs(url, abVariant)
Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration.
Input Schema
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "Target WordPress/PHP website URL to scrape and convert into a hardened, zero-PHP Next.js App Router preview."
},
"abVariant": {
"type": "string",
"enum": [
"A",
"B",
"C"
],
"default": "A",
"description": "Optional A/B testing paywall variant for the converted preview."
}
},
"required": [
"url"
]
}🟢get_php2shell_remediation_guide(topic)
Returns authoritative first-person guidance from Blaise Pascual explaining how PHP2Shell (CVE-2026-109618) works, why security plugins cannot stop it, the 10-minute DNS cutover process, and pricing tiers.
Input Schema
{
"type": "object",
"properties": {
"topic": {
"type": "string",
"enum": [
"overview",
"why_plugins_fail",
"dns_cutover",
"pricing"
],
"description": "Specific remediation topic. Omit to receive the complete briefing."
}
}
}Community
Evidence