Seo Notary

io.github.raxocodePublished by GitHub account raxocodev0.1.0Updated Oct 25, 2026

Verify what a web page really returns over HTTP and in a browser. Deterministic, local, no LLM.

VerifiedSTDIODesktop onlyWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that fetches a web page over HTTP and in a real browser and returns deterministic SEO findings so an assistant can verify what the page truly

What you can do
Verify a URL and return a structured report with a short summary in one call, covering HTTP status, redirects, content type, title, meta description, canonical, robots directives and JSON-LD syntax in the raw response. With the browser tier, compare raw versus rendered values for title, canonical, robots meta and description, and surface hydration errors, uncaught page errors, console errors and failed requests. Look up the rule catalog to see the 23 rules and what each does not prove.
When to use it
Useful when a coding agent edits frontend or page code and needs evidence of what the page actually serves, including after JavaScript runs, rather than a claim of done. Fits local development checks and CI runs where deterministic pass/fail with exit codes matters.
Requirements
Local process started with npx from the seo-notary npm package; requires Node 22.19.0 or newer. The browser tier additionally needs Chromium installed via the install-browser command. No accounts, API keys or environment variables are declared.
Before you install
The server fetches whatever URL it is given; the default local network profile permits localhost and private hosts, while the strict profile allows public hosts only. Page content is treated as untrusted evidence. The release is early (0.1) and rule output and severities may change. No third-party security audit has been performed, and the browser tier is not pixel-accurate.

Installation

In SourceWeft

  1. Open Seo Notary in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

SEO Notary

Verify what a web page really returns, so your coding agent can fix it and prove it.

HTTP and real-browser checks for Claude Code, Cursor, VS Code and CI. Deterministic. No LLM. One command.

Status: 0.1 (early release). APIs, rule output and rule severities may still change between 0.x releases; see the changelog.

Coding agents edit page code but cannot see what the page actually serves. Client-side scripts overwrite titles and canonicals, server rendering breaks, redirects bounce, and the agent reports "done" without evidence. SEO Notary fetches the page, runs deterministic rules over the response and the rendered DOM, and returns structured findings with stable exit codes.

text
$ seo-notary verify http://127.0.0.1:4173/broken --tier browserFAIL http://127.0.0.1:4173/brokentier browser (faithful), 1153 ms, 0 redirects, HTTP 200  title        Acme Widgets | Handmade widgets for every workshop  canonical    http://127.0.0.1:4173/broken  rendered DOM  title        Loading...  canonical    https://staging.acme.example/broken
2 errors, 0 warnings, 0 info; 20 rules passed
ERROR   RENDER_TITLE_DIFFERS  head > title  The title changes after JavaScript runs.  raw:      Acme Widgets | Handmade widgets for every workshop  rendered: Loading...  fix: Make the server-rendered title and the client-rendered title agree.$ echo $?1

That output is abridged from a real run of the demo in this repository. Remove the script that rewrites the title and canonical and the same command prints PASS and exits 0.

Quickstart

Requires Node >=22.19.0.

bash
# Tier 1: raw HTTP and HTML. No browser, nothing to download.npx seo-notary verify http://localhost:3000/
# Tier 2: also render the page in Chromium and compare raw vs rendered.npx seo-notary install-browsernpx seo-notary verify http://localhost:3000/ --tier browser

To run from a checkout instead: npm install && npm run build, then node packages/cli/dist/bin.js verify <url>.

Exit codes: 0 pass, 1 findings at or above --fail-on (default error), 2 operational failure (bad input, network, timeout, policy, browser). Use --format json for exactly one JSON document on stdout. Details: docs/CLI.md.

Use it from an agent

seo-notary mcp runs a local MCP server over stdio with two tools: verify_url and get_rule_catalog. verify_url returns the full report as structured content plus a short summary, in one call. See docs/MCP.md for what has and has not been tested, and for an AGENTS.md snippet that tells agents to verify after frontend changes.

What it checks

HTTP status, redirect chain, content type, title, meta description, canonical link, robots directives (meta and X-Robots-Tag) and JSON-LD syntax in the raw response. With --tier browser: whether the title, canonical, robots meta and description change after JavaScript runs, framework hydration error messages, uncaught page errors, console errors and failed requests. 23 rules in total: docs/RULES.md. Each lists what it does not prove.

What it does not do

  • No crawling, rank tracking, keyword or backlink data, and no claims about indexing or ranking. It reports measured signals only.
  • No LLM calls and no code uploads. It fetches the URL you give it.
  • No hosted service. It runs on your machine.
  • "Hydration error detected" is pattern matching on console messages, not proof of a markup mismatch.
  • The browser tier is not pixel-accurate in either mode.

Security

Page content is untrusted evidence: output strings are stripped of control characters and length-bounded, and nothing in a page is ever treated as an instruction. Two network profiles exist. local (default) lets you verify localhost and private hosts; strict allows public hosts only. A redirect can never move from a public host to a private address. Limits and caveats, including the browser tier's best-effort interception, are in docs/SECURITY.md. To report a vulnerability see SECURITY.md. No third-party security audit has been performed.

Packages

PackagePurpose
seo-notaryCLI and local MCP server
seo-notary-coreSchemas, network policy, fetcher, rules, reports. No browser dependency
seo-notary-browserOptional Playwright adapter

Development

Requires Node >=22.19.0.

bash
npm installnpm run buildnpm run typecheck && npm run lintnpm test                 # unit and integrationnpm run test:security    # network policynpm run test:browser     # needs Chromium: npx playwright-core install --only-shell chromiumnpm run test:smoke       # packs and installs the packages into an empty directorynpm run demo             # serves the broken/fixed demo on http://127.0.0.1:4173

Docs: Architecture, CLI, MCP, Rules, Threat model, Decisions. Contributions: CONTRIBUTING.md.

License

Source code is released under the MIT License. The Raxocode and SEO Notary names and logos are not covered by that license; see TRADEMARK.md.

Built by Raxocode. Project site: seonotary.com.

Source: README.md at commit 60c0df6

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestOct 17, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts