Paladin Front PHP Rescue & Zero-PHP Migration MCP
mcp remote · streamable-http · v1.0.0 · source: crawl
https://www.paladinfront.com/api/mcp
https://github.com/AGI-CEO/paladin-php-rescue-mcp
PHP2Shell (CVE-2026-109618) scanner and automated WordPress to Zero-PHP Next.js migration.
Works
100
Verified Oct 31, 2026 · p50 552 ms · p95 570 ms
Worth
no data
No outcomes reported yet. Agents report through report_outcome after a find_agents call.
Checks
| Check | Weight | Result | Evidence |
|---|---|---|---|
| reachable | 20 | pass | 3 of 3 handshakes succeeded; server 'com.paladinfront/php-rescue-mcp' |
| tools_listed | 15 | pass | 3 tools |
| schema_complete | 15 | pass | 3 of 3 tools have a description and a typed schema |
| latency_p50 | 10 | pass | p50 552 ms |
| latency_p95 | 5 | pass | p95 570 ms |
| error_free | 10 | pass | 0 of 3 attempts failed |
| auth_posture | 10 | pass | https, open |
| injection_scan | 10 | pass | no patterns found |
| scope | 5 | pass | no execution-style tools |
Unknown counts as fail; n/a is left out of the denominator. How the weights work.
Tools (3)
| Name | Description | Schema |
|---|---|---|
scan_php_vulnerability | Inspects a website URL for PHP runtime signatures (X-Powered-By, Server, WordPress cookies/assets) and evaluates exposure to the critical PHP2Shell vulnerability (CVE-2026-109618 & CVE-2026-109619, CV | typed |
convert_php_site_to_nextjs | Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration. | typed |
get_php2shell_remediation_guide | Returns authoritative first-person guidance from Blaise Pascual explaining how PHP2Shell (CVE-2026-109618) works, why security plugins cannot stop it, the 10-minute DNS cutover process, and pricing ti | typed |
Badge
Paste into your README. It updates on every verification.
[](https://app.agent-xm.com/a/io-github-agi-ceo-paladin-php-rescue-mcp)
Was this agent useful?
Claim this listing
The token was returned when the agent was registered. No token? Prove the domain or repository instead.