Website Auditor MCP
An MCP server for website-auditor.io —
AI-visibility (GEO) and site-audit tools you can call from any MCP client
(Claude Desktop, Claude Code, Cursor, Codex, and other agents).
Ask an agent "does ChatGPT recommend my business?", "what's my AI-visibility
score?", "audit example.com", or "how do I stack up against my competitors?"
and it answers with real data — an overall AI-visibility score (0–100), a
per-engine breakdown across ChatGPT, Perplexity, Claude, Gemini, Microsoft Copilot and Google AI Overviews, a full
site audit (security, performance, crawlability and markup), competitor comparisons, and ongoing
monitoring.
The server is a thin, authenticated wrapper over the Website Auditor API — the
audit engine, AI-visibility scoring and monitoring live in that service; this
server just makes them available to agents.
Tools
Prompts
Clients that support MCP prompts (Claude Desktop, claude.ai) render these as
something you can pick from a menu, so you don't have to phrase the request
yourself or know which tool to ask for. In clients that don't surface prompts
(Codex, currently), nothing is lost but the menu — ask in words and the same
tools run.
Each Pro prompt falls back to get_sample_audit when no API key is configured,
so you always get output rather than an error.
Naming the business (optional)
get_ai_visibility and run_audit both accept two optional arguments that
decide what question the AI-visibility check actually asks.
compare_competitors accepts business_location only — see below for why it
takes no name:
Supply a name only when you actually know it. A supplied name overrides
detection and is treated as confirmed, so a guess is scored exactly as if a
human had verified it — and silences the warning that would have told you
otherwise. Leaving it out is the safer default: detection is transparent about
its own uncertainty.
The same applies to location, in the other direction. Omitting it is correct
for a national or global business and wrong for a local one, since a local
business measured without a place is measured against the wrong queries.
On compare_competitors: it takes business_location and applies it to
your site and every competitor, because a comparison asks about one market —
scoring you locally while scoring your rivals globally would rank the answers
to two different questions. It deliberately takes no business_name: a name
identifies one business, and forwarding yours to your competitors would score
every one of them as you. The result names the market it used, so a scoped
comparison is never mistaken for a global one.
Install & configure
The server runs directly via npx — no clone or build required.
Try it before you buy it. Install with no API key at all and ask your agent
for a sample audit — get_sample_audit returns a full report for example.com
in the exact format a real run produces, so you can check the shape fits your
needs first.
Pricing. Auditing real domains needs a Website Auditor subscription at
$49/month — eligible new customers get a 7-day free trial (payment
method required to start; no charge until the trial ends; customers who used
a trial in the last 12 months are billed immediately). Sign up and create an
API key at
api.website-auditor.io/admin_portal,
then set it as WA_API_KEY below. There is no free API tier — a key only
functions with an active subscription.
Claude Desktop (claude_desktop_config.json), Cursor
(~/.cursor/mcp.json), and most other clients use the same mcpServers shape:
Claude Code — add it from the CLI:
Codex — the CLI, IDE extension and ChatGPT desktop app all read the same
~/.codex/config.toml, so one of these covers all three:
Codex doesn't render MCP prompts, so the Prompts above won't appear
as menu entries there — ask in words instead ("show me a sample audit").
Or install the packaged Codex plugin, which bundles the same server and
restores the prompts as skills (which Codex does render):
Cursor — one-click install, or put the same mcpServers JSON as above in
~/.cursor/mcp.json:
[Install in Cursor]
The one-click config arrives with an empty WA_API_KEY — the sample report
works as-is; fill the key in under Settings → MCP to audit real domains.
There is also a packaged Cursor plugin (this server plus the prompts as
skills) in cursor-plugin/; its Cursor Marketplace listing
is pending — status in docs/CURSOR-PLUGIN.md.
Restart the client and the tools appear.
Getting an API key
WA_API_KEY is a per-user key (it starts with wa_) minted from a Website
Auditor account at
api.website-auditor.io/admin_portal
— the admin portal, where you subscribe and manage keys.
Minting a key requires an active subscription ($49/month; eligible new
customers get a 7-day free trial — payment method required, no charge until
the trial ends): there is no free API tier, so every tool except
get_sample_audit, check_upgrade_status and get_recommendations needs one.
get_sample_audit needs no key at all. get_recommendations answers any valid
key with the next steps from an audit already on record; with Pro it also says
where to get listed, what AI assistants get wrong about the business, and which
fix file fixes each finding.
Treat the key like a password — set it only in your MCP client's env and never
commit it.
Restart after setting or changing the key. WA_API_KEY is read once, when
the server starts, so a key added while the client is running is invisible to
it — in Claude Desktop, quit and reopen the app. Without the restart the tools
keep returning the same AUTH_REQUIRED you just acted on, which looks
identical to the key not working.
Configuration (environment variables)
Only WA_API_KEY is normally needed; the rest have sensible defaults. See
.env.example for the full list.
Auth & tiers
Your key is validated on every call. The Pro/free tier is resolved live from the
API and cached briefly, so upgrades and downgrades take effect within about a
minute:
- No key →
get_sample_audit still works (that's the point of it); every
other tool returns AUTH_REQUIRED with the price and a sign-up link.
- Revoked or unrecognized key →
INVALID_KEY, carrying the API's own
remediation ("generate a new key"). Distinct from PRO_REQUIRED: the fix is a
new key, not a purchase.
- No active subscription (valid key, lapsed/canceled/never subscribed) →
PRO_REQUIRED with the price and an upgrade link — there is no free API tier;
check_upgrade_status still answers so the caller can learn why, and
get_recommendations still answers with the free list ("tier": "free").
- Subscribed (status
active or a trial in progress) → all tools.
Errors are normalized to stable codes agents can branch on — e.g.
AUTH_REQUIRED, INVALID_KEY, PRO_REQUIRED, OVER_QUOTA,
UNREACHABLE_DOMAIN, INVALID_INPUT, TIMEOUT. A domain that resolves but
whose pages never load (down, refusing, timing out, or answering 404/5xx on
every page) returns UNREACHABLE_DOMAIN; one that does not resolve is refused
before any audit runs, as INVALID_INPUT. Neither gets a fabricated score.
Develop
The suite is hermetic — the API client, subscription provider and meter are
injected, and HTTP is mocked at the fetch boundary, so no network is touched.
Privacy Policy
Anonymous install id. When telemetry is enabled, the server generates a
random UUID on first run and stores it at
~/.config/website-auditor-mcp/install-id (or $XDG_CONFIG_HOME), sending it
with each event. It exists solely to tell one install restarting many times
apart from many separate installs — without it, install counts are just restart
counts. It is randomly generated, never derived from your machine, username or
network, and is not a fingerprint. Setting WA_METRICS_DISABLED stops
telemetry entirely: no id is generated and nothing is written to disk.
This connector talks to a single external service: the Website Auditor API
at website-auditor.io. When you invoke a tool
it sends only two things to that API:
- the target domain you asked to audit or monitor, and
- your API key (
WA_API_KEY), used to authenticate the request and resolve
your plan tier.
At startup, and at most hourly while tools are in use, the server also asks
the same API for Pro's current price (GET /pricing.json), so the price it
states is never out of date. That request carries no key, no install id and no
data about you or your sites.
That's the full extent of what leaves your machine. The connector does not
collect, store, or transmit your files, prompts, conversation content, or any
other personal data, and it does not send data to any third party beyond the
Website Auditor API. Your API key is held only in your MCP client's
configuration (in Claude Desktop it is stored in the OS keychain and injected as
an environment variable); it is never written to the bundle or logged.
Anonymous, aggregate usage telemetry (which tool ran, success/failure, latency —
no domains, no keys, no personal data) may be emitted to improve the service, and
can be disabled entirely by setting WA_METRICS_DISABLED=1. Installed as a
desktop extension, the same opt-out is a "Disable anonymous usage telemetry"
checkbox in the extension's settings.
Full privacy policy: https://website-auditor.io/privacy
License
MIT — © 2026 Kevin Armstrong / SpikeyCoder.
This covers the MCP server in this repo: the client that talks to the Website
Auditor API. The audit engine and the API behind it are separate products, not
covered here, and running real audits still needs a Website Auditor account.
Learn more at website-auditor.io.