Troubleshooting

First: test the connection without an assistant

This isolates ToolCargo from your client. Put your key in an environment variable first (export TOOLCARGO_API_KEY=tp_live_…). A working key returns the four tools:

curl -s https://toolcargo.com/mcp/site-audit \
  -H "Authorization: Bearer $TOOLCARGO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-11-25" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

• HTTP 401 with invalid_token: the key is wrong, revoked, or missing the Bearer prefix.
• HTTP 403 with insufficient_scope: the key was created without the Site Audit connector ticked. Create a new key.
• HTTP 403 with forbidden_origin: a browser-based tool sent an Origin we don't accept. Use a desktop client or the CLI.
• A JSON list of tools: ToolCargo is fine; the issue is in the client configuration.

The client shows no tools

• Claude Code: run claude mcp list and /mcp inside a session. If you added the server with --scope project, it only exists in that folder.
• Check that the URL ends in /mcp/site-audit with no trailing slash and uses https.
• Restart the client after editing JSON configuration files; most read them only at start-up.
• Make sure the header is exactly Authorization: Bearer tp_live_….

OAuth sign-in fails or loops

• Sign in to ToolCargo in the same browser the client opens, then approve. Pop-up blockers can hide the window.
• If the approval page says the link is not valid, start the connection again from the client — authorization links expire after five minutes.
• Revoked the app from your dashboard? The client must reconnect; revocation is immediate.

“Monthly limit reached” or “Rate limit”

Tool results report how many calls you have used. Monthly quotas reset on the 1st (UTC); per-minute limits reset after a minute. Failed and rejected calls are not counted. Your dashboard shows each call.

“Private or local hostnames are not fetched”

Site Audit only reaches public sites on ports 80 and 443. Staging sites behind VPNs, localhost, IP-restricted previews and password-protected pages cannot be audited. Some sites also block automated requests (HTTP 403 or a challenge page); the report will show the status the site returned.

“Blocked by the site”

The site answered with 401/403/429 or a bot-challenge page, so we could not see the real page and did not score it. If it's your client's site, allow the ToolCargoAudit user agent in the firewall or bot protection and re-run. Search engines' crawlers are often treated differently, so a block here doesn't mean Google is blocked — check with the search engine's own URL inspection tool.

The audit says the page has almost no text

The page is probably rendered with JavaScript. Site Audit reads the HTML the server sends, which is also what many crawlers see first. Server-side rendering or pre-rendering fixes both.

Billing

• After paying, Pro activates when PayPal notifies us — usually within seconds. If it has not activated after ten minutes, email us with the time of purchase.
• If a renewal fails, PayPal retries; your account uses Free limits meanwhile.
• To stop billing, cancel in the dashboard or in PayPal under automatic payments.

Still stuck? Email mustafa.halawa9@gmail.com with the time of the failed call — it appears in your usage list.