# Bot Appétit (remote · botappetit.ai)

Can a machine consume this page? AEO, SEO and performance scans. Page scans need no account.

- Trust score: 70/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-06

## Components

- remote · `botappetit.ai`: 70/100 (this document), [markdown](https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit.md), [page](https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit)

## Channel facts

- Endpoint: `https://botappetit.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-06.

- **Endpoint Security**: 66/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (set_pins).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1906 tokens (~136/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Bot Appétit MCP server?

Bot Appétit is a hosted endpoint at https://botappetit.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http ai-botappetit-bot-appetit 'https://botappetit.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "ai-botappetit-bot-appetit": {
      "url": "https://botappetit.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ai-botappetit-bot-appetit": {
      "type": "http",
      "url": "https://botappetit.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.ai-botappetit-bot-appetit]
url = "https://botappetit.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-botappetit-bot-appetit": {
      "type": "remote",
      "url": "https://botappetit.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-botappetit-bot-appetit --url 'https://botappetit.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ai-botappetit-bot-appetit:
    url: "https://botappetit.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "ai-botappetit-bot-appetit": {
      "Transport": "http",
      "Url": "https://botappetit.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add ai-botappetit-bot-appetit -t streamable-http -u 'https://botappetit.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "ai-botappetit-bot-appetit": {
      "type": "http",
      "url": "https://botappetit.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-06 (score 70, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-11-04 (score 69, +2)

- [security improvement] DNSSEC: fail → pass

### 2026-11-03 (score 67, 0)

- [security] Tool “site_scan_status” rewrote its description, which is the text the model reads
- [security] Tool “start_site_scan” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 128 → 142
- [functional improvement] Stability: unverified → 0.03

### 2026-11-02 (score 67)

First indexed and scored.

## MCP tools (14)

### `scan_page` (~152 tokens)

Scan a page

Check one web page for AEO, SEO and performance: can a machine consume it? Returns the findings by check and the report link. If the exact page was scanned in the last 24 hours the stored result is returned at no cost; set fresh to scan again. A page that blocks our scanner is returned as blocked with no score, because it cannot pass. Free, no account needed.

Input parameters:

- `fresh` (boolean): Set true to always run a new scan instead of returning a stored result under 24 hours old. A new scan uses the stricter new-scan rate limit.
- `url` (string, required): The page to check, such as https://example.com/pricing. A bare domain works.

### `get_report` (~106 tokens)

Get a stored report

Get a stored Bot Appétit report by scan id, the same report a person sees at botappetit.ai/r/<id>. Costs nothing and does not scan. Use it to re-read a report you were given a link to. A page that blocked our scanner is returned as blocked, with no score.

Input parameters:

- `id` (string, required): The scan id: the last part of a report link on botappetit.ai/r/<id>, or `scan_id` from scan_page.

### `page_history` (~98 tokens)

Get a page’s history

List every stored Bot Appétit scan of one exact page, newest first, with the score at the time and how it moved since the scan before. Costs nothing and does not scan. Use it to show whether a page has improved. Blocked and failed scans are listed without a score.

Input parameters:

- `url` (string, required): The exact page, such as https://example.com/pricing. `/a` and `/a/` are different pages.

### `list_checks` (~86 tokens)

List the checks

List every check Bot Appétit runs on a page, grouped by category, with the id of each. Use the id with explain_check for what a check means and what good looks like. Every check asks one question: can a machine consume this page?

Input parameters:

- `category` (string): Only checks in this category id, such as "aeo". Leave out for all of them.

### `explain_check` (~78 tokens)

Explain a check

Explain one Bot Appétit check: what it looks at, why it matters for machines reading a page, and what good looks like. Use the id from list_checks or a report. Costs nothing and does not scan.

Input parameters:

- `id` (string, required): A check id from list_checks or from a report, such as "llms-txt".

### `request_site_scan` (~130 tokens)

Ask for a whole-site scan

A whole-site scan reads a representative sample of a site and needs a person with a Bot Appétit account, and an agent never creates one. This returns exactly what the person must do, in order: connect this agent to their account (a one-time approval in their browser), after which start_site_scan, site_scan_status, list_sites and the other account tools work. For a single page, use scan_page instead, which is free and needs no account.

Input parameters:

- `url` (string): The site the person wants scanned, if you know it. It is used only to word the steps.

### `leaderboard` (~145 tokens)

The leaderboard

The highest-scoring sites by category, from the latest Bot Appétit scan of each site's homepage: rank, host, score out of 100, grade and a link to the full report. Call it with no category to see the top of every category, or with a category id for that board. Only sites that were scored on the current rules are ranked; a site that blocked our scanner is never ranked.

Input parameters:

- `category` (string): A category id such as "software" or "news". Leave out for the top sites of every category.
- `limit` (integer): How many sites to return per category (default 10 for one category, 5 for all).

### `start_site_scan` (~229 tokens)

Start a whole-site scan

Start a whole-site scan for the signed-in person's account: Bot Appétit reads a representative sample of the site (not every page) and scores it. Needs the person to have authorised this connection. It returns a job_id straight away and the scan runs in the background, so read it with site_scan_status. A full scan of a large site usually takes about 2 and a half minutes and nine in ten finish within about 5 and a half minutes; a site of ten pages or fewer usually finishes in under half a minute. Do not poll: the first answer asks for one check after 30 seconds, and if the scan is still running the next answer says how long to wait. Read check_again_after_seconds in the answer and wait that long before the next check. The result is private to their account until they choose to share it. For one page, use scan_page, which needs no account.

Input parameters:

- `site` (string, required): The site to scan: a domain such as example.com, a sitemap URL, or a list of pages on ONE site, one per line.

### `site_scan_status` (~200 tokens)

Read a site scan

Read one of the signed-in person's site scans: whether it is still running, and once it has finished the score, the checks that failed, the category scores and the pages it covered, each page with a link to its own full report. Only the account that ran the scan can read it. A scan that is still running is normal, not an error. A full scan of a large site usually takes about 2 and a half minutes and nine in ten finish within about 5 and a half minutes; a site of ten pages or fewer usually finishes in under half a minute. Do not poll: the first answer asks for one check after 30 seconds, and if the scan is still running the next answer says how long to wait. Read check_again_after_seconds in the answer and wait that long before the next check.

Input parameters:

- `job_id` (string, required): The job_id start_site_scan returned, or one from list_sites or site_history.

### `list_sites` (~64 tokens)

List the person's sites

List the sites the signed-in person follows in Bot Appétit, newest activity first, each with its latest site-scan score, the change since the scan before, and the trend. Use a host from here with site_history, set_pins and the other site tools.

### `site_history` (~98 tokens)

Read one site over time

Read one of the signed-in person's sites over time: every site scan of it newest first with the score and the change since the previous scored scan (a change across a scoring update or different pinned pages is marked, not passed off as the site's own), the pinned pages, and the monthly re-scan settings.

Input parameters:

- `host` (string, required): The site, as list_sites gives it: for example www.example.com. An address is accepted too.

### `set_pins` (~132 tokens)

Pin or unpin pages

Pin or unpin pages on one of the signed-in person's sites. Pinned pages are scanned in every site scan of that site and count toward its score; up to 25, on the site itself. Give pin and/or unpin lists. Returns each address's outcome and the pins now in place; they apply from the next scan.

Input parameters:

- `host` (string, required): The site, as list_sites gives it.
- `pin` (array): Page addresses to pin. They must be on the site (or its www/apex twin).
- `unpin` (array): Page addresses to stop pinning.

### `set_rescan_settings` (~121 tokens)

Set monthly re-scans

Turn the signed-in person's monthly re-scans of their sites on or off, and the email of each result on or off. Leave a field out to keep it as it is; call with no fields to read the current settings. The settings belong to the account, not to one site.

Input parameters:

- `email` (boolean): Email the person the result of each monthly re-scan. Leave out to keep the current setting.
- `rescan` (boolean): Re-scan this account's sites automatically each month. Leave out to keep the current setting.

### `share_site_scan` (~128 tokens)

Share a site scan

Create or stop the unlisted share link for one of the signed-in person's site scans. Site scans are private by default; a link lets anyone who holds it read that one scan (not the person's other scans) and stays valid until stopped. Only create a link when the person has asked to share the scan, and tell them who can open it.

Input parameters:

- `action` (string, required): "create" makes an unlisted link anyone holding it can open; "stop" turns it off so the link stops working.
- `job_id` (string, required): The site scan to share or stop sharing.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit#diagnostics

## Score history

- 2026-11-06: 70
- 2026-11-05: 69
- 2026-11-04: 69
- 2026-11-03: 67
- 2026-11-02: 67

## Common questions

### What is the Bot Appétit MCP server?

Bot Appétit is an MCP server listed in the public MCP registry as ai.botappetit/bot-appetit. Can a machine consume this page? AEO, SEO and performance scans. Page scans need no account. This page covers its hosted endpoint (https://botappetit.ai/mcp).

### Is the Bot Appétit MCP server safe to use?

Bot Appétit scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Bot Appétit MCP server expose?

Bot Appétit exposes 14 tools: scan_page, get_report, page_history, list_checks, explain_check, and 9 more. Their descriptions and schemas cost roughly 1,767 tokens of context every time the server is loaded.

### Does the Bot Appétit MCP server require authentication?

No. We connected to Bot Appétit without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Bot Appétit MCP server still maintained?

Bot Appétit is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Bot Appétit MCP server?

VerifyMCP ran 13 checks on Bot Appétit, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://botappetit.ai/mcp
- Website: https://botappetit.ai/mcp
- Changelog RSS feed: https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit.json
- HTML version of this page: https://verifymcp.io/servers/ai-botappetit-bot-appetit/botappetit