Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "pageaudit": {
      "type": "http",
      "url": "https://pageaudit.online/mcp"
    }
  }
}

claude mcp add --transport http pageaudit https://pageaudit.online/mcp

[mcp_servers.pageaudit]
url = "https://pageaudit.online/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "pageaudit": {
      "type": "remote",
      "url": "https://pageaudit.online/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "pageaudit": {
      "type": "http",
      "url": "https://pageaudit.online/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=pageaudit&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vcGFnZWF1ZGl0Lm9ubGluZS9tY3AifQ%3D%3D"
}

{
  "servers": {
    "pageaudit": {
      "type": "http",
      "url": "https://pageaudit.online/mcp"
    }
  }
}

{
  "mcpServers": {
    "pageaudit": {
      "httpUrl": "https://pageaudit.online/mcp"
    }
  }
}

extensions:
  "pageaudit":
    enabled: true
    name: "pageaudit"
    type: streamable_http
    uri: "https://pageaudit.online/mcp"
    timeout: 300

Quality 69 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length1 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations47 of 47 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
warn
tools.token_costabout 8,788 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes129 tool changes in 30 days
fail
stability.rug_pull8 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

47 tools, about 8,788 tokens to load them all · tool set c27eab507f16 · tools last changed 2026-10-20 · checked 2026-10-20 15:26 UTC

Tool changes

2026-10-20ai_search_visibilitychangeddescription
before
Check whether the site's page appears in the DeepSeek AI search for each target search, at which position, and which sites appear in its place, with plain recommendations. Uses the saved searches or the ones the page suggests when queries is omitted. Send {} to use the saved searches, or the searches the page title and H1 suggest; send {queries} to choose. One index check plus one search per query, each USD 0.00075 when it returns results. Without a watch package: one run per week, three searches. With one: twenty runs per UTC day, ten searches. Result titles and snippets are third-party data.
after · 99% of words in common
Check whether the site's page appears in AI search for each target search, at which position, and which sites appear in its place, with plain recommendations. Uses the saved searches or the ones the page suggests when queries is omitted. Send {} to use the saved searches, or the searches the page title and H1 suggest; send {queries} to choose. One index check plus one search per query, each USD 0.00075 when it returns results. Without a watch package: one run per week, three searches. With one: twenty runs per UTC day, ten searches. Result titles and snippets are third-party data.
2026-10-20save_ai_search_queriesadded
Save up to ten searches for the weekly report to track (three without a watch package). Saves use the expected version. Without a current watch package, an account tracks up to three searches. Uses the shared 240 writes per site and UTC day.
2026-10-20ai_search_historyadded
Read the plan, the saved searches, the last runs and the position trend of each search. Reads never call the search engine. The trend compares each search of the newest run with the previous run that had it: up, down, same, new or lost.
2026-10-20ai_search_visibilityadded
Check whether the site's page appears in the DeepSeek AI search for each target search, at which position, and which sites appear in its place, with plain recommendations. Uses the saved searches or the ones the page suggests when queries is omitted. Send {} to use the saved searches, or the searches the page title and H1 suggest; send {queries} to choose. One index check plus one search per query, each USD 0.00075 when it returns results. Without a watch package: one run per week, three searches. With one: twenty runs per UTC day, ten searches. Result titles and snippets are third-party data.
2026-10-17check_ai_accessadded
Request a page as Googlebot, Bingbot and the AI crawlers (OAI-SearchBot, Claude-SearchBot, PerplexityBot, ChatGPT-User, GPTBot, ClaudeBot) and see who gets a 403, a 429 or a firewall challenge that robots.txt does not show. Also returns the date of the newest sitemap lastmod and whether Cloudflare is in front. Free, without an account. The same page within one hour returns the stored result. The page is requested with the published user agent of Googlebot, Bingbot, OAI-SearchBot, Claude-SearchBot, PerplexityBot, ChatGPT-User, GPTBot, ClaudeBot, and once as a browser. A 403, a 429 or a firewall challenge that only a crawler gets is the block that robots.txt does not show. The sitemap is the one that robots.txt declares, or `/sitemap.xml`; it is stale when its newest `lastmod` is more than 30 days old. Limit: Cloudflare recognises the real crawler by its IP address, so a rule that trusts verified bots can treat the real crawler differently. The same page within one hour returns the stored result (`cached_at`) without requesting the site again.
2026-10-17weekly_site_report_historyadded
Read one weekly report of a site's history by its id.
2026-10-17save_weekly_site_reportadded
Turn the weekly report of a site on or off and set up to 3 competitors. Turning on needs a watch package in force. Turning on needs a watch package in force and a free site in it (409 with `limit` and `plans` otherwise). The first report runs right away; later ones run a week after the last. A new competitor gets its base this week and its new pages from the next. Saves use the expected version.
2026-10-17weekly_site_reportadded
Read the weekly report of a site: what changed since last week, the new pages of up to 3 competitors and every finding. Reading never runs the report. Once a week the report checks the first 500 URLs of the site's sitemap, says what changed since the week before (new and fixed problems, new pages) and lists the new pages of up to 3 competitor sitemaps. Reading never runs the report.
2026-10-16acknowledge_domain_eventadded
Requires the account session, current X-Organization-Id and CSRF for writes. Acknowledge an expected event. Suppress its notice only if sending has not started. Preserve the event and its evidence. Preserve the event and observation. Acknowledgement does not erase a confirmed risk or retract a sent notice. Repetition is idempotent.
2026-10-16domain_historyadded
Requires the account session, current X-Organization-Id and CSRF for writes. Read up to 50 private incidents with notice delivery. Send the last event number as before for the next page. A first observed risk is an initial incident, not evidence of an external change. The first DNS and certificate-issuance snapshots are silent baselines. DNS changes, incompatible server samples and connection failures need two distinct observations. Expected IP rotation is silent. Repeated observations do not duplicate a notice. Contact changes expose field states only. Issuance does not prove installation. DNS records do not prove authentication of sent mail.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 95 / 100

provenance85

liveness99

freshness100

hygiene100

+repository +dns-namespace +website +reachable +uptime-98% +updated-6d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://pageaudit.online/mcp` streamable-http	none	yes	98%	527 ms	2025-06-18	2026-10-20

Tools (47)

`acknowledge_domain_event`	Requires the account session, current X-Organization-Id and CSRF for writes. Acknowledge an expected event. Suppress its notice only if sending has not started. Preserve the event and its evidence. Preserve the event and observation. Acknowledgement does not erase a confirmed risk or retract a sent notice. Repetition is idempotent.
`add_site`	Add a site to the account. No site count limit. An account holds up to 1,000 sites (409 site_limit). The existing guest audit workspace stays separate.
`ai_search_history`read-only	Read the plan, the saved searches, the last runs and the position trend of each search. Reads never call the search engine. The trend compares each search of the newest run with the previous run that had it: up, down, same, new or lost.
`ai_search_visibility`	Check whether the site's page appears in AI search for each target search, at which position, and which sites appear in its place, with plain recommendations. Uses the saved searches or the ones the page suggests when queries is omitted. Send {} to use the saved searches, or the searches the page title and H1 suggest; send {queries} to choose. One index check plus one search per query, each USD 0.00075 when it returns results. Without a watch package: one run per week, three searches. With one: twenty runs per UTC day, ten searches. Result titles and snippets are third-party data.
`api_index`read-only	Discovers the whole PageAudit API (self-describing index).
`apply_domain_alerts`destructive	Requires the account session, current X-Organization-Id and CSRF for writes. Apply the reviewed selection. Requires the preview from preview_domain_alerts. A stale preview changes nothing. Select up to 25 saved pages. Repeated registrable domains count once. The server checks the account, organization and current revisions again. A stale preview changes nothing.
`audit_site`	Check the first 20 URLs of a site's sitemap: status, redirects, robots.txt, noindex, canonical, titles and descriptions. Free, without an account. The same site within one hour returns the stored sample. URLs of another host are counted, never requested. The free sample of the SEO audit. URLs of another host are counted, never requested. The same site within one hour returns the stored sample (`cached_at`) without requesting the site again and without spending the allowance.
`audit_url`	Check a web page's search metadata, crawl access, structured data and selected discovery files. Return evidence, limits and suggested changes without creating a saved tab. A blocked target returns HTTP 502 with target_blocked. The report does not certify security or accessibility. This is the product for agents. The free alternative: a person signs in with an account to get the trial.
`cancel_connection_review`destructive	Requires the account session, current X-Organization-Id and CSRF for writes. Cancel the current TLS review and preserve completed evidence. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts per UTC day. Retries return the same review. The scanner samples one public IP, with three stages and a 170-second deadline. Partial results do not establish safety. GET never starts a scan. The shared realtime channel reports stage changes. Reports expire after 26 hours.
`check_ai_access`	Request a page as Googlebot, Bingbot and the AI crawlers (OAI-SearchBot, Claude-SearchBot, PerplexityBot, ChatGPT-User, GPTBot, ClaudeBot) and see who gets a 403, a 429 or a firewall challenge that robots.txt does not show. Also returns the date of the newest sitemap lastmod and whether Cloudflare is in front. Free, without an account. The same page within one hour returns the stored result. The page is requested with the published user agent of Googlebot, Bingbot, OAI-SearchBot, Claude-SearchBot, PerplexityBot, ChatGPT-User, GPTBot, ClaudeBot, and once as a browser. A 403, a 429 or a firewall challenge that only a crawler gets is the block that robots.txt does not show. The sitemap is the one that robots.txt declares, or `/sitemap.xml`; it is stale when its newest `lastmod` is more than 30 days old. Limit: Cloudflare recognises the real crawler by its IP address, so a rule that trusts verified bots can treat the real crawler differently. The same page within one hour returns the stored result (`cached_at`) without requesting the site again.
`check_domain`	Refresh due registration, contacts, TLS, DNS, mail policies, certificate issuance and a limited DNS/TLS sample. Reuses fresh public data. Reuse fresh observations. A failed or partial query preserves the last complete observation and its date. Up to 100 cold page reads per owner and UTC day.
`configure_domain_dns`destructive	Requires the account session, current X-Organization-Id and CSRF for writes. Set up to three known DKIM selectors and choose whether IP rotation is expected. Expected rotation keeps history without notices; alias changes still notify. Does not discover selectors, enable monitoring or authenticate sent messages. Send manual_expires_on, dns, or both. Omitted settings are preserved. DNS requires both selectors and rotating_addresses. An identical retry is idempotent. A conflicting revision returns 409.
`configure_domain_monitor`destructive	Requires the account session, current X-Organization-Id and CSRF for writes. Enable or stop domain monitoring, or pause notices for maintenance. Count a registry domain once per account, including its organization copies. Add only the tab's origin. HTTP receives DNS checks only. Maintenance pauses notices while collection continues. Confirm enabled, no suspension and next_check_at after saving.
`connection_review`read-only	Requires the account session, current X-Organization-Id and CSRF for writes. Read today's private TLS review without starting a scan. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts per UTC day. Retries return the same review. The scanner samples one public IP, with three stages and a 170-second deadline. Partial results do not establish safety. GET never starts a scan. The shared realtime channel reports stage changes. Reports expire after 26 hours.
`connect_search_console`	Start read-only Google consent. The account owner must follow redirect in their browser. Follow redirect in the account's browser. Consent expires after five minutes. The callback is single-use and bound to the account and site. The property must match the site and Google must authorize it before the connection is saved.
`contact`	Write to the people behind the product: a question, or a sponsorship/partnership/advertising proposal. One route for a question and for a sponsorship, partnership or ad proposal (`tipo`, with the placements of `GET /api/partners`). One message every 10 seconds per network: one that arrives sooner waits its turn and then goes out — no error. The message reaches the team by e-mail, with `email` as the reply address. For voice, send multipart/form-data: `dados` is this JSON (up to 32 KiB), and `audio` is one WebM, Ogg or M4A audio file (up to 2 MB). Audio can replace message. The browser records up to two minutes. Audio is attached to the owner's e-mail.
`create_guest`	Creates a guest token pa_… for the tab workspace. Keep the token: it is the identity of the tabs and of the audits tied to them.
`create_tab`	Opens a saved URL. Set queue_audit=false to monitor a discovered origin without a page audit.
`disconnect_search_console`destructive	Remove the local Google credential and stop collection. Keep the last good sample. The last good sample stays available. An in-flight callback or collection cannot reconnect the site.
`domain_history`read-only	Requires the account session, current X-Organization-Id and CSRF for writes. Read up to 50 private incidents with notice delivery. Send the last event number as before for the next page. A first observed risk is an initial incident, not evidence of an external change. The first DNS and certificate-issuance snapshots are silent baselines. DNS changes, incompatible server samples and connection failures need two distinct observations. Expected IP rotation is silent. Repeated observations do not duplicate a notice. Contact changes expose field states only. Issuance does not prove installation. DNS records do not prove authentication of sent mail.
`domain_portfolio`	Requires the account session, current X-Organization-Id and CSRF for writes. Read cached domain monitoring and deadlines for selected saved pages. Does not start external collection or activate monitoring. Every tab must belong to the current account and organization. Repeat with the next group of IDs for a larger workspace.
`domain_status`read-only	Read registration, contact visibility, TLS, DNS, CAA, mail policies, certificate issuance and a limited server comparison. Read source dates and collection gaps. Private options require the account session. A discovered name never starts monitoring automatically. Pages share public observations by registry domain and HTTPS origin. Private settings and history stay with the account and organization. Missing data is not a healthy result.
`embed_snippet`read-only	The embeddable widget's snippet, already assembled with the site's name and colour — one script tag, no account, no lead capture. One script tag puts the audit form on your own site, with your name and colour, and no account or key. Send the same query you would send to `/embed` and the answer comes back with `snippet` already assembled. The widget never asks the visitor for an e-mail.
`get_audit`read-only	Re-reads an audit already made, with `fixes` (the ready fix for each finding).
`get_badge`read-only	Metadata and markdown of the SVG badge of a shared report.
`get_patch`read-only	The consolidated patch of an audit: <head> block to paste, files to create and templates with placeholders. No model — only facts from the page. Each finding becomes a fix in one of three classes: `deterministico` (comes whole from what the page declares: final URL, title, description, OG), `molde` (a tag with a marked placeholder, like `{{TITULO}}`, and the suggested source) or `sem_patch` (a decision or infrastructure, with the instruction). Nothing is invented by a model.
`get_site`read-only	Read one site owned by the signed-in account.
`get_tool`read-only	Copy and checks of one micro-tool by slug (e.g. title-tag-checker).
`health`read-only	Liveness and the commit deployed right now — it is how the smoke waits for its own deploy.
`journeys`read-only	Read the owned site's installation, actions, paths and ordered conversion funnel for the last seven days. Requires the account's browser session. Only this site's owner can read it. Data updates through the shared realtime transport. No user identity, typed text or screen recording.
`lab_result`read-only	The lab tests of an audit (mobile and desktop): running, finished with scores, metrics and biggest savings, or failed. With wait (up to 25) it answers as soon as a running test finishes. Long-poll: with `wait` the answer comes as soon as a running test finishes, or after `wait` seconds with `status: running`. Repeat until it is not running.
`lab_test`	Starts a lab test of an audit's page: Lighthouse run by Google PageSpeed Insights (performance, accessibility, best practices, SEO). Answers 202 at once; the test takes ~25 s to 2+ minutes — then read it with lab_result. Does not change the audit score. Answers 202 at once; the test runs for ~25 s to over 2 minutes and its summary is stored in the audit (`summary.lab.<strategy>`), so it comes back in `GET /api/audits/:id`, in the tab and in the shared report. It does not change the audit score. Calling again while the same strategy is running does not start a second test. Limits: 4 tests at a time on the server, 6 per network per hour and 500 per day for the whole product.
`list_sites`read-only	Read up to 50 sites owned by the signed-in account. Follow next_cursor.
`list_tabs`read-only	Lists the owner's saved pages (guest or session), with the active page's last report. Group pages by site to match the Projects table. One call loads the saved pages and the active page's last report. The UI groups pages by site in Projects and opens each site in a work tab. The introduction stays in Welcome. A signed-in account sends `X-Organization-Id`; a guest has one temporary workspace.
`list_tools`read-only	Lists the micro-tools (title, meta, canonical, OG, JSON-LD…).
`preview_domain_alerts`	Requires the account session, current X-Organization-Id and CSRF for writes. Review the exact selected domains before changing renewal notices. Select up to 25 saved pages. Repeated registrable domains count once. The server checks the account, organization and current revisions again. A stale preview changes nothing.
`review_connection`	Requires the account session, current X-Organization-Id and CSRF for writes. Start a TLS review of the saved HTTPS origin using current domain monitoring rights. At most three starts per account and UTC day, one per site. A repeated request reuses today's review. Do not claim complete safety from a partial result. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts per UTC day. Retries return the same review. The scanner samples one public IP, with three stages and a 170-second deadline. Partial results do not establish safety. GET never starts a scan. The shared realtime channel reports stage changes. Reports expire after 26 hours.
`run_tab`	Re-audits the tab's URL.
`save_ai_search_queries`destructive	Save up to ten searches for the weekly report to track (three without a watch package). Saves use the expected version. Without a current watch package, an account tracks up to three searches. Uses the shared 240 writes per site and UTC day.
`save_weekly_site_report`destructive	Turn the weekly report of a site on or off and set up to 3 competitors. Turning on needs a watch package in force. Turning on needs a watch package in force and a free site in it (409 with `limit` and `plans` otherwise). The first report runs right away; later ones run a week after the last. A new competitor gets its base this week and its new pages from the next. Saves use the expected version.
`search_console`read-only	Read the site's last good 28-day sample, partial coverage, dates and collection failure. The sample covers 28 days, at most 50 queries and 50 pages. Coverage is partial. It is not a traffic total or a ranking promise. Credentials and raw provider responses are not returned.
`set_domain_expiry`destructive	Requires the account session, current X-Organization-Id and CSRF for writes. Set or remove the private manual expiry. Send manual_expires_on, dns, or both. Omitted settings are preserved. DNS requires both selectors and rotating_addresses. An identical retry is idempotent. A conflicting revision returns 409.
`sync_search_console`	Collect a due sample. Repeated calls cannot bypass the daily reservation. The hourly schedule uses the same durable reservation. A failure preserves the last good sample and schedules the next attempt 24 hours later. This route cannot force an extra collection.
`tab_history`read-only	The tab's previous runs and what changed between each one and the one before it (score delta, findings that appeared and that disappeared). Every run has always been kept; this is where you read the series. Each entry carries the score, the counts and a `change` with the point delta and the findings that appeared (`broke`) or disappeared (`fixed`) since the previous run — compared by finding code, never by message. Runs older than the watch feature are matched by URL.
`watch_tab`destructive	Turns the daily watch on or off for a tab: it re-audits the page once a day and e-mails when the score drops or a new error/warning appears. Needs the signed-in account (its browser session cookie); a guest token gets 403 `account_required`. With `monitor: true` the page is re-audited once a day and an e-mail goes out when the score drops or a new error/warning appears — never on an improvement. Watching needs an account (the alert has to reach someone) and each account watches a limited number of pages.
`weekly_site_report`read-only	Read the weekly report of a site: what changed since last week, the new pages of up to 3 competitors and every finding. Reading never runs the report. Once a week the report checks the first 500 URLs of the site's sitemap, says what changed since the week before (new and fixed problems, new pages) and lists the new pages of up to 3 competitor sitemaps. Reading never runs the report.
`weekly_site_report_history`read-only	Read one weekly report of a site's history by its id.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "online.pageaudit/pageaudit",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
  "remotes": [
    {
      "url": "https://pageaudit.online/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.0.1",
  "repository": {
    "url": "https://github.com/wrpbr/pageaudit",
    "source": "github"
  },
  "websiteUrl": "https://pageaudit.online",
  "description": "Technical SEO, passive security and page-delivery audits with evidence and suggested fixes."
}