Is Paladin Php Rescue free?

Yes, Paladin Php Rescue is free to use.

How do I install Paladin Php Rescue?

Paladin Php Rescue is a remote plugin. You do not need to install anything locally. Add the server URL to your AI app's MCP configuration and you are ready to go.

Is Paladin Php Rescue safe to use?

Yes. Paladin Php Rescue passed MCP Marketplace's automated security scan with a score of 10/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What AI apps work with Paladin Php Rescue?

Paladin Php Rescue uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Paladin Php Rescue MCP Server

by AGI CEO

Developer ToolsLow Risk10.0MCP RegistryRemote

Free

Server data from the Official MCP Registry

PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.

About

PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.

Remote endpoints: streamable-http: https://paladinfront.com/api/mcp

Security Report

10.0

Low Risk10.0Low Risk

Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.

3 tools verified · Open access · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Found in Source Code

Found by scanning the linked source code. This listing connects to a hosted endpoint, so none of this runs on your machine: it describes what the server software does where it is hosted.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Applies to the server that hosts this plugin, not to your machine.

How to Connect

Remote Plugin

No local installation needed. Your AI client connects to the remote endpoint directly.

Add this to your MCP configuration to connect:

{
  "mcpServers": {
    "com-paladinfront-www-php-rescue-mcp": {
      "url": "https://paladinfront.com/api/mcp"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

PHP2Shell (CVE-2026-109618) Scanner & WordPress-to-Next.js Converter MCP Server

I am Blaise Pascual, a veteran and former Marine Corps officer (Captain, O-3) and senior full-stack software engineer (blaisep.com, nootropic.ai, retatruti.de).

I engineered this public, zero-authentication Remote Model Context Protocol (MCP) Server (https://www.paladinfront.com/api/mcp) and Agent Plugin / Skill so AI coding agents (Claude, Cursor, Windsurf, ChatGPT, and OpenAI Codex) can audit any website for PHP2Shell (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) runtime flaws and compile a live Zero-PHP Next.js App Router replacement preview in seconds.

Live Endpoints & Discovery Manifests

Remote Streamable HTTP MCP Server: https://www.paladinfront.com/api/mcp
Zero-PHP Rescue Hub: https://www.paladinfront.com/php-rescue
OpenAPI 3.1.0 Spec: https://www.paladinfront.com/.well-known/openapi.json
MCP Server Card (SEP-2127): https://www.paladinfront.com/.well-known/mcp/server-card.json
Smithery Skill Listing: https://smithery.ai/skills/jetblaise/php2shell-rescue

Exposed MCP Tools

scan_php_vulnerability ({ url: string })
- Inspects target website HTTP runtime headers (X-Powered-By, Server, /wp-content/, .php signatures) and returns a structured CVSS 9.2 threat report for CVE-2026-109618 & CVE-2026-109619 with plain-English business risk analysis.
convert_php_site_to_nextjs ({ url: string, abVariant?: "A" | "B" | "C" })
- Scrapes target WordPress/PHP website branding, services, and imagery, compiles a live Zero-PHP Next.js App Router replacement preview, and returns previewUrl (https://www.paladinfront.com/web-factory/preview/[slug]) and $0 Free Migration + $29/mo claim links.
get_php2shell_remediation_guide ({ topic?: "overview" | "why_plugins_fail" | "dns_cutover" | "pricing" })
- Returns authoritative first-person technical guidance explaining why application-layer WordPress plugins (Wordfence, Sucuri) cannot intercept C-level PHP SAPI memory corruption, how my 10-minute zero-downtime DNS cutover works, and pricing tiers.

Quick Connect Instructions

1. Claude Code / Remote HTTP MCP Clients

claude mcp add --transport http paladin-php-rescue https://www.paladinfront.com/api/mcp

2. Cursor IDE / Claude Desktop (`mcp.json`)

{
  "mcpServers": {
    "paladin-php-rescue": {
      "type": "streamable-http",
      "url": "https://www.paladinfront.com/api/mcp"
    }
  }
}

3. Local Stdio Bridge (`tools/php-rescue-mcp-stdio.mjs`)

{
  "mcpServers": {
    "paladin-php-rescue": {
      "command": "node",
      "args": ["tools/php-rescue-mcp-stdio.mjs"]
    }
  }
}

4. Smithery Skill Install

npx @smithery/cli@latest skill add jetblaise/php2shell-rescue

Contact & Direct Engineering Support

Founder: Blaise Pascual
Zero-PHP Migration Hub: https://www.paladinfront.com/php-rescue
Phone: 910-325-2161
Email: inbox@blaisep.com
Book 1-on-1 Session: https://tidycal.com/pascual/roadmap-session

Reviews

No reviews yet

Be the first to review this server!

4.7

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

Stars

167

Installs