WSG Check

WSG-Check

[CI] [codecov]

Check a website against automated heuristics based on the W3C Web Sustainability Guidelines. Get a weighted score, recommendations, and reports in terminal, JSON, Markdown, or HTML format through a CLI or a Next.js web app.

Release status

The latest release is v0.7.0.

Source on main targets WSG September-2026, the 24 September 2026 Group Note Draft; v0.6.1 and earlier target July-2026. It includes an MCP server for AI assistants, with the check_url, list_guidelines, and get_guideline tools, listed in the MCP Registry as io.github.ivanoats/wsg-check. The server first shipped in v0.4.0; v0.3.0 was tagged on GitHub but not published to npm. See the changelog and spec versioning policy.

Scores from different spec versions should not be treated as directly comparable. The package version and check selection also matter when comparing reports.

Quick start

Requires Node.js 22 or later. Pin the released CLI for reproducible usage:

npx @sustainablewebsites/[email protected] https://example.com # x-release-please-version
# Or install globallynpm install -g @sustainablewebsites/[email protected] # x-release-please-versionwsg-check https://example.com --format json --output report.json

To run the current source, including unreleased features, use Node.js 22.22.1 or later (required by development tooling):

git clone https://github.com/ivanoats/wsg-check.gitcd wsg-checknpm ci             # prepare also generates Panda CSS tokensnpm run dev        # http://localhost:3000
# Build and run the CLI from this checkoutnpm run build:clinode dist/cli/index.js https://example.com

See CONTRIBUTING.md for environment configuration and development commands.

What the results mean

• Checks cover web development, UX, and hosting. The business category has no automated checks.
• Analysis uses fetched HTML and HTTP metadata; it does not render JavaScript, measure Core Web Vitals, or download every referenced asset.
• Results describe one page, but most checks read the server or content shared by a site template, so pages on one site usually score alike. Scores differ mainly on page-specific content such as images and inline styles or scripts.
• CO₂ estimates use the HTML transfer size and the SWD v4 model, not measured full-page energy consumption. Failed green-hosting lookups fall back to false.
• Report page weight is the HTML transfer size: the bytes received over the network, compressed when the server compressed them. Resource and third-party counts come from references in the HTML. Referenced assets are not downloaded or measured.
• Security headers, form validation, native form features, and image alternative text remain visible as related checks, excluded from WSG scores.

CLI Usage

WSG-Check ships with a command-line tool that lets you check any website directly from your terminal or integrate checks into CI pipelines.

Basic usage

# Check a website with default (terminal) outputnpx @sustainablewebsites/wsg-check https://example.com
# Output as JSONnpx @sustainablewebsites/wsg-check https://example.com --format json
# Save the report to a filenpx @sustainablewebsites/wsg-check https://example.com --format markdown --output report.md
# Fail the process (exit 1) if the score is below 70npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 70

Options

--header values land in shell history and CI logs, and a malformed one is echoed in the error. For a secret, set "headers": {"Cookie": "..."} in a wsg-check.config.json kept out of version control. Header names in the config file are checked when it loads, and an error names the bad header without printing its value. --header replaces the config file's headers entirely. Headers are not sent over plain http after an https hop. To change the user agent, use WSG_USER_AGENT or the config's userAgent. The web API and MCP server do not accept request headers.

CI integration

Use --fail-threshold to fail your pipeline when a site's sustainability score drops:

# .github/workflows/sustainability.yml- name: Check sustainability  run: npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 60 --format json --output wsg-report.json- name: Upload report  uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1  with:    name: wsg-report    path: wsg-report.json

Exit codes

Use with AI assistants (MCP)

The package includes wsg-check-mcp, a Model Context Protocol server for Claude Code, Claude Desktop, VS Code, Cursor, and other MCP clients. It runs on your machine over stdio, with no account, port, or hosted service. Your assistant can then check a deployed site or your local dev server, look up guidelines, and fix what it finds.

# Claude Codeclaude mcp add wsg-check -- npx -y -p @sustainablewebsites/wsg-check wsg-check-mcp

Claude Desktop (claude_desktop_config.json) and Cursor (.cursor/mcp.json):

{  "mcpServers": {    "wsg-check": {      "command": "npx",      "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"]    }  }}

npx -y @sustainablewebsites/wsg-check --mcp starts the same server; it's the command the MCP Registry listing, io.github.ivanoats/wsg-check, uses.

VS Code (.vscode/mcp.json) uses a servers key:

{  "servers": {    "wsg-check": {      "type": "stdio",      "command": "npx",      "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"]    }  }}

Try prompts such as "Check http://localhost:3000 against the WSG and fix the top three issues" or "Which WSG guidelines cover web fonts?"

Network access

• Local URLs are allowed by default, so http://localhost:3000 and other loopback addresses work without setup. The trade-off: text the assistant reads, such as a web page or a file in your project, could try to steer it into requesting a service on your machine. Requests are GET-only and the results go back to the assistant. If you don't check a local dev server, add --no-local after wsg-check-mcp in the arguments, or set WSG_CHECK_NO_LOCAL=1.
• Private networks (10/8, 172.16/12, 192.168/16) are blocked unless you add --allow-private-network or set WSG_CHECK_ALLOW_PRIVATE=1.
• The only other request check_url makes is a green-hosting lookup: it sends the hostname to the Green Web Foundation. Local hostnames are never sent.
• Cloud metadata and other reserved addresses are always blocked. Redirects from a public site into your machine or network are refused, and each connection is pinned to the address that was checked.

Agent skill

The repository also ships an Agent Skill, wsg-sustainability-review. It walks an assistant through checking a site, fixing the issues in your codebase in priority order, and checking again. It uses the MCP tools when they are configured and falls back to the CLI otherwise. Install it into Claude Code, Cursor, Copilot, and other agents with:

npx skills add ivanoats/wsg-check

REST API

The web app exposes Next.js Route Handlers:

Responses use CORS headers, shared error envelopes, and in-memory rate limiting. Stored results expire after one hour and the store holds at most 500 entries. Results and limits are not shared across server instances. The browser carries newly created reports through sessionStorage; result URLs are not durable share links. See runtime and storage.

Architecture and documentation

The CLI, web API, and MCP server share a TypeScript fetch → check → score → report pipeline. The code is layered and framework-independent at its core, with direct dependencies on concrete utility implementations. The architecture overview documents these boundaries and the external-I/O exceptions.

• Documentation index
• Architecture Decision Log (ADL) and ADR template
• Module and check reference
• WSG spec versioning
• Contributing, releasing, and changelog
• Executive summary and implementation plan — historical planning context; use the architecture overview for implemented behavior

License

Apache-2.0. See NOTICE and the Contributor License Agreement.