Site Audit — tool reference

Server URL: https://toolcargo.com/mcp/site-audit · Scope: connector:site-audit · Transport: Streamable HTTP (stateless). Every tool is marked read-only and open-world (it contacts the internet). Each call counts once toward your monthly quota; calls that fail validation or error on our side are refunded.

A prompt called launch_check is also provided. It asks the assistant to run all four tools on one URL and summarise blockers first.

audit_page

Fetches one URL and checks the served HTML and response headers.

{ "url": "https://example.com/pricing" }

The result ends with a 0–100 heuristic score (errors −12, warnings −5, notices −1). It is a quick signal for comparing before and after a fix — not a prediction of rankings.

check_links

{ "url": "https://example.com/resources", "scope": "external", "max_links": 50 }

Extracts unique http(s) links from the page (fragments removed) and tests each with HEAD, retrying with GET when a server rejects HEAD or errors. scope is all, internal (same host, ignoring www.) or external. At most 25 links per call on Free and 100 on Pro; eight are checked in parallel. Reports broken (4xx/5xx), unreachable (DNS, TLS, timeout) and redirected links.

check_crawl_rules

{ "url": "https://example.com/blog/post", "user_agent": "Googlebot" }

• Fetches /robots.txt and evaluates it for the given crawler (default Googlebot; try Bingbot or GPTBot). A 5xx robots.txt is reported as blocking, a 4xx as “no restrictions”.
• Checks the page's noindex directives and canonical, as in audit_page.
• Looks for the URL in the sitemaps named in robots.txt (or /sitemap.xml), following sitemap indexes. At most six sitemap files of up to 5 MB each are read, so very large sites may show “not found in the files checked”.

check_social_preview

{ "url": "https://example.com/blog/launch" }

Reads Open Graph and Twitter tags (falling back to the title and meta description, as most platforms do), fetches the preview image, and checks its HTTP status, Content-Type, byte size and pixel dimensions. Flags SVG images, images under 600×315, ratios far from 1.91:1 and files over 5 MB.

Result format

Every report starts with an outcome: completed (the page was audited), blocked (401/403/429 or a bot-challenge page — we could not see the real page),page error (404/410/5xx — only the response was checked) or not HTML. Page-level checks run only for completed audits; otherwise they are listed as not checked with the reason, and no score is given. A request that never got a response (DNS, TLS, timeout) or a refused URL is an error, not a result.

Each finding has:

• status — passed, failed, or not checked;
• severity by one rule — high: blocks indexing, sharing or the page itself; medium: likely reduces visibility, click-through or preview quality; low: best practice or hygiene;
• evidence — what we observed (a tag value, a header, a count);
• why it matters and a practical fix.

Compatibility (changed 11 September 2026): tool names and inputs are unchanged. Text results gained an Outcome: line, “Evidence / Why it matters / Fix” lines and “Not checked” items; severity is shown as high/medium/low. audit_page results from signed-in accounts end with a link to the saved report. Blocked pages are no longer audited as if they were the site (previously a bot-challenge page could be scored), and links answering 401/403/429 are reported as “could not verify” instead of broken.

Usage policy

The same rules apply to calls from your assistant and to audits run on the website, including re-runs:

• Counted: the site answered and you got a result — including “blocked by the site” and “page error” outcomes.
• Not counted: refused or invalid URLs, sites we couldn't reach (DNS, TLS, timeout), and failures on our side. Rate-limit and quota rejections never use a call.
• A retry is simply another call under the same rules. Quotas reset on the 1st of each month (UTC).

Saved history

For signed-in accounts, every audit_page run — from the website or your assistant — is saved privately: the URL, the check results and short evidence, never the page HTML. From Audits you can re-run a page, compare any two runs (fixed / new / still to fix), print a client report or download Markdown. History is kept 180 days and can be switched off or deleted at any time. Scheduled re-checks and alerts are not part of Site Audit.

Limits and behaviour

• HTML is read up to 2 MB; images up to 6 MB. Each request times out after 8–10 seconds; redirects are followed up to five hops.
• JavaScript is not executed. Pages that build their content in the browser can look empty — the report says so when there is very little text.
• One page per call. Site Audit is not a crawler.

Our fetcher

Requests come from Vercel's infrastructure with the user agent ToolCargoAudit/0.1 (+https://toolcargo.com/docs/site-audit#fetcher). We only fetch URLs a signed-in user (or the rate-limited homepage demo) explicitly asks for, plus that page's links, preview image, robots.txt and sitemaps when the matching tool is called. We do not crawl, store page contents, or retry in the background.

For safety, the fetcher refuses non-http(s) URLs, non-default ports, URLs with credentials, localhost and private, link-local or reserved IP ranges — including hostnames that resolve to them — on every redirect hop. Site owners who want requests to stop can block the user agent above or contact us.