SiteVerdict — Website Audit Tools

io.github.siteverdictPublished by GitHub account siteverdictv0.2.1Updated Oct 24, 2026

Website audits for AI agents: GDPR consent, speed, WCAG, SPF/DMARC and AI-search readiness.

The publisher's own server: audit.domains - Domain Valuation

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Lets an assistant run browser-based website audits covering GDPR consent, speed, WCAG accessibility, email security and AI-search readiness, returning a ranked

What you can do
Provides audit tools that run real browser-based checks against a public website and return scores, summaries and a prioritised fix list. Tools cover cookie consent and GDPR/PECR tracking, Core Web Vitals and estimated revenue lost to slow pages, WCAG 2.2 accessibility, domain email health (MX, SPF, DKIM, DMARC, TLS), and AI-search readiness for ChatGPT, Perplexity and Google AI Overviews. A full_website_audit tool runs all checks in parallel, and get_audit_results collects results from long-running scans. Prompts and resources such as siteverdict://checks are also included.
When to use it
Use it when you want an assistant to audit a public website and produce a prioritised fix plan, for example before a launch, when checking whether a cookie banner is GDPR-compliant, when estimating revenue lost to slow pages, or when checking email spoofing risk and AI-search visibility.
Requirements
Node.js 20+ for the npm package @siteverdict/mcp, run with npx over stdio, or a remote streamable HTTP endpoint. An Apify API token is required, supplied as the APIFY_TOKEN environment variable or the X-Apify-Token header, or via OAuth sign-in in remote mode. Optional data toolsets may need additional third-party keys. Network access to the audited sites and to api.apify.com is required.
Before you install
Audits run as Apify Actors on your own Apify account and are billed by Apify at its pay-per-event price, so real money is spent; each run has a spend cap (default $2, configurable with maxCostUsd). The APIFY_TOKEN secret is required and is sent only to api.apify.com. Optional data toolsets can use further third-party keys supplied as SITEVERDICT_SECRET_ variables or X-SiteVerdict-Secret- headers. Tools are read-only and reject private or internal targets, but the remote endpoint is a

Installation

In SourceWeft

  1. Open SiteVerdict — Website Audit Tools in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.siteverdict%2Fsiteverdict/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "siteverdict-website-audit-tools": {
      "type": "http",
      "url": "https://mcp.webrevenuescan.com/mcp"
    }
  }
}

README

SiteVerdict — Website Audit Tools (MCP server)

Website audit tools for AI agents. Ask Claude, ChatGPT, Cursor or any MCP client to "audit my website and tell me what to fix first". It runs real browser-based checks and returns a ranked fix plan:

ToolWhat it checks
full_website_auditRuns every check below in parallel, then returns an overall score, an executive summary and one prioritised fix list
audit_tracking_consentCookie consent and GDPR / UK GDPR / PECR: tags that fire before consent or after "Reject", tracking cookies, Google Consent Mode v2, broken GA4/GTM tags, duplicate page_views
scan_speed_and_revenueCore Web Vitals (LCP, INP, CLS, TTFB), page weight and bottlenecks, plus an estimate of revenue lost to slow pages if you give traffic and order value
audit_accessibility_wcagWCAG 2.2 A/AA/AAA (axe-core), mapped to success criteria and to the European Accessibility Act / EN 301 549
check_domain_email_healthMX, SPF, DKIM, DMARC, BIMI, MTA-STS, DNSSEC, CAA, TLS expiry, spoofing risk and Gmail/Yahoo bulk-sender gaps
check_ai_search_readinessCan ChatGPT, Perplexity and Google AI Overviews read and cite you? Covers robots.txt AI bots, llms.txt, schema.org, rendering, canonical tags and sitemap
get_audit_resultsCollects the results of a long scan that was still running, at no extra cost

Prompts: website_fix_plan, cookie_consent_check, prelaunch_check. Resources: siteverdict://checks, siteverdict://guide/scoring.

How billing works

Each check is an Apify Actor. The server runs it on your own Apify account using your APIFY_TOKEN, and Apify bills you directly at its pay-per-event price. This server has no payments, no accounts and no stored data.

  • Every run has a spend cap (maxTotalChargeUsd, default $2, configurable per call with maxCostUsd).
  • If you cancel a tool call, the Apify run is aborted, so you stop paying.
  • You can see run costs in your Apify console.

Get a token at https://console.apify.com/settings/integrations. To try the tools without a token, set SITEVERDICT_DRY_RUN=1. Every result is then built-in sample data and is clearly labelled.

Install

Requires Node.js 20+. Replace apify_api_xxx with your token.

Claude Code

bash
claude mcp add --env APIFY_TOKEN=apify_api_xxx --transport stdio siteverdict -- npx -y @siteverdict/mcp

Claude Desktop

Go to Settings → Developer → Edit Config (claude_desktop_config.json):

json
{  "mcpServers": {    "siteverdict": {      "command": "npx",      "args": ["-y", "@siteverdict/mcp"],      "env": { "APIFY_TOKEN": "apify_api_xxx" }    }  }}

You can also install the one-click .mcpb bundle from the Releases page. Claude Desktop asks for your token and stores it securely.

Cursor

Add this to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

json
{  "mcpServers": {    "siteverdict": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@siteverdict/mcp"],      "env": { "APIFY_TOKEN": "${env:APIFY_TOKEN}" }    }  }}

VS Code (GitHub Copilot agent mode)

Add this to .vscode/mcp.json. VS Code prompts for the token once and stores it encrypted:

json
{  "inputs": [    { "type": "promptString", "id": "apify-token", "description": "Apify API token", "password": true }  ],  "servers": {    "siteverdict": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@siteverdict/mcp"],      "env": { "APIFY_TOKEN": "${input:apify-token}" }    }  }}

Or run: code --add-mcp '{"name":"siteverdict","command":"npx","args":["-y","@siteverdict/mcp"],"env":{"APIFY_TOKEN":"${input:apify-token}"}}'

Windsurf / Devin Desktop

Add this to ~/.codeium/windsurf/mcp_config.json. Newer builds use ~/.config/devin/mcp_config.json, or %APPDATA%\devin\mcp_config.json on Windows:

json
{  "mcpServers": {    "siteverdict": {      "command": "npx",      "args": ["-y", "@siteverdict/mcp"],      "env": { "APIFY_TOKEN": "${env:APIFY_TOKEN}" }    }  }}

Cline

Install from the Cline MCP Marketplace once the listing is live, or add this to cline_mcp_settings.json:

json
{  "mcpServers": {    "siteverdict": {      "command": "npx",      "args": ["-y", "@siteverdict/mcp"],      "env": { "APIFY_TOKEN": "apify_api_xxx" },      "disabled": false,      "autoApprove": []    }  }}

OpenAI Codex CLI

bash
codex mcp add siteverdict --env APIFY_TOKEN=apify_api_xxx -- npx -y @siteverdict/mcp

Or add this to ~/.codex/config.toml:

toml
[mcp_servers.siteverdict]command = "npx"args = ["-y", "@siteverdict/mcp"]tool_timeout_sec = 600
[mcp_servers.siteverdict.env]APIFY_TOKEN = "apify_api_xxx"

Scans can take a few minutes, so raise tool_timeout_sec from its default of 60.

Gemini CLI

bash
gemini mcp add -e APIFY_TOKEN=apify_api_xxx siteverdict npx -y @siteverdict/mcp

ChatGPT and Claude (remote connector with OAuth)

These clients need a remote HTTPS URL. The server ships remote mode with OAuth 2.1: CIMD/DCR client registration, PKCE, and a sign-in page where you paste your own Apify token. It also has a ChatGPT/MCP Apps score-card UI. Once the owner deploys it, add https://mcp.webrevenuescan.com/mcp as a custom connector, or /mcp/<toolsets> such as /mcp/web+compliance. Design and deploy steps: docs/REMOTE.md. Not deployed yet.

Docker

bash
docker run -i --rm -e APIFY_TOKEN=apify_api_xxx mcp/siteverdict

Remote / Streamable HTTP (self-hosted)

bash
SITEVERDICT_HTTP_HOST=127.0.0.1 SITEVERDICT_HTTP_PORT=3333 npx -y @siteverdict/mcp --http# endpoint: http://127.0.0.1:3333/mcp   health: /healthz# each user sends their own token:  X-Apify-Token: apify_api_xxx   (or Authorization: Bearer apify_api_xxx)claude mcp add --transport http siteverdict http://127.0.0.1:3333/mcp --header "X-Apify-Token: apify_api_xxx"

The server binds to localhost by default and validates Host and Origin. To serve it publicly, put it behind TLS and set SITEVERDICT_ALLOWED_HOSTS and SITEVERDICT_ALLOWED_ORIGINS.

Toolsets (keep the tool list small)

The default is web: the 7 audit tools plus detect_tech_stack, monitor_website_changes, fetch_clean_markdown and get_run_results. To add more groups:

bash
npx -y @siteverdict/mcp --toolsets web,compliance        # or SITEVERDICT_TOOLSETS=allnpx -y @siteverdict/mcp --tools sanctions_screen,uk_property_data   # explicit allow-list
ToolsetTools
webfull_website_audit, audit_tracking_consent, scan_speed_and_revenue, audit_accessibility_wcag, check_domain_email_health, check_ai_search_readiness, get_audit_results, detect_tech_stack, monitor_website_changes, fetch_clean_markdown
marketingseo_rank_check, search_traffic_diagnose, google_ads_transparency, reviews_monitor
leadsfind_local_businesses, company_registry_lookup, sec_filing_watch, sec_full_text_search, find_public_tenders, detect_tech_stack
compliancesanctions_screen, validate_vat_or_company_number, extract_pdf_invoice, company_registry_lookup
travelflight_fare_scan, flight_fare_estimate, flight_deal_alerts, check_flight_compensation, visa_entry_check
propertyuk_property_data

Some data tools can use your own third-party keys:

  • stdio: SITEVERDICT_SECRET_<NAME> env vars
  • HTTP: X-SiteVerdict-Secret-<Name> headers

Examples are COMPANIES_HOUSE_API_KEY, HMRC_CLIENT_ID, GOOGLE_MAPS_API_KEY, SERPAPI_API_KEY and EPC_API_TOKEN. The siteverdict://tools resource lists them all. Keys are never tool arguments and never appear in results. Without them, the tool uses the Actor's clearly labelled sample mode or format-only checks.

Full generated table: marketplace/tools.md.

Example prompts

  • "Audit https://example.com and give me a fix plan for this week."
  • "Is my cookie banner on example.co.uk GDPR-compliant? Does anything track before consent?"
  • "How much revenue is my slow mobile site losing? I get 40k visits a month, a 2% conversion rate and a £70 average order."
  • "Check example.com against WCAG 2.2 AA and tell me what the European Accessibility Act means for us."
  • "Can people spoof email from our domain? Check SPF, DKIM and DMARC for example.com."
  • "Will ChatGPT and Perplexity cite our site? Check AI-search readiness."

Configuration

VariableDefaultPurpose
APIFY_TOKEN—Your Apify token (stdio mode)
SITEVERDICT_DRY_RUN01 returns sample data with no Apify calls
SITEVERDICT_DEFAULT_MAX_CHARGE_USD2Spend cap per Actor run
SITEVERDICT_DEFAULT_WAIT_SECS / SITEVERDICT_MAX_WAIT_SECS240 / 900How long a call waits before returning running plus a runId
SITEVERDICT_RATE_LIMIT_PER_MINUTE20Tool calls per minute per client
SITEVERDICT_MAX_CONCURRENT_RUNS6Concurrent Actor runs per client
SITEVERDICT_APIFY_USERNAMEfrom brand.jsonApify account that owns the Actors
SITEVERDICT_ACTOR_TRACKING_CONSENT, ..._SPEED_REVENUE, ..._ACCESSIBILITY, ..._DOMAIN_EMAIL, ..._AI_SEARCH<username>/siteverdict-…Override individual Actor IDs
SITEVERDICT_DNS_CHECK1Resolve hostnames and reject private addresses (SSRF guard)
SITEVERDICT_HTTP_HOST / _PORT / _PATH127.0.0.1 / 3333 / /mcpHTTP mode
SITEVERDICT_ALLOWED_HOSTS / _ORIGINSlocalhostComma lists for public HTTP deployments

Safety

  • Read-only. No tool changes your site. Every tool is annotated readOnlyHint: true, destructiveHint: false, openWorldHint: true.
  • Public targets only. Private, loopback, link-local, CGNAT, cloud-metadata and reserved IPs, internal hostnames, non-http(s) schemes, credentials in URLs and odd ports are all rejected. Hostnames that resolve to private addresses are rejected too.
  • Tokens stay with Apify. Tokens are sent only to api.apify.com in an Authorization header. They are never logged and never placed in URLs.
  • Limits. Calls are rate-limited and concurrent runs are capped per client. Every run has a spend cap. Cancelling a call aborts its run.

Development

bash
npm installnpm run typecheck && npm run lint && npm test   # unit + integration tests (mocked Apify, no network)npm run smoke                                   # builds, then drives dist/cli.js over real stdionpm run inspector                               # MCP Inspector UI against the dry-run serverSITEVERDICT_DRY_RUN=1 npm run dev               # stdio from source

To rename the brand, edit brand.json and run npm run brand:sync.

Built on the official MCP TypeScript SDK v2 (@modelcontextprotocol/server). It serves both the 2026-07-28 protocol and 2025-era clients.

Privacy & terms

See PRIVACY.md and TERMS.md. Both are drafts until reviewed. Support: GitHub issues.

Source: README.md at commit 3934572

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

2
  1. v0.2.1LatestOct 13, 2026
  2. v0.2.0Oct 13, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Business & Commerce27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Developer Tools2 toolsOct 24, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth
Data & AnalyticsCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only
AI & MLNot validated yetNov 7, 2026

Mcp Supply Audit

Published by GitHub account kimmawla

Audits MCP servers as supply-chain artifacts — registry entries, PyPI/npm packages, client configs and tool definitions — using read-only static checks.

STDIODesktop only
Developer ToolsNot validated · the package did not installNov 5, 2026