A brief becomes a real page.Wordfence MCP integration
Ask how the site's security looks, and get a straight answer.
EMCP reads Wordfence's own status: the firewall mode, whether scans run and when one last failed, how many findings are open, and the findings and blocks themselves as type, severity and dates. It is read-only. IP addresses, file paths and finding details stay in Wordfence's screens.
Free integrationWordfence 9.0.2, single site
One question, four reads
| Step | What EMCP does |
|---|---|
| 01 · Status | Version, counts, app passwords off |
| 02 · Firewall | Enabled, extended protection |
| 03 · Scans | Last finished, no failure |
| 04 · Findings | Severity and type, no paths |
A practical place to start
From a security question to the right Wordfence screen.
- 01
Read the overview
status returns the version, licence state, whether application passwords are disabled and the finding counts.
- 02
Check firewall and scans
firewall reports the firewall and protection mode; scan-status reports whether a scan is running, the last completed scan and any failure.
- 03
Look at findings
list-findings returns new or ignored findings by severity, with a link to Wordfence's scan screen for the details.
Built for Wordfence
Read-only by design
Wordfence protects the site; an AI changing its firewall or allowlist could lock you out. So the integration has one read tool and no write tool. It never starts a scan, changes a setting or touches the blocklist.
Enough detail, nothing private
Findings come back as ID, type, severity, status and dates, and blocks as ID, type, dates, hit counts and expiry. IP addresses, file paths and the raw finding data stay out of the answer; list-findings links to Wordfence’s scan screen for the full picture.
Connecting on a Wordfence site
Wordfence turns off WordPress application passwords by default. Use EMCP’s OAuth sign-in when you connect your AI client, and leave Wordfence’s setting as it is. status tells you whether application passwords are disabled.
Use the Wordfence tool reference for operation names and arguments, and EMCP’s own security tools for a malware and hardening scan.
Get connected
Put Wordfence in your AI’s toolkit.
- 1
Install Wordfence
Install EMCP Tools 3.21.1 or later, or EMCP Lite 1.0.5 from WordPress.org, with Wordfence 9.0.2 on a single site. Other versions and multisite are refused.
- 2
Connect with OAuth
Wordfence disables application passwords by default. Connect your AI client with EMCP's OAuth sign-in rather than changing that setting.
- 3
Ask about the site
wordfence-read is on by default. There is no write tool to enable.
Then connect Claude Code, Claude Desktop, or Cursor to use the Wordfence tools enabled on your site. Compare Free and Pro access.
A few useful details
Before you connect.
Questions about Wordfence, supported operations, and the workflow on your site.
Can it start a scan?
No. scan-status reports scan_start_supported as false. Start scans in Wordfence.
Why are IP addresses missing from blocks?
Block entries return type, dates, hit counts and expiry only, so visitor IP addresses are never sent to the AI.
Does no findings mean the site is clean?
No. Findings are what earlier scans stored. Check when the last scan ran and whether it failed.
Do I need Wordfence Premium?
No. The free edition works. status reports whether a licence is configured and whether it is premium.
Your tools. Your WordPress site.