ai.certscore由 certscore.ai 發布官方發布者v0.2.32更新於 Nov 7, 2026
MCP server for CertScore.ai public website risk-signal workflows.
CertScore.ai 的託管 MCP 服務（mcp.certscore.ai），由 certscore.ai 發布；需要 OAuth 登入；Streamable HTTP；14 個工具。
暫無 AI 概覽：以下資訊來自註冊中心條目和服務本身。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/ai.certscore%2Fmcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。
{
"mcpServers": {
"certscore-ai": {
"type": "http",
"url": "https://mcp.certscore.ai/mcp"
}
}
}CertScore (certscore.ai) is a production-minded MVP for scanning public websites for potential accessibility, privacy, cookie, policy, and disclosure risk signals. It is a risk signal and monitoring product, not a legal certification platform.
apps/web: product-facing web app and control-plane workflowsapps/validation-worker: active validation runtime owned by WC01packages/shared: shared constants, types, validators, scoring config, and scheduling helperspackages/web-bot-auth: server-only Web Bot Auth signing and key-directory helperspackages/db: PostgreSQL query helpers, migrations, seed SQL, and env helperspackages/ui: reusable UI primitivesWC01 is now the product/control-plane repo.
WS01WS01CertScore.ai MCP Light is the free, no-auth, hosted three-tool integration for public website privacy scans. It detects evidence-backed privacy, cookie, tracker, consent, policy, regulatory-review, HTTPS/TLS, and eligible Reject Path post-refusal signals. Results include a CertScore score and supporting evidence for human and agentic review; they are not legal advice, certification, or a compliance determination.
Add CertScore to Cursor · MCP Light landing page · Cursor Directory listing · Agent installation guide · Full installation reference · MCP package guide
Try it with: Use CertScore.ai to review [PUBLIC URL] before launch. Report the CertScore score, evidence-backed findings, Reject Path observations when available, coverage limitations, and the report URL.
This monorepo should use apps/web/.env.local as the single local development runtime env:
Use .env.example only as a reference template for shared keys. Do not rely on a root .env.local for app runtime configuration.
Recommended environment split inside WC01:
Do not point localhost at the production database or production auth credentials unless you are intentionally testing production behavior.
Required for the web app:
NEXT_PUBLIC_APP_URLDATABASE_URLBETTER_AUTH_SECRETGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETS3_BUCKETS3_REGIONS3_ACCESS_KEY_IDS3_SECRET_ACCESS_KEYRequired for the validation runtime in WC01:
DATABASE_URLOPENAI_API_KEYOptional but recommended:
WORKER_CONCURRENCYPLAYWRIGHT_BROWSERS_PATHVALIDATION_OPENAI_MODELVALIDATION_NANO_MODELWEB_BOT_AUTH_ENABLEDWEB_BOT_AUTH_PRIVATE_KEY_PEMWEB_BOT_AUTH_SIGNATURE_AGENT_URLUse Node 22, 23, or 24 for local development. Node 20 is below the workspace engine floor, and Node 25 is not supported because it can fail DNS resolution for app routes and external service calls on localhost.
pnpm installcp apps/web/.env.example apps/web/.env.localhttp://localhost:3000/api/auth/callback/googlehttp://127.0.0.1:3000/api/auth/callback/googlehttps://certscore.ai/api/auth/callback/google/auth/callback is only an app alias route; it is not the redirect URI Better Auth initiates with GoogleNEXT_PUBLIC_APP_URL should be http://localhost:3000S3_BUCKET.pnpm --filter @website-signal-risk-scanner/validation-worker exec playwright install chromiumpnpm dev:validationpnpm --filter @website-signal-risk-scanner/web devWS01 when you need the standalone scanner locally.localhost:3000:pnpm dev:scanner:localWC01:pnpm dev:allpnpm dev:validation:schedulerUse these commands before shipping changes:
pnpm turbo run typecheckpnpm turbo run buildValidation-specific checks:
pnpm --filter @website-signal-risk-scanner/validation-worker typecheckpnpm test:scan-pipelineThe scan pipeline test is deterministic and runs locally from apps/validation-worker/src/validation/pipeline.test.ts.
The normalized concern lifecycle in WC01 is documented in docs/normalized-concern-pipeline.md.
GitHub Actions workflow: .github/workflows/accessibility-validation.yml
worker-scan-pipeline-tests runs on pushes to main, pull requests, and manual dispatch. It installs Chromium, typechecks validation-worker, and runs pnpm test:scan-pipeline.live-validation-smoke runs after the deterministic job and executes pnpm --filter @website-signal-risk-scanner/validation-worker smoke:validation only when the runtime secrets are configured.Use these lightweight checks before first deployment validation:
pnpm dev:storage:localpnpm --filter @website-signal-risk-scanner/web check-envpnpm check-env:validationpnpm --filter @website-signal-risk-scanner/validation-worker check-envpnpm --filter @website-signal-risk-scanner/validation-worker check-runtimeFor local validation runs, pnpm dev:storage:local starts MinIO against the apps/web/.env.local S3 settings and creates the configured bucket when needed.
Run it alongside pnpm dev:scanner:local and pnpm dev:validation:worker.
Use this runtime smoke helper:
pnpm --filter @website-signal-risk-scanner/validation-worker schedulerThe full runtime QA sequence is documented in docs/runtime-validation.md. The validation pipeline design and deployment shape are documented in docs/validation-pipeline-plan.md. The validation crawler deployment and VM runbook is documented in docs/validation-ops-runbook.md. Cloudflare Verified Bot setup is documented in docs/cloudflare-web-bot-auth.md.
ConsentCheck can expose a signed HTTP Message Signatures key directory and sign outbound HTTP crawler requests for Cloudflare Verified Bot workflows.
Required configuration:
WEB_BOT_AUTH_ENABLEDWEB_BOT_AUTH_PRIVATE_KEY_PEMWEB_BOT_AUTH_SIGNATURE_AGENT_URLWEB_BOT_AUTH_EXPIRES_SECONDSWEB_BOT_AUTH_INCLUDE_NONCECommon commands:
pnpm web-bot-auth:generatepnpm web-bot-auth:printpnpm web-bot-auth:test-requestpnpm test:web-bot-authcertscore.aiconsentcheck.site is owned outside WC01 and must not be deployed by this repomain deploys through .github/workflows/web-aws-ecs-deploy.ymlpnpm ops:check:deploy before or after topology changes to catch stale local assumptionspnpm ops:check:live against the public hosts to verify runtime target and revision alignment after deployWC01 for the primary scanner deploy pathWS01 for scanner runtime deploymentWC01 deployment guidance scoped to web and validation onlyWC01 validation runtime changesS3_BUCKETRecommended production trigger:
Command:
pnpm dev:validation:schedulerThe primary scanner scheduler now lives in WS01.
After deployment, validate in this order:
WS01 owns crawl, auditing, scoring, reporting, PDF generation, and scheduled sweep logic.來源：README.md，提交 0bed26a
Check CertScore connection
Read current authenticated connection mode, granted scopes, workspace access, rolling scan quota and recovery action. No scan ID is needed and no scan is created. Use this to diagnose read-only access or quota limits; reconnect only for expired, revoked or expanded access.
無需輸入參數。
Scan site
Use for a user-requested website launch review, vendor assessment, cookie/tracker inventory, consent/GPC investigation or privacy-policy review. A public URL or domain is enough. Creates a privacy scan or reuses an eligible recent completed scan; default freshness=latest saves new-scan quota. Use refresh only for an explicitly requested fresh scan or post-fix recheck. Retain scanId, poll certscore_get_scan_status only while active at retryAfterSeconds, then read certscore_get_scan_bundle. A preliminary preConsentPreview is not final findings or totals. Coverage includes pre-consent storage, trackers, consent and CMP signals, privacy-policy disclosures, transport security and GDPR/ePrivacy or CCPA/CPRA review signals. Results are automated observations, not legal advice, certification, or a compliance determination. https://certscore.ai/developers/mcp.
url必填scanFromfreshnesstaskContextmaxWaitSecondswaitForCompletionGet CertScore scan
Retrieve the API v2 public-safe scan resource, including completed-limited no-go disposition, reason-specific guidance, and timing when available.
scanId必填Get scan status
Returns lifecycle status for a stable CertScore scanId. Active responses include phase, heartbeat, estimated progress, retryAfterSeconds, and sometimes a bounded preliminary preConsentPreview. Terminal responses include completion status, CertScore score and risk metadata when available, coverage, persisted execution region and timestamps, report URL, and a next-action field. Preliminary observations are distinct from completed findings.
scanId必填Get CertScore Pulse report
Focused follow-up: retrieve a bounded Pulse report with high-signal TextContent and typed structuredContent, including customer-safe no-go messaging. For broad privacy questions, use certscore_get_scan_bundle first because it combines canonical findings, limitations, and pre-consent rows without redundant calls.
detailformatscanId必填Get CertScore Pulse evidence
Focused follow-up: retrieve a bounded public-safe evidence packet with a concise TextContent digest and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first. Excludes raw cookie values, raw bodies, sensitive payloads, full DOM, and unredacted query values.
scanId必填Get report evidence page
For a focused question, use section=cmp, cms, consent, gpc, policy, tracking, transport, forms or accessibility. This returns selected retained report sections plus shared scan, score, findings and coverage context. CMP includes all 13 criteria with their assessment results and retained comparisons; CMS includes platform/version evidence and existing advisories. Policy also includes retained privacy-choice controls, unverified link candidates and notice passages; California-focused reports include their shared privacy section. detailedEvidence carries shared display wording, counts and cross-links; these audit rows are not additional findings. Use reviewFocus=gdpr_eprivacy or ccpa_cpra to match the corresponding web/PDF/Word view; omit it to retain the scan default. Preserve reviewFocus and section on cursor continuation; unselected or not-returned fields are not evidence of absence. Use workpaper=tracking separately for the starting-page tracking inventory, privacy choices/notices and GPC evidence, with JSON and CSV downloads. Never combine section and workpaper. The workpaper selector also applies to every continuation request. Otherwise retrieve scan report display content as paginated JSON, without internal diagnostic JSON downloads. The response also offers a single-file full JSON download; private JSON download links expire after five minutes and need no OAuth header; use pagination if your host blocks file downloads. Repeated display records use reportContentRef JSON Pointers. Includes evidence tables, full-site page and resource inventories, all retained additional-page form fields, form snapshot download references, and retained limitations. Snapshot images are downloaded separately from the returned URLs, with OAuth bearer authentication for workspace scans. Available on OAuth and Light. Start with scanId; follow pagination.nextCursor until complete. Pages share a snapshot; restart if it changes. Each entry has a JSON Pointer path and value; oversized stri
cursorscanId必填sectionworkpaperreviewFocusGet scan bundle
Main answer for a completed or completed-limited scan: canonical findings, next steps, supporting evidence, score, date/region, coverage and report URL. An existing scanId is enough; no new scan is created. The evidence index describes response delivery, never evidence absence. Optional next actions lead to deeper report tables, tracking workpapers and JSON/CSV exports. Use detail=evidence for request examples and policy candidates, including scans with no findings; detail=full adds bounded retained context. Preserve returned/total counts and omission metadata. Accept/Reject execution succeeded means a completed click and bounded observation; succeeded_with_confirmation additionally verifies the consent decision. Retained after-click facts remain distinct from registered decisions. Absent or failed capture remains explicitly limited. Use canonical findings for scoring effects. A later missing finding does not prove a fix. Results are automated public-web observations, not legal advice, certification, or a compliance determination.
detailscanId必填maxBytesmaxFindingsmaxPreConsentRowsExport CertScore findings
Return structured findings plus completed-limited no-go disposition and guidance for downstream review or ticketing workflows.
scanId必填List CertScore findings
Focused follow-up: list bounded API v2 public-safe findings already projected by the canonical pipeline, with matching high-signal TextContent and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first.
limitoffsetscanId必填Get pre-consent cookies and trackers
Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence with matching TextContent and typed structuredContent. For a new broad request such as checking a site for pre-consent tracking, use certscore_scan_site then certscore_get_scan_bundle first.
scanId必填maxRowsExplain CertScore finding
Explain one projected finding with public evidence, caveats, reviewer next steps, and reason-specific no-go context when applicable.
scanId必填findingId必填Get latest domain scan
Retrieve the latest eligible API v2 public-safe scan for a domain.
domain必填scanFromGet latest domain pre-consent cookies and trackers
Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence from the latest eligible scan for a domain, with matching TextContent and typed structuredContent. For a broad current-site review, use certscore_scan_site then certscore_get_scan_bundle first.
domain必填maxRowsscanFrom已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在儲存庫或註冊中心條目中宣告授權條款。
website-signal-risk-scanner/├─ apps/│ ├─ web/│ └─ validation-worker/├─ packages/│ ├─ shared/│ ├─ web-bot-auth/│ ├─ db/│ └─ ui/├─ docs/├─ .env.example├─ turbo.json├─ package.json└─ pnpm-workspace.yaml