Store Canary

io.github.erikras由 GitHub 账号 erikras 发布v1.1.0更新于 Oct 30, 2026

Free read-only WooCommerce checks: store, SSL, exposure, SEO, speed, products, policies + 3 prompts

已验证Streamable HTTP可网页运行安全与监控数据与分析商业与电商

概览

AI 生成的概览

托管式只读 MCP 服务器,从外部检查公开的 WooCommerce 商店,并给出通过/警告/失败结论与修复建议。

可以做什么
  • 执行整体健康检查:首页可达性、HTTPS、WooCommerce 识别、购物车与结账页加载、结账页支付标识
  • 检查 SSL:证书是否被接受、http 是否永久跳转到 https、跳转链长度与 HSTS 头
  • 检查暴露面:WordPress、WooCommerce、插件与 PHP 版本、公开 readme 与可读的调试日志
  • 检查 SEO 基础项:robots.txt、XML 站点地图、首页标题、meta 描述与 noindex
  • 测速:各取一次首页、商品页与购物车下载耗时,并抽样最多 10 个商品检查缺价、缺图或缺货
  • 核对隐私、条款、配送与退货政策链接是否可访问,并用通俗语言解释发现代码及修复建议
适用场景
适合需要快速从外部了解某个 WooCommerce 商店的健康、安全卫生、SEO 或速度状况时使用,例如大促前自查或排查结账故障,无需安装或登录。
运行要求
远程 Streamable HTTP 端点 mcp.storecanary.app,无需账号、API 密钥或认证头;仅支持 stdio 的客户端可通过 npx mcp-remote 桥接。被检查的商店必须是公开网址(不支持 IP、私有网络或非常规端口)。
安装前请注意
检查会向你提供的商店网址发送 GET 请求,该地址会传给该服务;据称不保存网址、结果与 IP。每连接约每分钟 10 次检查的限制。速度仅为单次采样而非实验室测试,证书到期日不可见。不做持续监控或定时任务,也不会写入、登录或操作购物车。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Store Canary,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.erikras%2Fstore-canary/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "store-canary": {
      "type": "http",
      "url": "https://mcp.storecanary.app/mcp"
    }
  }
}

README

[Store Canary logo]

Store Canary MCP connector

A free, hosted, read-only MCP server that checks a public WooCommerce store from the outside and answers in plain pass / warn / fail lines. No account, no API key, no install.

Connector address: https://mcp.storecanary.app/mcp (Streamable HTTP, no authentication)

Docs: https://storecanary.app/mcp

This repository only documents the hosted connector. It contains no server code.

Tools (all read-only)

ToolWhat it checks
check_storeOverall health: homepage reachable, HTTPS valid and redirects sane, WooCommerce detected, /cart/ and /checkout/ load, payment markers visible on checkout.
check_sslCertificate accepted, http:// permanently redirects to https://, short HTTPS-only redirect chain, HSTS header set.
check_exposureWordPress, WooCommerce, plugin and PHP versions shown publicly, a public /readme.html, a readable /wp-content/debug.log (log contents are never returned or kept).
check_seo_basicsrobots.txt (and whether it blocks the whole site), the XML sitemap, homepage title and meta description, homepage noindex.
check_speedTimes one download each of the homepage, one product page and the cart (one sample per page, not a lab test).
check_productsSamples up to 10 published products from the public WooCommerce Store API for missing prices, missing images and out-of-stock items.
check_policiesHomepage links to privacy, terms, shipping and returns/refunds pages, and each linked page loads.
explain_findingExplains any finding code (e.g. ssl_hsts, exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.

Every tool takes a store url (except explain_finding, which takes a code). Checks use GET requests only: they never log in, add to cart or submit forms. Each runs once, when you ask; nothing is monitored or scheduled.

Starter prompts

  • black_friday_audit — Audit my WooCommerce store before Black Friday. Runs all seven checks and turns them into a prioritized pre-sale fix list.
  • checkout_check — Is my checkout working? Checks that the cart, checkout and payment methods load, and explains anything that doesn't.
  • explain_finding — Explain this finding. Explains a Store Canary finding id with a suggested fix.

Setup

ChatGPT

Until Store Canary is in ChatGPT's app directory, enable developer mode and add a custom connector with the URL https://mcp.storecanary.app/mcp/chatgpt and no authentication.

Claude

Open Settings → Connectors → Add custom connector and paste https://mcp.storecanary.app/mcp.

Cursor

Add to your mcp.json:

json
{  "mcpServers": {    "store-canary": { "url": "https://mcp.storecanary.app/mcp" }  }}

Cline and other MCP clients

Add a remote server over Streamable HTTP at https://mcp.storecanary.app/mcp. No auth headers are needed. For clients that only speak stdio:

json
{  "mcpServers": {    "store-canary": {      "command": "npx",      "args": ["-y", "mcp-remote", "https://mcp.storecanary.app/mcp"]    }  }}

Then ask: "Check my store at example.com with Store Canary."

Limits and safety

  • Up to 10 checks a minute per connection, plus a shared cap.
  • About five GET requests per check, no cookies, done in under 10 seconds. Requests identify as StoreCanaryBot.
  • Public web addresses only: no IP addresses, private networks or unusual ports.

Privacy

Store Canary does not store the store URLs you check, their results, or your IP address. See the privacy policy.

Support

Email [email protected] or visit https://storecanary.app/mcp.

Built by Form Nerd, LLC. Licensed under MIT.

来源:README.md,提交 2a09352

工具

8

check_store

Check a WooCommerce store

Check a public WooCommerce store from the outside: is it reachable, is HTTPS valid and are redirects sane, is WooCommerce detected, do /cart/ and /checkout/ load, and are payment markers visible on checkout. Read-only: GET requests only, never adds to cart, logs in or submits forms. Returns pass/warn/fail findings plus a link to the full audit.

输入参数url必填

check_ssl

Check a store's HTTPS setup

Check that a store's HTTPS certificate is accepted, http:// permanently redirects to https://, the redirect chain is short and stays on HTTPS, and an HSTS header is set. The exact certificate expiry date isn't visible to an outside fetch. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

check_exposure

Check what a store exposes publicly

Flag WordPress, WooCommerce, plugin and PHP versions a store shows publicly (generator tags, asset ?ver= values, X-Powered-By), a public /readme.html and a readable /wp-content/debug.log. Log contents are never returned or kept. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

check_seo_basics

Check a store's SEO basics

Check a store's robots.txt (and whether it blocks the whole site), its XML sitemap, the homepage title and meta description, and noindex on the homepage. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

check_speed

Time a store's key pages

Time one download each of a store's homepage, one product page and the cart from Cloudflare's network. One sample per page, not a lab test or an average. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

check_products

Sample a store's products

Read up to 10 published products from the public WooCommerce Store API and flag missing prices, missing images and out-of-stock items. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

check_policies

Check a store's policy pages

Check that the homepage links to privacy, terms, shipping and returns/refunds pages, and that each linked page on the same site loads. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved; ongoing checks are Store Canary Pro.

输入参数url必填

explain_finding

Explain a Store Canary finding

Explain a finding code returned by any Store Canary tool (for example ssl_hsts or exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.

输入参数code必填

版本历史

2
  1. v1.1.0最新Oct 30, 2026
  2. v1.0.0Oct 29, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分