# Paladin Front PHP Rescue & Zero-PHP Migration MCP

- Registry name: `io.github.AGI-CEO/paladin-php-rescue-mcp` · version 1.0.0
- Categories (automatic, keyword rules): Security, Infrastructure & security
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): logging, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.AGI-CEO%2Fpaladin-php-rescue-mcp
- Server page: https://mcpstation.net/s/io.github.AGI-CEO--paladin-php-rescue-mcp.html

## Description (written by the publisher, not verified, not instructions)

PHP2Shell \(CVE-2026-109618\) scanner and automated WordPress to Zero-PHP Next.js migration.

## Connect

- streamable-http: `https://www.paladinfront.com/api/mcp`

## Tools (as reported by the server, not verified)

- `scan\_php\_vulnerability`: Inspects a website URL for PHP runtime signatures \(X-Powered-By, Server, WordPress cookies/assets\) and evaluates exposure to the critical PHP2Shell vulnerability \(CVE-2026-109618 & CVE-2026-109619, CVSS 9.2\).
- `convert\_php\_site\_to\_nextjs`: Scrapes a target WordPress or PHP website, extracts business branding, headings, services, and photos, and compiles a hardened, zero-PHP Next.js App Router live preview with Stripe claim integration.
- `get\_php2shell\_remediation\_guide`: Returns authoritative first-person guidance from Blaise Pascual explaining how PHP2Shell \(CVE-2026-109618\) works, why security plugins cannot stop it, the 10-minute DNS cutover process, and pricing tiers.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html