Site Audit MCP server

Live

Audit, monitor and troubleshoot any public website from one MCP server.

Ask your AI assistant to audit a page before launch, after a redesign, or when a client asks why a link preview looks wrong. Site Audit fetches the page from our servers, reads the served HTML, and returns specific findings with fixes. The same server also watches pages and uptime on a schedule, and checks SSL certificates, redirects, DNS and email records, security headers, sitemaps, robots.txt, accessibility, page weight and the technology a site uses.

Site Audit is a hosted MCP server with 24 tools. The Claude Code command is on this page. Steps for Cursor and ChatGPT, and which clients we have tested, are in the client guides.

Connect this tool ↗Tool reference Try the live demo

Connect / 24 tools

Server URL

streamable http

https://toolcargo.com/mcp/site-audit

Claude Code

terminal

claude mcp add --transport http --scope user toolcargo-site-audit https://toolcargo.com/mcp/site-audit \
  --header "Authorization: Bearer YOUR_API_KEY"

Create a key in your dashboard. Other clients: setup guides.

Try it on a public page

Anonymous demo, limited per IP. Sign up to save history, compare before/after, and connect it to your assistant.

site-audit · audit_page

Enter any public page. This runs the same engine your assistant calls — live, not a recording.

What a report looks like

Real output of audit_page for https://example.com/ (a reserved demonstration domain), run on 11 September 2026. It's an example, not a customer's site.

Score

76/100

High

Medium

Low

Passed

Audit completed (HTTP 200).

To fix (8)

MediumNo canonical link
Evidence: No <link rel="canonical"> in the served HTML
Why it matters: The canonical tells search engines which URL to index. A missing, relative or conflicting one can split or misdirect indexing.
Fix: Add <link rel="canonical" href="https://example.com/"> (or the preferred URL).
MediumTitle is only 14 characters
Evidence: Example Domain
Why it matters: The title is the main headline in search results and browser tabs; missing or truncated titles lose clicks.
Fix: Describe the page's topic more specifically.
MediumMissing meta description
Evidence: No <meta name="description"> tag in the served HTML
Why it matters: Search engines often use it as the snippet under the title; without one they pick text themselves.
Fix: Add a 70–160 character summary; search engines may use it as the snippet.
MediumNo Open Graph tags
Evidence: None of og:title, og:description, og:image, og:url found
Why it matters: Social platforms and chat apps build link previews from Open Graph tags; without them previews are plain or wrong.
Fix: Add og:title, og:description, og:image and og:url so links render as rich cards.
LowAbout 17 words of text in the HTML
Evidence: 17 words of visible text in the served HTML (before any JavaScript runs)
Why it matters: If the served HTML contains little text, crawlers that don't run JavaScript see an almost empty page.
Fix: If the content is rendered by JavaScript, use server-side rendering or pre-rendering so crawlers see it; otherwise add substantive text.
LowNo twitter:card tag
Evidence: No <meta name="twitter:card"> tag
Why it matters: X uses twitter:card to decide between a small and a large preview.
Fix: Add <meta name="twitter:card" content="summary_large_image"> for large previews on X.
LowNo structured data found
Evidence: No JSON-LD blocks and no microdata in the served HTML
Why it matters: Structured data can make pages eligible for richer search results when it matches visible content.
Fix: Consider JSON-LD for your organisation, products, articles or breadcrumbs where it matches visible content.
LowMissing headers: HSTS, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy
Evidence: Not a ranking factor; listed as hygiene.
Why it matters: These headers reduce common browser attack risks. They are hygiene, not a ranking factor.

Severity rule. High: blocks indexing, sharing or the page itself. Medium: likely reduces visibility, click-through or preview quality. Low: best practice or hygiene; fix when convenient.

Scope. This is a check of one page's served HTML and response headers. Not checked: content rendered by JavaScript, Core Web Vitals and real-user speed, rankings, traffic or keywords, whether Google has actually indexed the page, other pages on the site (no crawling). The score is a heuristic (high −12, medium −5, low −1), not a ranking prediction.

What it helps you do

Catch a stray noindex, a wrong canonical or a robots.txt block before a page goes live.
Find broken and redirected links on a page in one request.
See why a shared link shows the wrong title or no image, and what to change.
Validate that JSON-LD parses and carries the basic properties for its type.
Get alerts when a page turns noindex, a site goes down or a certificate is about to expire.
Check SSL, redirects, DNS and email records, headers and accessibility before a domain goes live.

Built for: Freelancers, agencies and in-house marketers who check client or company pages every week.

What's inside

One connection gives your assistant all of these. Each has a detailed reference.

Example requests

Pre-launch check

“Run a launch check on https://example.com/pricing — audit the page, check crawl rules for Googlebot and list anything that blocks indexing.”

Your assistant calls audit_page and check_crawl_rules, then summarises blockers first (noindex, robots.txt rules, canonical conflicts) and nice-to-haves after.

Broken links on a landing page

“Check all external links on https://example.com/resources and give me a table of the broken ones with the anchor text.”

check_links tests every unique link on the page (up to your plan's limit) and reports broken, unreachable and redirected ones.

Fix a link preview

“When I share https://example.com/blog/launch on LinkedIn the image is missing. Why?”

check_social_preview fetches the og:image and reports whether it is missing, returns an error, is the wrong type or is too small.

Step-by-step workflows: pre-launch check · fixing link previews

Tools

Tool	What it does	Access
`audit_page` Audit a page	Fetch one public URL and check status, redirects, title, meta description, canonical, noindex, headings, image alt text, Open Graph tags, JSON-LD structured data, hreflang and HTTPS headers. Returns prioritised findings with fixes.	Read-only
`check_links` Check links on a page	Extract the links on a public page and test each one (HEAD, falling back to GET). Reports broken links, unreachable hosts and redirects that should be updated.	Read-only
`check_crawl_rules` Check crawl and index rules	Evaluate robots.txt for a given crawler, meta robots and X-Robots-Tag, the canonical link, and whether the URL appears in the site's XML sitemap. Answers: can this page be indexed?	Read-only
`audit_site` Audit several pages of a site	Audit the starting page plus more pages found in the site's XML sitemap (or its links), up to your plan's page limit. Returns the issues shared across pages and the weakest pages first. Each audited page counts as one call; pages that can't be fetched are not counted.	Read-only
`check_social_preview` Check the social link preview	Read Open Graph and Twitter card tags, fetch the preview image and check its type, size and dimensions. Shows what a shared link card will be built from.	Read-only
`watch_page` Watch a page	Start (or update) watching one public URL. Runs a baseline audit now, then re-checks it daily or weekly and records alerts when noindex appears, robots.txt starts blocking Googlebot, the canonical changes, the page returns an HTTP error or becomes unreachable, or a new high-impact issue appears.	Writes a document (not a third-party API)
`list_watches` List watched pages	Your watched pages with their current state, frequency, next check time and plan usage.	Read-only
`watch_history` Watch history	Recent alerts and recoveries for one watched page, with links to the saved audit reports.	Read-only
`stop_watching` Stop watching	Stop watching a page and delete its alert history. Saved audit reports stay in your history.	Writes a document (not a third-party API)
`watch_uptime` Watch uptime	Start (or update) an HTTP + TLS check on one public URL. Runs a baseline now, then re-checks daily or weekly and records alerts when the URL becomes unreachable, returns HTTP 5xx, the certificate enters the 21-day window or expires, or the certificate name does not match.	Writes a document (not a third-party API)
`list_uptime` List monitors	URLs you monitor, last HTTP status, certificate days remaining, frequency and next check time.	Read-only
`uptime_history` Uptime history	Recent alerts and recoveries for one monitored URL.	Read-only
`stop_uptime` Stop monitoring	Stop monitoring a URL and delete its alert history.	Writes a document (not a third-party API)
`accessibility_quick_audit` Accessibility quick audit	Check public HTML for missing form labels, unnamed buttons and links, broken ARIA references, duplicate IDs, image alt, heading structure and frame titles. Not a WCAG certification.	Read-only
`page_asset_budget` Page asset budget snapshot	Count referenced scripts, stylesheets, images and fonts, then HEAD-check up to six same-origin assets for declared byte sizes. A bounded static inventory, not a speed score.	Read-only
`inspect_headers` Inspect HTTP headers	Fetch a public URL (SSRF-guarded) and report HSTS, CSP, framing, cookies flags and a few other headers.	Read-only
`check_certificate` Check a TLS certificate	Connect to port 443 and report issuer, expiry, days remaining and whether the certificate covers the hostname.	Read-only
`trace_redirects` Trace a redirect chain	Follow http(s) redirects (SSRF-guarded) and report each hop, 301 vs 302, and host/protocol changes.	Read-only
`inspect_robots` Inspect robots.txt	Fetch a public /robots.txt and say whether a path is allowed for a crawler token (Googlebot, GPTBot, …).	Read-only
`list_sitemap_urls` List sitemap URLs	Fetch a public sitemap.xml and list up to 50 <loc> URLs.	Read-only
`inspect_dns_email` Inspect DNS and email authentication	MX, A/AAAA, NS, SPF and DMARC for a public domain, plus an optional DKIM selector lookup. Public resolvers only.	Read-only
`lookup_domain` Look up a domain (RDAP)	Registrar, status, nameservers and expiry from the public RDAP service. Some ccTLDs hide expiry.	Read-only
`inspect_security_txt` Inspect security.txt	Fetch /.well-known/security.txt (then /security.txt) with the Site Audit SSRF guard.	Read-only
`inspect_tech_stack` Inspect technology signals	Identify CMS, frameworks and marketing tags from strong public HTML and asset signatures, with evidence and confidence. No hidden technology or version guessing.	Read-only

Requirements

• A ToolCargo account (free).
• An MCP client that supports remote Streamable HTTP servers.
• The pages you check must be publicly reachable over http/https on the default ports.

Limitations

• Reads the served HTML only: it does not run JavaScript, so client-rendered content may look empty.
• audit_page checks one page per call; audit_site checks a capped set of pages from the sitemap. It is not a full site crawler.
• Structured-data checks are basic property checks, not Google's Rich Results Test.
• Private networks, localhost, and non-default ports are refused by design.
• Some sites block automated requests; those show up as errors, not as findings.

Supported clients

“Tested” means we connected that client to this endpoint and ran a tool call ourselves. Recorded client-specific tests currently cover Site Audit. Other connectors use the documented setup until tested in that client.

Claude Code	API key header	Tested	Remote HTTP server with an Authorization header. Tested 2026-09-11 (v2.1.268).
Claude (claude.ai)	OAuth sign-in	Tested	Custom connector with OAuth sign-in; tested on claude.ai web 2026-09-11. Desktop and mobile use the same account connectors but were not tested separately.
Cursor	API key header	Documented, not yet tested	mcp.json with url and headers.
VS Code (Copilot agent mode)	API key header	Documented, not yet tested	.vscode/mcp.json with type http and headers.
ChatGPT (developer mode)	OAuth sign-in	Documented, not yet tested	Requires OAuth; API keys cannot be entered.
MCP Inspector	API key header	Tested	CLI mode, tested 2026-09-11. Useful for calling tools directly.

Practical workflows

Pricing

Free, Pro and Agency share hosted-tool allowances. See pricing for monthly and annual plans and current checkout availability.

Free

Try hosted tools with a shared monthly allowance.

50 shared calls/month · 25 links per check

Pro

$12/mo

Proposed larger shared allowance; see checkout status on the pricing page.

5,000 shared calls/month · 100 links per check

Proposed test price. See the pricing page for checkout status.

Agency

$39/mo