Site Audit — tool reference

Server URL: https://toolcargo.com/mcp/site-audit · Scope: connector:site-audit · Transport: Streamable HTTP (stateless). Every tool is marked read-only and open-world (it contacts the internet). Each call counts once toward your monthly quota; calls that fail validation or error on our side are refunded.

A prompt called launch_check is also provided. It asks the assistant to run the four single-page tools on one URL and summarise blockers first.

Interactive connector dashboard

Call connector_dashboard with an empty input to browse connectors, see your Site Audit plan and monthly usage, and review your latest saved page reports. In an MCP Apps compatible host, you can run a page audit and attach a saved report to your conversation. Viewing the dashboard is free; audits use the same quota as the tools below. OpenAI extension support adds sidebar and thread entrypoints in compatible hosts.

audit_page

Fetches one URL and checks the served HTML and response headers.

{ "url": "https://example.com/pricing" }

The result ends with a 0–100 heuristic score (errors −12, warnings −5, notices −1). It is a quick signal for comparing before and after a fix — not a prediction of rankings.

audit_site

{ "url": "https://example.com", "max_pages": 10 }

Audits the starting URL first, then more pages of the same site: from the XML sitemap listed in robots.txt (or /sitemap.xml, including sitemap indexes), or — if there is no readable sitemap — from the links on the starting page. Shallow paths come first. Each page gets the full audit_page checks; the result lists the issues shared across pages (“missing meta description on 7/10 pages”) and the weakest pages first. Each page is saved to your history like a normal audit.

• Pages per call: up to your plan's limit (Free 5, Pro 20, Agency 100). Each audited page counts as one call; the call only runs if that many calls are left this month.
• Pages that can't be fetched, and pages not started within the time limit (about 35 seconds from the start of the call), are listed and not counted.
• To protect the sites being checked, the same site can be the target of at most 6 audit_site calls per 10 minutes across all accounts; a refused call is not counted.
• It is not a full crawler: it samples up to the limit, and skips files such as PDFs and images.

check_links

{ "url": "https://example.com/resources", "scope": "external", "max_links": 50 }

Extracts unique http(s) links from the page (fragments removed) and tests each with HEAD, retrying with GET when a server rejects HEAD or errors. scope is all, internal (same host, ignoring www.) or external. At most 25 links per call on Free and 100 on Pro; eight are checked in parallel. Reports broken (4xx/5xx), unreachable (DNS, TLS, timeout) and redirected links.

check_crawl_rules

{ "url": "https://example.com/blog/post", "user_agent": "Googlebot" }

• Fetches /robots.txt and evaluates it for the given crawler (default Googlebot; try Bingbot or GPTBot). A 5xx robots.txt is reported as blocking, a 4xx as “no restrictions”.
• Checks the page's noindex directives and canonical, as in audit_page.
• Looks for the URL in the sitemaps named in robots.txt (or /sitemap.xml), following sitemap indexes. At most six sitemap files of up to 5 MB each are read, so very large sites may show “not found in the files checked”.

check_social_preview

{ "url": "https://example.com/blog/launch" }

Reads Open Graph and Twitter tags (falling back to the title and meta description, as most platforms do), fetches the preview image, and checks its HTTP status, Content-Type, byte size and pixel dimensions. Flags SVG images, images under 600×315, ratios far from 1.91:1 and files over 5 MB.

Result format

Every report starts with an outcome: completed (the page was audited), blocked (401/403/429 or a bot-challenge page — we could not see the real page),page error (404/410/5xx — only the response was checked) or not HTML. Page-level checks run only for completed audits; otherwise they are listed as not checked with the reason, and no score is given. A request that never got a response (DNS, TLS, timeout) or a refused URL is an error, not a result.

Each finding has:

• status — passed, failed, or not checked;
• severity by one rule — high: blocks indexing, sharing or the page itself; medium: likely reduces visibility, click-through or preview quality; low: best practice or hygiene;
• evidence — what we observed (a tag value, a header, a count);
• why it matters and a practical fix.

Compatibility (changed 11 September 2026): tool names and inputs are unchanged. Text results gained an Outcome: line, “Evidence / Why it matters / Fix” lines and “Not checked” items; severity is shown as high/medium/low. audit_page results from signed-in accounts end with a link to the saved report. Blocked pages are no longer audited as if they were the site (previously a bot-challenge page could be scored), and links answering 401/403/429 are reported as “could not verify” instead of broken.

Usage policy

The same rules apply to calls from your assistant and to audits run on the website, including re-runs:

• Counted: the site answered and you got a result — including “blocked by the site” and “page error” outcomes.
• Not counted: refused or invalid URLs, sites we couldn't reach (DNS, TLS, timeout), and failures on our side. Rate-limit and quota rejections never use a call.
• A retry is simply another call under the same rules. Quotas reset on the 1st of each month (UTC).

Saved history

For signed-in accounts, every audit_page run — from the website or your assistant — is saved privately: the URL, the check results and short evidence, never the page HTML. From Audits you can re-run a page, compare any two runs (fixed / new / still to fix), print a client report or download Markdown. History is kept 180 days and can be switched off or deleted at any time. Scheduled re-checks and alerts are not part of Site Audit.

Limits and behaviour

• HTML is read up to 2 MB; images up to 6 MB. Each request times out after 8–10 seconds; redirects are followed up to five hops.
• JavaScript is not executed. Pages that build their content in the browser can look empty — the report says so when there is very little text.
• One page per call. Site Audit is not a crawler.

Also in this server

These tools are served from this same server; each link has the detailed reference.

• Page Watch: Scheduled re-checks that tell you when a page's indexability changes.
• Uptime & SSL Monitor: Scheduled HTTP checks and certificate expiry on public URLs.
• Accessibility Quick Audit: Find actionable accessibility issues in served HTML.
• Page Asset Budget: Find the scripts, styles and images weighing down a page.
• HTTP headers: HSTS, CSP, cookies flags — what the server actually sends.
• SSL certificate: Issuer, expiry and name match for a hostname's TLS certificate.
• Redirect tracer: See every hop when a URL redirects, and whether it is a 301 or a 302.
• robots.txt: Is this path allowed for Googlebot — or GPTBot?
• Sitemap: List the URLs a sitemap.xml actually contains.
• DNS & email auth: SPF, DMARC, MX and DKIM lookups before a client domain goes live.
• Domain lookup: Registrar, nameservers and expiry from public RDAP.
• security.txt: Who to email when you find a hole — RFC 9116.
• Technology Signals: See which technologies a public page visibly uses.

Our fetcher

Requests come from Vercel's infrastructure with the user agent ToolCargoAudit/0.1 (+https://toolcargo.com/docs/site-audit#fetcher). We only fetch URLs a signed-in user (or the rate-limited homepage demo) explicitly asks for, plus that page's links, preview image, robots.txt and sitemaps when the matching tool is called. We do not crawl, store page contents, or retry in the background.

For safety, the fetcher refuses non-http(s) URLs, non-default ports, URLs with credentials, localhost and private, link-local or reserved IP ranges — including hostnames that resolve to them — on every redirect hop. Site owners who want requests to stop can block the user agent above or contact us.