SiteVerdict — Website Audit Tools

SiteVerdict — Website Audit Tools (MCP server)

Website audit tools for AI agents. Ask Claude, ChatGPT, Cursor or any MCP client to "audit my website and tell me what to fix first". It runs real browser-based checks and returns a ranked fix plan:

Prompts: website_fix_plan, cookie_consent_check, prelaunch_check. Resources: siteverdict://checks, siteverdict://guide/scoring.

How billing works

Each check is an Apify Actor. The server runs it on your own Apify account using your APIFY_TOKEN, and Apify bills you directly at its pay-per-event price. This server has no payments, no accounts and no stored data.

• Every run has a spend cap (maxTotalChargeUsd, default $2, configurable per call with maxCostUsd).
• If you cancel a tool call, the Apify run is aborted, so you stop paying.
• You can see run costs in your Apify console.

Get a token at https://console.apify.com/settings/integrations**. To try the tools without a token, set SITEVERDICT_DRY_RUN=1. Every result is then built-in **sample data and is clearly labelled.

Install

Requires Node.js 20+. Replace apify_api_xxx with your token.

Claude Code

claude mcp add --env APIFY_TOKEN=apify_api_xxx --transport stdio siteverdict -- npx -y @siteverdict/mcp

Claude Desktop

Go to Settings → Developer → Edit Config (claude_desktop_config.json):

{
  "mcpServers": {
    "siteverdict": {
      "command": "npx",
      "args": ["-y", "@siteverdict/mcp"],
      "env": { "APIFY_TOKEN": "apify_api_xxx" }
    }
  }
}

You can also install the one-click .mcpb bundle from the Releases page. Claude Desktop asks for your token and stores it securely.

Cursor

Add this to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "siteverdict": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@siteverdict/mcp"],
      "env": { "APIFY_TOKEN": "${env:APIFY_TOKEN}" }
    }
  }
}

VS Code (GitHub Copilot agent mode)

Add this to .vscode/mcp.json. VS Code prompts for the token once and stores it encrypted:

{
  "inputs": [
    { "type": "promptString", "id": "apify-token", "description": "Apify API token", "password": true }
  ],
  "servers": {
    "siteverdict": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@siteverdict/mcp"],
      "env": { "APIFY_TOKEN": "${input:apify-token}" }
    }
  }
}

Or run: code --add-mcp '{"name":"siteverdict","command":"npx","args":["-y","@siteverdict/mcp"],"env":{"APIFY_TOKEN":"${input:apify-token}"}}'

Windsurf / Devin Desktop

Add this to ~/.codeium/windsurf/mcp_config.json. Newer builds use ~/.config/devin/mcp_config.json, or %APPDATA%\devin\mcp_config.json on Windows:

{
  "mcpServers": {
    "siteverdict": {
      "command": "npx",
      "args": ["-y", "@siteverdict/mcp"],
      "env": { "APIFY_TOKEN": "${env:APIFY_TOKEN}" }
    }
  }
}

Cline

Install from the Cline MCP Marketplace once the listing is live, or add this to cline_mcp_settings.json:

{
  "mcpServers": {
    "siteverdict": {
      "command": "npx",
      "args": ["-y", "@siteverdict/mcp"],
      "env": { "APIFY_TOKEN": "apify_api_xxx" },
      "disabled": false,
      "autoApprove": []
    }
  }
}

OpenAI Codex CLI

codex mcp add siteverdict --env APIFY_TOKEN=apify_api_xxx -- npx -y @siteverdict/mcp

Or add this to ~/.codex/config.toml:

[mcp_servers.siteverdict]
command = "npx"
args = ["-y", "@siteverdict/mcp"]
tool_timeout_sec = 600

[mcp_servers.siteverdict.env]
APIFY_TOKEN = "apify_api_xxx"

Scans can take a few minutes, so raise tool_timeout_sec from its default of 60.

Gemini CLI

gemini mcp add -e APIFY_TOKEN=apify_api_xxx siteverdict npx -y @siteverdict/mcp

ChatGPT and Claude (remote connector with OAuth)

These clients need a remote HTTPS URL. The server ships remote mode with OAuth 2.1: CIMD/DCR client registration, PKCE, and a sign-in page where you paste your own Apify token. It also has a ChatGPT/MCP Apps score-card UI. Once the owner deploys it, add https://mcp.webrevenuescan.com/mcp as a custom connector, or /mcp/<toolsets> such as /mcp/web+compliance. Design and deploy steps: docs/REMOTE.md. Not deployed yet.

Docker

docker run -i --rm -e APIFY_TOKEN=apify_api_xxx mcp/siteverdict

Remote / Streamable HTTP (self-hosted)

SITEVERDICT_HTTP_HOST=127.0.0.1 SITEVERDICT_HTTP_PORT=3333 npx -y @siteverdict/mcp --http
# endpoint: http://127.0.0.1:3333/mcp   health: /healthz
# each user sends their own token:  X-Apify-Token: apify_api_xxx   (or Authorization: Bearer apify_api_xxx)
claude mcp add --transport http siteverdict http://127.0.0.1:3333/mcp --header "X-Apify-Token: apify_api_xxx"

The server binds to localhost by default and validates Host and Origin. To serve it publicly, put it behind TLS and set SITEVERDICT_ALLOWED_HOSTS and SITEVERDICT_ALLOWED_ORIGINS.

Toolsets (keep the tool list small)

The default is web: the 7 audit tools plus detect_tech_stack, monitor_website_changes, fetch_clean_markdown and get_run_results. To add more groups:

npx -y @siteverdict/mcp --toolsets web,compliance        # or SITEVERDICT_TOOLSETS=all
npx -y @siteverdict/mcp --tools sanctions_screen,uk_property_data   # explicit allow-list

Some data tools can use your own third-party keys:

• stdio: SITEVERDICT_SECRET_<NAME> env vars
• HTTP: X-SiteVerdict-Secret-<Name> headers

Examples are COMPANIES_HOUSE_API_KEY, HMRC_CLIENT_ID, GOOGLE_MAPS_API_KEY, SERPAPI_API_KEY and EPC_API_TOKEN. The siteverdict://tools resource lists them all. Keys are never tool arguments and never appear in results. Without them, the tool uses the Actor's clearly labelled sample mode or format-only checks.

Full generated table: marketplace/tools.md.

Example prompts

• "Audit https://example.com and give me a fix plan for this week."
• "Is my cookie banner on example.co.uk GDPR-compliant? Does anything track before consent?"
• "How much revenue is my slow mobile site losing? I get 40k visits a month, a 2% conversion rate and a £70 average order."
• "Check example.com against WCAG 2.2 AA and tell me what the European Accessibility Act means for us."
• "Can people spoof email from our domain? Check SPF, DKIM and DMARC for example.com."
• "Will ChatGPT and Perplexity cite our site? Check AI-search readiness."

Configuration

Safety

• Read-only. No tool changes your site. Every tool is annotated readOnlyHint: true, destructiveHint: false, openWorldHint: true.
• Public targets only. Private, loopback, link-local, CGNAT, cloud-metadata and reserved IPs, internal hostnames, non-http(s) schemes, credentials in URLs and odd ports are all rejected. Hostnames that resolve to private addresses are rejected too.
• Tokens stay with Apify. Tokens are sent only to api.apify.com in an Authorization header. They are never logged and never placed in URLs.
• Limits. Calls are rate-limited and concurrent runs are capped per client. Every run has a spend cap. Cancelling a call aborts its run.

Development

npm install
npm run typecheck && npm run lint && npm test   # unit + integration tests (mocked Apify, no network)
npm run smoke                                   # builds, then drives dist/cli.js over real stdio
npm run inspector                               # MCP Inspector UI against the dry-run server
SITEVERDICT_DRY_RUN=1 npm run dev               # stdio from source

To rename the brand, edit brand.json and run npm run brand:sync.

Built on the official MCP TypeScript SDK v2 (@modelcontextprotocol/server). It serves both the 2026-07-28 protocol and 2025-era clients.

Privacy & terms

See PRIVACY.md and TERMS.md. Both are drafts until reviewed. Support: GitHub issues.