markdown<\/code> for plain Markdown output.<\/li>\n<\/ul>\n\nThe MCP endpoint supports read-only tools for security summary, vulnerability, exposure, integrity, performance risk, readiness, and Markdown audit reports. Tool arguments include mode<\/code> and report<\/code>.<\/p>\n\nWhen VideoWhisper AI Site Manager is active, Security Audit also registers agent tools for latest summary\/report reads, synchronous scan refreshes for small sites, scan task discovery, queued scan creation, queue batch processing, queue status polling, and retrying failed scan tasks.<\/p>\n\n
On WordPress 6.9+, administrators can also enable WordPress Abilities. These abilities are admin-only, read-only, and permission-checked with manage_options<\/code> by default. They can optionally be marked public for the official WordPress MCP Adapter, which must be installed separately. Existing REST and MCP endpoints remain available and are not replaced.<\/p>\n\nSome sites use an OAuth, firewall, or bearer-auth layer that consumes Authorization: Bearer<\/code> before the Security Audit route receives the request. If standalone Codex MCP bearer setup returns oauth_token_invalid<\/code> or a similar upstream bearer-auth error, use the MCP path-token URL shown on the Agents tab instead of the bearer URL.<\/p>\n\nEndpoint protection controls include:<\/p>\n\n
\n- REST\/MCP requests per minute per IP.<\/li>\n
- Separate agent scan cooldown.<\/li>\n
- Optional exact IPv4\/IPv6 allowlist.<\/li>\n
- Token rotation.<\/li>\n<\/ul>\n\n
Developer hooks<\/h4>\n\n
Security Audit exposes generic hooks that any plugin can use to extend scan data, reports, admin UI, and Site Manager integration:<\/p>\n\n
\nvwsa_latest_snapshot<\/code> filters the latest stored snapshot before reports use it.<\/li>\nvwsa_scan_settings<\/code> filters normalized scan settings for a scan context.<\/li>\nvwsa_scan_inventory<\/code> filters inventory data before findings are finalized.<\/li>\nvwsa_scan_findings<\/code> filters findings before snapshot lifecycle metadata is saved.<\/li>\nvwsa_snapshot_before_save<\/code> filters the completed snapshot before it is stored.<\/li>\nvwsa_snapshot_saved<\/code> fires after a snapshot is stored.<\/li>\nvwsa_report<\/code> filters built report output.<\/li>\nvwsa_site_manager_integration<\/code> filters the Site Manager integration definition.<\/li>\nvwsa_admin_tabs<\/code> filters admin tabs.<\/li>\nvwsa_admin_render_tab<\/code> lets extensions render custom admin tabs.<\/li>\nvwsa_admin_scan_panel_after<\/code> renders generic content after the scan panel.<\/li>\nvwsa_admin_findings_before<\/code> renders content before findings.<\/li>\nvwsa_admin_finding_card_start<\/code> renders content inside a finding card.<\/li>\nvwsa_admin_finding_actions<\/code> filters per-finding action links.<\/li>\nvwsa_admin_findings_after<\/code> renders content after findings.<\/li>\n<\/ul>\n\nImportant limitations and disclaimers<\/h4>\n\n
Security Audit reports are informational only. Findings and AI-ready reports may be incomplete, inaccurate, outdated, or unsuitable for a specific site or legal situation.<\/p>\n\n
Security Audit does not provide legal advice, compliance certification, professional security advice, malware cleanup, incident response, or a guarantee that a site is secure. Administrators should verify findings and consult an experienced security, technical, or legal provider before making important changes.<\/p>\n\n
REST and MCP reports may expose sensitive operational information, including site configuration, component versions, possible vulnerabilities, paths, and other details. Enable agent endpoints only when you understand where the data will be sent and who can access the token.<\/p>\n\n
Third-party AI agents may produce incomplete, incorrect, unsafe, or unsuitable recommendations. Review all recommendations before acting and do not perform destructive changes without backups and appropriate professional review.<\/p>\n\n
This plugin is not a firewall, malware cleaner, legal compliance tool, vulnerability scanner guarantee, or replacement for backups, security monitoring, dedicated scanners, or experienced administrators.<\/p>\n\n
External services<\/h4>\n\n
By default, Security Audit does not call external vulnerability services.<\/p>\n\n
If the administrator enables WPVulnerability lookups, the plugin sends installed plugin slugs to the public WPVulnerability API at https:\/\/www.wpvulnerability.net\/<\/code> to retrieve vulnerability data. No API key is required for normal component lookups. Responses are cached locally. See:<\/p>\n\n\n- https:\/\/www.wpvulnerability.com\/<\/li>\n
- https:\/\/docs.wpvulnerability.com\/<\/li>\n
- https:\/\/www.wpvulnerability.com\/privacy\/<\/li>\n
- https:\/\/www.wpvulnerability.com\/license\/<\/li>\n<\/ul>\n\n
During scans, Security Audit may also make a local HTTP HEAD request to the site's own homepage URL to inspect response headers. This request is sent to the configured site URL, not to a third-party vulnerability service.<\/p>\n\n\n
\n- Upload the plugin folder to
\/wp-content\/plugins\/<\/code> or install it from the WordPress plugin screen.<\/li>\n- Activate VideoWhisper Security Audit.<\/li>\n
- Go to Tools > Security Audit.<\/li>\n
- Run a scan and review findings.<\/li>\n
- Open the Settings tab to configure categories, default scan\/report mode, scan limits, and optional WPVulnerability lookups.<\/li>\n
- Open the Agents tab to enable REST\/MCP endpoints, rotate tokens, view endpoint URLs, and copy setup instructions if you want read-only external report access.<\/li>\n<\/ol>\n\n\n
\n