@wphealthkit/cli

CLI tool for WP HealthKit — audit WordPress plugins from your terminal.

Installation

# Global install
npm install -g @wphealthkit/cli

# Or run without installing
npx @wphealthkit/cli <command>

Authentication

Interactive login (recommended)

wphk login
# Enter your WP HealthKit API key when prompted
# Key is saved to ~/.wphkrc (chmod 600)

Environment variable

export WPHK_API_KEY=wphk_live_xxxxxxxxxxxx

Get your API key from wphealthkit.com/settings.

Commands

wphk audit <slug|file.zip>

Trigger an audit by WordPress.org plugin slug or local .zip file.

# Audit by wp.org slug
wphk audit woocommerce

# Audit a local plugin zip
wphk audit ./my-plugin.zip

Returns an auditId you can use to poll for results.

wphk report <audit-id>

Fetch the full audit report for a given audit ID.

wphk report aud_abc123

wphk findings <audit-id> [options]

List findings for an audit, with optional filters.

wphk findings aud_abc123
wphk findings aud_abc123 --severity critical
wphk findings aud_abc123 --category security
wphk findings aud_abc123 --severity high --limit 10

Options:

• --severity <level> — Filter by severity: critical, high, medium, low, info
• --category <name> — Filter by category: security, performance, compatibility, etc.
• --limit <n> — Limit number of results

wphk check <slug>

Quick directory lookup for a plugin — grade, risk, active installs, last audit.

wphk check woocommerce

Example output:

WooCommerce v9.4.2
  Grade: A | Risk: low
  Findings: 3 | Standards: 94/100
  Active installs: 7,000,000
  Last audited: 2026-04-08
  https://wphealthkit.com/directory/woocommerce

wphk usage

Show your current plan usage for the billing period.

wphk usage

Example output:

Tier: pro
Audits: 12/100 this month
Can audit: yes

wphk login

Save your API key to ~/.wphkrc. The file is created with 600 permissions (owner read/write only).

wphk login

wphk --version / wphk -v

Print the CLI version.

Environment Variables

| Variable | Description | Default | |---|---|---| | WPHK_API_KEY | Your WP HealthKit API key | — | | WPHK_API_URL | Override the API base URL | https://wphealthkit.com/api/v1 |

CI/CD Integration

Use the CLI in GitHub Actions to audit plugins as part of your workflow:

name: Plugin Audit

on:
  push:
    paths:
      - "my-plugin/**"

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install WP HealthKit CLI
        run: npm install -g @wphealthkit/cli

      - name: Build plugin zip
        run: zip -r my-plugin.zip my-plugin/

      - name: Trigger audit
        env:
          WPHK_API_KEY: ${{ secrets.WPHK_API_KEY }}
        run: |
          RESULT=$(wphk audit ./my-plugin.zip)
          echo "$RESULT"
          AUDIT_ID=$(echo "$RESULT" | jq -r '.data.auditId')
          echo "AUDIT_ID=$AUDIT_ID" >> $GITHUB_ENV

      - name: Wait for results (30s)
        run: sleep 30

      - name: Fetch report
        env:
          WPHK_API_KEY: ${{ secrets.WPHK_API_KEY }}
        run: wphk report $AUDIT_ID

License

MIT