Store Canary

io.github.erikrasPublished by GitHub account erikrasv1.1.0Updated Oct 30, 2026

Free read-only WooCommerce checks: store, SSL, exposure, SEO, speed, products, policies + 3 prompts

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & AnalyticsBusiness & Commerce

Overview

AI-generated overview

Hosted, read-only MCP server that audits a public WooCommerce store from the outside and returns pass/warn/fail findings with fixes.

What you can do
  • Run an overall store health check covering reachability, HTTPS, WooCommerce detection, cart and checkout loading, and payment markers
  • Check SSL: certificate acceptance, http-to-https redirect, redirect chain length and HSTS header
  • Inspect exposure of WordPress, WooCommerce, plugin and PHP versions, public readme and debug log
  • Check SEO basics: robots.txt, XML sitemap, homepage title, meta description and noindex
  • Time one download each of the homepage, a product page and the cart, and sample up to 10 products for missing prices, images or stock
  • Verify policy links for privacy, terms, shipping and returns, and explain any finding code in plain words with a suggested fix
When to use it
Useful when you want a quick outside-in health, security-hygiene, SEO or speed snapshot of a WooCommerce store, for example before a sale or when diagnosing a broken checkout, without installing anything or logging in.
Requirements
Remote Streamable HTTP endpoint at mcp.storecanary.app; no account, API key or auth headers. Clients that only support stdio can bridge via npx mcp-remote. The target store must be a public web address (no IPs, private networks or unusual ports).
Before you install
Checks send GET requests to the store URL you supply, so that address reaches the service; results, URLs and IPs are stated not to be stored. Rate limited to about 10 checks a minute per connection. Speed figures are single samples, not lab tests, and certificate expiry is not visible. Nothing is monitored or scheduled, and no writes, logins or cart actions occur.

Installation

In SourceWeft

  1. Open Store Canary in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.erikras%2Fstore-canary/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "store-canary": {
      "type": "http",
      "url": "https://mcp.storecanary.app/mcp"
    }
  }
}

README

[Store Canary logo]

Store Canary MCP connector

A free, hosted, read-only MCP server that checks a public WooCommerce store from the outside and answers in plain pass / warn / fail lines. No account, no API key, no install.

Connector address: https://mcp.storecanary.app/mcp (Streamable HTTP, no authentication)

Docs: https://storecanary.app/mcp

This repository only documents the hosted connector. It contains no server code.

Tools (all read-only)

ToolWhat it checks
check_storeOverall health: homepage reachable, HTTPS valid and redirects sane, WooCommerce detected, /cart/ and /checkout/ load, payment markers visible on checkout.
check_sslCertificate accepted, http:// permanently redirects to https://, short HTTPS-only redirect chain, HSTS header set.
check_exposureWordPress, WooCommerce, plugin and PHP versions shown publicly, a public /readme.html, a readable /wp-content/debug.log (log contents are never returned or kept).
check_seo_basicsrobots.txt (and whether it blocks the whole site), the XML sitemap, homepage title and meta description, homepage noindex.
check_speedTimes one download each of the homepage, one product page and the cart (one sample per page, not a lab test).
check_productsSamples up to 10 published products from the public WooCommerce Store API for missing prices, missing images and out-of-stock items.
check_policiesHomepage links to privacy, terms, shipping and returns/refunds pages, and each linked page loads.
explain_findingExplains any finding code (e.g. ssl_hsts, exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.

Every tool takes a store url (except explain_finding, which takes a code). Checks use GET requests only: they never log in, add to cart or submit forms. Each runs once, when you ask; nothing is monitored or scheduled.

Starter prompts

  • black_friday_audit — Audit my WooCommerce store before Black Friday. Runs all seven checks and turns them into a prioritized pre-sale fix list.
  • checkout_check — Is my checkout working? Checks that the cart, checkout and payment methods load, and explains anything that doesn't.
  • explain_finding — Explain this finding. Explains a Store Canary finding id with a suggested fix.

Setup

ChatGPT

Until Store Canary is in ChatGPT's app directory, enable developer mode and add a custom connector with the URL https://mcp.storecanary.app/mcp/chatgpt and no authentication.

Claude

Open Settings → Connectors → Add custom connector and paste https://mcp.storecanary.app/mcp.

Cursor

Add to your mcp.json:

json
{  "mcpServers": {    "store-canary": { "url": "https://mcp.storecanary.app/mcp" }  }}

Cline and other MCP clients

Add a remote server over Streamable HTTP at https://mcp.storecanary.app/mcp. No auth headers are needed. For clients that only speak stdio:

json
{  "mcpServers": {    "store-canary": {      "command": "npx",      "args": ["-y", "mcp-remote", "https://mcp.storecanary.app/mcp"]    }  }}

Then ask: "Check my store at example.com with Store Canary."

Limits and safety

  • Up to 10 checks a minute per connection, plus a shared cap.
  • About five GET requests per check, no cookies, done in under 10 seconds. Requests identify as StoreCanaryBot.
  • Public web addresses only: no IP addresses, private networks or unusual ports.

Privacy

Store Canary does not store the store URLs you check, their results, or your IP address. See the privacy policy.

Support

Email [email protected] or visit https://storecanary.app/mcp.

Built by Form Nerd, LLC. Licensed under MIT.

Source: README.md at commit 2a09352

Tools

8

check_store

Check a WooCommerce store

Check a public WooCommerce store from the outside: is it reachable, is HTTPS valid and are redirects sane, is WooCommerce detected, do /cart/ and /checkout/ load, and are payment markers visible on checkout. Read-only: GET requests only, never adds to cart, logs in or submits forms. Returns pass/warn/fail findings plus a link to the full audit.

Parametersurlrequired

check_ssl

Check a store's HTTPS setup

Check that a store's HTTPS certificate is accepted, http:// permanently redirects to https://, the redirect chain is short and stays on HTTPS, and an HSTS header is set. The exact certificate expiry date isn't visible to an outside fetch. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

check_exposure

Check what a store exposes publicly

Flag WordPress, WooCommerce, plugin and PHP versions a store shows publicly (generator tags, asset ?ver= values, X-Powered-By), a public /readme.html and a readable /wp-content/debug.log. Log contents are never returned or kept. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

check_seo_basics

Check a store's SEO basics

Check a store's robots.txt (and whether it blocks the whole site), its XML sitemap, the homepage title and meta description, and noindex on the homepage. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

check_speed

Time a store's key pages

Time one download each of a store's homepage, one product page and the cart from Cloudflare's network. One sample per page, not a lab test or an average. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

check_products

Sample a store's products

Read up to 10 published products from the public WooCommerce Store API and flag missing prices, missing images and out-of-stock items. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

check_policies

Check a store's policy pages

Check that the homepage links to privacy, terms, shipping and returns/refunds pages, and that each linked page on the same site loads. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

Parametersurlrequired

explain_finding

Explain a Store Canary finding

Explain a finding code returned by any Store Canary tool (for example ssl_hsts or exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.

Parameterscoderequired

Version history

2
  1. v1.1.0LatestOct 30, 2026
  2. v1.0.0Oct 29, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts