# com.validoria/validoria-mcp

> Continuous website testing by Validoria — monitor security, SEO, performance, and accessibility.

- name: com.validoria/validoria-mcp
- version: 2.0.1
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.validoria%2Fvalidoria-mcp
- tools: https://api.protogrid.dev/v1/servers/com.validoria%2Fvalidoria-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "validoria-mcp": {
      "type": "http",
      "url": "https://api.teste.no/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-99% ~updated-72d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 57 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_incident (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_keywords (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_finding (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- warn `tools.token_cost`: about 12,063 tokens to load every tool
- warn `tools.api_dump`: 74 tools, 69% named like REST operations: looks like an API mapped one endpoint per tool

### stability: 100 (weight 15)

- pass `stability.changes`: 4 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: validoria-mcp@2.0.1 resolved: 98 packages

- tools: 74, about 12,063 tokens to load them all
- tool set hash: 664fb245cb46fd529f9cd0a53dc9a989
- tools last changed: 2026-10-11T09:51:33.084Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.validoria/validoria-mcp.svg)](https://protogrid.dev/servers/com.validoria/validoria-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-11 `add_keyword` changed (description, inputSchema)
  - before: Add an SEO keyword to track for a target. Max 50 keywords per target.
  - after: Add an SEO keyword to track for a target, optionally for one page (pageUrl). Max 50 keywords per target.
- 2026-10-11 `list_keywords` changed (description)
  - before: List all SEO keywords tracked for a target, including latest Google rank position. Max 50 per target.
  - after: List all SEO keywords tracked for a target, including latest Google rank position and the page each is tracked for. Max 50 per target.
- 2026-10-04 `update_team_settings` changed (inputSchema)
- 2026-10-02 `get_target_scores` changed (description)
  - before: Get composite scores (Security, SEO, Performance, Accessibility) for a target. Each score is 0-100 with a status rating.
  - after: Get composite scores (Security, SEO, Performance, Accessibility, AI-search readiness) for a target. Each score is 0-100 with a status rating.

Full history: https://api.protogrid.dev/v1/servers/com.validoria%2Fvalidoria-mcp/changes

## Dependencies

- npm validoria-mcp@2.0.1: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.teste.no/api/mcp (streamable-http, auth none, reachable true, uptime30d 0.9915254)

## Packages

- npm validoria-mcp@2.0.1 secrets: TESTE_NO_API_KEY

## Tools (74)

- `acknowledge_incident`: Acknowledge an open incident to signal that someone is looking at it. Changes status from OPEN to ACKNOWLEDGED.
- `active_runs`: Get currently running and queued tests across all targets. Useful for checking what tests are in progress right now.
- `add_keyword`: Add an SEO keyword to track for a target, optionally for one page (pageUrl). Max 50 keywords per target.
- `analyze_target`: Fingerprint a URL and get test recommendations before creating a target. Detects platform (Shopify, WordPress, etc.), CDN, server stack, frontend framework, analytics, and B2B/ecommerce signals. Returns recommended tests with explanations. Use this before create_target to know what type to assign and which tests will be enabled.
- `cancel_load_test`: Cancel a running load test.
- `create_automation_rule`: Create an automation rule that reacts to events. Triggers: TEST_FAILED, TEST_RECOVERED, INCIDENT_CREATED, INCIDENT_RESOLVED, TARGET_DOWN, TARGET_RECOVERED. Actions: escalate (change severity), suppress (mute), rerun (schedule retry), notify, webhook, add_note.
- `create_journey`: Create a custom browser test flow for a target. Steps are executed sequentially in a Playwright browser. Supports actions: navigate, click, type, fill, select, assert, wait, screenshot, scroll, hover, use_fragment. Variables like {{LOGIN_EMAIL}} are resolved from the target secrets vault.
- `create_maintenance_window`: Schedule a maintenance window for a target. During maintenance, alerts and notifications are suppressed. Supports one-time, daily, and weekly recurring windows.
- `create_muting_rule`: Create a rule to auto-mute findings matching a pattern. Existing open findings matching the rule are muted immediately. Supports muting by fingerprint pattern, test definition, or test+target combination.
- `create_notification_rule`: Create a notification alert rule. Defines which events at which severity levels trigger notifications on which channels. Supports quiet hours and per-target scoping.
- `create_page_fragment`: Create a reusable step sequence that can be shared across multiple Journeys. Fragment names must be unique per team.
- `create_scheduled_report`: Create a new scheduled email report. Reports include run stats, open findings, composite scores, and per-target status.
- `create_target`: Add a new website, API, or webshop target for monitoring with full onboarding. Automatically enables compatible tests, triggers an initial scan, and captures a page screenshot. Requires write scope (Free plan: 1 target). Use analyze_target first to detect platform and get test recommendations.
- `daily_trends`: Get daily time-series data for runs, findings, and average duration. Useful for identifying trends over time. Returns up to 90 days of data.
- `delete_automation_rule`: Permanently delete an automation rule.
- `delete_journey`: Permanently delete a journey and all its steps.
- `delete_maintenance_window`: Remove a scheduled maintenance window.
- `delete_notification_rule`: Permanently delete a notification rule.
- `delete_page_fragment`: Permanently delete a page fragment.
- `delete_scheduled_report`: Permanently delete a scheduled report.
- `delete_secret`: Permanently delete a secret from a target's vault.
- `delete_target`: Permanently delete a target and all its associated data (runs, findings, incidents, artifacts). This cannot be undone.
- `disable_all_tests`: Disable all test definitions globally. Optionally filter by category to only disable tests in that category. Requires admin scope.
- `enable_all_tests`: Enable all test definitions globally. Optionally filter by category to only enable tests in that category. Requires admin scope.
- `get_automation_rule`: Get full details of a specific automation rule.
- `get_finding`: Get full details of a specific finding, including evidence, AI analysis, and recommended fix.
- `get_incident`: Get full details of a specific incident including linked findings, AI analysis, and deployment correlation.
- `get_journey`: Get full details of a specific journey including all steps.
- `get_load_test`: Get details and results of a load test run.
- `get_run`: Get full details of a specific test run including metrics, score, summary, errors, and associated findings.
- `get_site_map`: Get the latest crawl snapshot for a target. Returns page inventory stats, SEO issues, broken pages/assets, response times, and a diff against the previous crawl. Optionally include page-level details.
- `get_target`: Get detailed information about a specific target including status, uptime, fingerprint, and composite scores.
- `get_target_scores`: Get composite scores (Security, SEO, Performance, Accessibility, AI-search readiness) for a target. Each score is 0-100 with a status rating.
- `get_team_settings`: Get the team's configuration including AI enrichment, uptime monitoring, severity escalation, run policies, notification coalescing, SEO, and Kloner Tasks integration settings.
- `guest_get_scan`: Poll results for a guest_start_scan. Pass the scanId and guestSessionId from the start response. No API key required.
- `guest_start_scan`: Run a free 6-test HTTP scan against a public URL without an API key. Rate-limited (5/IP/hour, 3/session/day). Returns scanId — poll with guest_get_scan. For continuous monitoring, sign up free and use create_target. See teste-no://docs/quickstart.
- `import_targets`: Bulk import up to 100 websites for monitoring. Each URL gets a target created with auto-enabled tests, initial scan, and screenshot capture. Partial success — failed URLs are reported individually without blocking others.
- `list_automation_rules`: List all automation rules for the team. Rules automatically react to events (test failures, incidents, downtime) with configurable actions (escalate severity, suppress, rerun, webhook, notify).
- `list_findings`: List findings (discovered issues) across your targets. Filter by status, severity, or target. Returns title, severity, status, test name, and AI enrichment if available.
- `list_incidents`: List incidents (grouped operational issues) across your targets. Filter by status. Returns title, severity, status, findings count, and deployment correlation.
- `list_journeys`: List custom browser test flows (journeys) for a target or all team targets. Journeys are multi-step Playwright tests that verify user flows like checkout, login, and search.
- `list_keywords`: List all SEO keywords tracked for a target, including latest Google rank position and the page each is tracked for. Max 50 per target.
- `list_load_tests`: List recent load test runs for a target.
- `list_maintenance_windows`: List maintenance windows for a target. Shows scheduled and recurring maintenance periods that suppress alerts.
- `list_notification_channels`: List all notification channels (Email, Slack, Webhook, SMS, Web Push) configured for the team. Sensitive config values are redacted.
- `list_notification_rules`: List all notification alert rules for the team. Rules map event types + severity levels to notification channels.
- `list_page_fragments`: List all reusable page fragments for the team. Fragments are shared step sequences (e.g. "Login", "Dismiss Cookies") that can be inserted into multiple Journeys via the use_fragment action.
- `list_runs`: List recent test runs. Filter by target, status, or test slug. Returns run status, score, summary, duration, and finding count.
- `list_scheduled_reports`: List all scheduled reports for the team. Reports are automatically generated and emailed on a daily or weekly basis.
- `list_secrets`: List secrets stored in a target's vault. Values are masked — only key names and labels are shown. Secrets are used by test plugins (e.g. LOGIN_EMAIL, LOGIN_PASSWORD for B2B shops, ga4_service_account for GA4).
- `list_targets`: List all monitoring targets for your team. Returns name, URL, type, status, and uptime info for each target.
- `list_tests`: List all available test definitions (plugins). Shows slug, name, category, runner type, weight class, schedule, and enablement status. Useful for knowing which tests can be triggered.
- `mute_finding`: Mute an open finding to suppress it from dashboards and alerts. Status changes from OPEN to MUTED.
- `recompute_scores`: Force recompute all composite scores (Security, SEO, Performance, Accessibility) for a target. Useful after manual changes or when scores seem stale.
- `record_deployment`: Record a deployment event for a target. Deployments are auto-correlated with incidents created within 20 minutes. Useful for tracking releases and root-cause analysis.
- `remove_keyword`: Remove an SEO keyword from a target.
- `resolve_incident`: Resolve an incident to mark it as handled. Changes status to RESOLVED and sets the closed timestamp.
- `rotate_secret`: Update the value of an existing secret.
- `start_load_test`: Start a load test against a target. Max 100 concurrent connections, max 5 min duration, 1 test at a time per target, 60s cooldown between tests. Modes: HTTP_FLOOD (autocannon), BROWSER_USERS (Playwright), COMBINED (both). OWNER/ADMIN only.
- `store_secret`: Store an encrypted secret in a target's vault. Common keys: LOGIN_EMAIL, LOGIN_PASSWORD (B2B shop auth), ga4_service_account (GA4 monitoring). Values are AES-256-GCM encrypted at rest.
- `system_health`: Get a comprehensive system health report: BullMQ queue depths, active/stuck runs, user sessions, notification delivery stats, and recent error counts. Requires admin scope.
- `target_stats`: Get statistics for a specific target: runs, pass rate, findings, duration. Supports lifetime, monthly, or weekly periods.
- `team_stats`: Get team-wide overview statistics: total runs, pass rate, open findings, open incidents, average duration. Supports lifetime, monthly, or weekly periods.
- `trigger_all_tests`: Run all enabled tests against a target as a scan workflow. All tests in the target's test profile are queued. Returns the workflow ID and list of queued runs.
- `trigger_journey`: Execute a journey (custom browser test flow) against its target. The journey runs asynchronously — use get_run to check progress.
- `trigger_test`: Run a specific test against a target. Specify either the test definition ID or slug. The test is queued and executed asynchronously — use get_run to check status.
- `update_automation_rule`: Update an existing automation rule. Any field not provided will remain unchanged.
- `update_journey`: Update a journey's name, settings, or steps. When steps are provided, all existing steps are replaced.
- `update_notification_rule`: Update a notification rule. Only provided fields are changed.
- `update_page_fragment`: Update a page fragment. When steps are provided, all existing steps are replaced.
- `update_scheduled_report`: Update an existing scheduled report. Any field not provided stays unchanged.
- `update_target`: Update a target's properties (name, URL, type, environment, business weight, tags, uptime toggle).
- `update_team_settings`: Update team configuration. All fields are optional — only provided fields are changed. Covers: AI enrichment (model, temperature, auto-enrich, spending cap), uptime (timeout, thresholds), severity escalation (recurrence/age triggers), run policies (concurrency, timeouts), SEO (rank tracking, keyword strategy), notification coalescing (digest), and the kill switch (testsPaused).
- `update_test`: Enable or disable a test definition globally, or update its schedule/timeout. Requires admin scope.