Web Scan

io.github.ankitkumarjha515Published by GitHub account ankitkumarjha515v1.0.0Updated Oct 26, 2026

Audit any live URL: 85 SEO, AI-search, security, leaked-key and speed checks, with fixes to verify.

The publisher's own server: scan.mx Email Diagnostics

VerifiedStreamable HTTPWeb executableWeb Search & Scraping Developer Tools Security & Monitoring

Server details

Identifier: io.github.ankitkumarjha515/web-scan
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Oct 21, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account ankitkumarjha515 for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ankitkumarjha515%2Fweb-scan.svg)](https://sourceweft.com/mcp/io.github.ankitkumarjha515%2Fweb-scan?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Remote MCP server that audits a public URL for SEO, AI-search, security, leaked-key and speed issues, then re-checks after fixes.

What you can do: Scan a public URL and get a 0-100 score, grade and every failing or warning check with its id, detail and suggested fix
Re-scan a URL after deploying fixes and see per check id whether it now passes, plus new and previous scores and whether all checks are fixed
Read a stored report by its slug from a shared report link without scanning again
When to use it: Useful when a coding agent ships a site or preview deployment and you want it audited and the fixes verified in the live environment, or when someone shares a Web Scan report link to review. It covers one page per scan and is aimed at public sites.
Requirements: Remote Streamable HTTP endpoint; no API key or sign-up needed for the MCP server. The URL being scanned must be publicly reachable, so localhost and private networks are not supported. Fair-use rate limits apply per IP; signing in on the website gives higher limits and shareable saved reports.

Before you install

Scans are passive reads of what a public site already serves, but results can expose live secrets found in served JavaScript, so treat report contents as sensitive. Reports expire after two weeks, and shareable report links are only produced for signed-in requests. Rate limits apply per IP.

Installation

In SourceWeft

Open Web Scan in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ankitkumarjha515%2Fweb-scan/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "web-scan": {
      "type": "http",
      "url": "https://preflight-api.agentmarket.lol/api/mcp"
    }
  }
}

README

Web Scan

Your coding agent shipped it. Web Scan checks it.

One call audits any live URL in about 5 seconds: 85 checks across SEO, AI search (GEO), security headers, leaked API keys, Core Web Vitals and accessibility. Every finding comes with the exact fix, ranked by how many points it is worth. Then your agent fixes it and verifies the fix on the live site, without you re-running anything.

Free. No sign-up. No API key. Works as an MCP server, a GitHub Action, a CLI and on the web.

Why agents use it

Built for the agent loop. scan_url finds what is wrong, verify_fixes proves each fix landed in production, per check id. No screenshots to read, no dashboards to click.
Fixes, not findings. Each failing check returns its id, what was found on the page, and a concrete fix. Findings are ranked by real score gain (the report is re-scored with that one fix applied), so the agent works in the order that matters.
Catches what AI-built apps leak. Reads the JavaScript the site serves to every visitor and finds live secret keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, database URLs, private keys) and Supabase service_role keys. Every match gets a second look that drops placeholders and docs examples, so a red result is a real leak.
Sees the page the way AI search does. Shows what ChatGPT, Claude and Perplexity crawlers actually receive (no JavaScript), which AI bots robots.txt lets in, and whether the page answers the questions buyers ask.
Honest scoring. One number from three parts (search and sharing, security, speed), capped when a critical check fails, next to a benchmark of 25 well-known sites. Missing security headers are hardening notes, not holes. Unsure findings say "needs checking".
Safe to point at anything public. Passive only: it reads what the site already serves and never probes hidden paths. Text from scanned pages is returned as data, never as instructions.

MCP server

Remote, stateless, Streamable HTTP. No key needed.

Claude Code

Cursor (~/.cursor/mcp.json), Windsurf, VS Code (.vscode/mcp.json, key servers)

Codex (~/.codex/config.toml)

Tools

Tool	What it does
`scan_url`	Fresh audit of a public URL: score 0-100, grade, every failing or warning check with id, detail and fix, and `fullReportUrl` for the complete interactive report. 5-15 s.
`verify_fixes`	Re-scan after a deploy and report per check id whether it now passes, the new and previous score, what is still failing, and `allFixed`.
`get_report`	Read a shared report (`web-scan.agentmarket.lol/r/<slug>`) without re-scanning.

Try it in your agent:

Scan https://my-app.com with Web Scan, fix everything in this repo in order of points, and verify the fixes once I deploy.

GitHub Action

Fail the build when a deploy makes the site worse.

yaml

- uses: ankitkumarjha515/web-scan@v1  with:    url: https://my-app.com    min-score: 85        # fail below this score    fail-on: score       # score | failures | any | never

- uses: ankitkumarjha515/web-scan@v1  with:    url: https://my-app.com    min-score: 85        # fail below this score    fail-on: score       # score | failures | any | never

Writes a summary table to the job page, with a link to the full interactive report. Pair it with a preview deployment to catch problems before they reach production.

CLI

No dependencies, Node 18+.

bash

node bin/web-scan.mjs https://my-app.com --min-score 90node bin/web-scan.mjs https://my-app.com --fail-on failures --json

node bin/web-scan.mjs https://my-app.com --min-score 90node bin/web-scan.mjs https://my-app.com --fail-on failures --json

Exit code 0 passes, 1 fails the gate, 2 means the scan could not run. Every run ends with a link to the full report on the website: charts, the AI search view, link previews and a live speed test.

What it checks

Area	Examples
Search basics	title, description, canonical, headings, language, structured data validity, hreflang
AI search (GEO)	text without JavaScript, GPTBot / ClaudeBot / PerplexityBot access, llms.txt, answer-ready sections, citability
Crawlability	status, noindex, robots.txt (including rules that block this exact page), sitemap, soft 404s, redirects
Sharing	og:image that actually loads, titles and descriptions for X, LinkedIn, Slack and WhatsApp previews
Security	HTTPS, HSTS, CSP strength, cookies, CORS, mixed content, framing
Leaked secrets	provider keys and database URLs in served JavaScript, Supabase `service_role`, source maps, debug builds
Speed	server response, page weight, render-blocking files, fonts, caching, plus Core Web Vitals on demand
Images and accessibility	alt text, sizes, lazy loading, formats, zoom, labels, landmarks

Every report also says what kind of site it is (shop, local business, software, publisher, agency), the basics that kind of site needs, and what the scan covered and what it could not see.

Whole-site audits, competitor comparison, hourly monitoring and a README badge are on the website.

Limits

Public URLs only: no localhost or private networks. Use a preview deployment.
Fair-use rate limits per IP; sign in on the website for higher limits.
One page per scan_url call; use the website for whole-site crawls.

License

MIT for this repository (Action, CLI, registry metadata). The scanner itself runs as a hosted service.

Source: README.md at commit 8de8a99

Tools

scan_url

Scan a URL

Run a fresh Web Scan audit of a public URL and return its score (0-100), grade, and every failing or warning check with its id, title and fix: the result is complete in itself. reportUrl is a shareable link only when the request carries a signed-in Web Scan token (reports are saved for signed-in users only); otherwise it is null and nothing is stored. fullReportUrl is always present: the full report on the website, to share with the user. Use this first, to find out what to fix on a live page. Takes about 5-15 seconds. Cannot scan localhost or private networks; use a deployed or preview URL.

Parametersurlrequired

verify_fixes

Verify fixes

Re-scan a URL after you deployed fixes and report, per check id, whether it now passes (fixed: true), plus the new score, the previous score, what is still failing with its fix, and allFixed. Use this after a change reaches production (or a public preview) instead of asking the user to re-scan. Pass the check ids from the scan or fix prompt; with none, every failing or warning check is returned. If a fix you made still shows fixed: false, the deploy may not be live yet or a CDN may be serving a cached page: wait about a minute and call again before concluding the fix failed.

Parametersurlrequiredchecks

get_report

Get a stored report

Read a stored Web Scan report by its slug (the part after /r/ in a web-scan.agentmarket.lol/r/<slug> link) without re-scanning: score, grade, scan time and the failing or warning checks with fixes. Use this when the user shares a report link. Reports expire after two weeks; to check the current state of a site, use scan_url or verify_fixes instead.

Parametersslugrequired

Version history

v1.0.0LatestOct 21, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

Other Scan integrations

scan.mx Email Diagnostics

mx.scanOfficial publisher

Remote MCP server that lets an assistant run graded email deliverability and DNS checks on a domain, covering MX, SPF, DKIM, DMARC, blacklists and more.

Streamable HTTPWeb executable

Developer Tools9 toolsOct 25, 2026