# com.validoria/validoria-mcp (remote · api.teste.no)

Continuous website testing by Validoria — monitor security, SEO, performance, and accessibility.

- Trust score: 66/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `api.teste.no`: 66/100 (this document), [markdown](https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp.md), [page](https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp)
- npm · `validoria-mcp`: 33/100, [markdown](https://verifymcp.io/servers/com-validoria-validoria-mcp/validoria-mcp.md), [page](https://verifymcp.io/servers/com-validoria-validoria-mcp/validoria-mcp)

## Channel facts

- Endpoint: `https://api.teste.no/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `2.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 74 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 57/100
  - 20% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 5738 tokens (~73/item across 78 items; 74 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 99/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 96% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-validoria-validoria-mcp https://api.teste.no/api/mcp
```

### Codex

```toml
[mcp_servers.com-validoria-validoria-mcp]
url = "https://api.teste.no/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-validoria-validoria-mcp": {
      "type": "remote",
      "url": "https://api.teste.no/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-validoria-validoria-mcp --url https://api.teste.no/api/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-validoria-validoria-mcp:
    url: "https://api.teste.no/api/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-validoria-validoria-mcp": {
      "type": "http",
      "url": "https://api.teste.no/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-18 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-16 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-15 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-12 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-11 (score 62, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-10 (score 61)

First indexed and scored.

## MCP tools (74)

### `guest_start_scan` (~92 tokens)

Guest quick scan (no account)

Run a free 6-test HTTP scan against a public URL without an API key. Rate-limited (5/IP/hour, 3/session/day). Returns scanId — poll with guest_get_scan. For continuous monitoring, sign up free and use create_target. See teste-no://docs/quickstart.

Input parameters:

- `url` (string, required): Public http(s) URL to scan, e.g. https://example.com

### `guest_get_scan` (~67 tokens)

Get guest scan results

Poll results for a guest_start_scan. Pass the scanId and guestSessionId from the start response. No API key required.

Input parameters:

- `guestSessionId` (string): Guest session id returned by guest_start_scan
- `scanId` (string, required): Scan workflow id from guest_start_scan

### `list_targets` (~67 tokens)

List Targets

List all monitoring targets for your team. Returns name, URL, type, status, and uptime info for each target.

Input parameters:

- `limit` (number): Max number of targets to return
- `status` (string): Filter by target status
- `type` (string): Filter by target type

### `get_target` (~40 tokens)

Get Target Details

Get detailed information about a specific target including status, uptime, fingerprint, and composite scores.

Input parameters:

- `targetId` (string, required): The target ID to look up

### `get_target_scores` (~48 tokens)

Get Target Composite Scores

Get composite scores (Security, SEO, Performance, Accessibility) for a target. Each score is 0-100 with a status rating.

Input parameters:

- `targetId` (string, required): The target ID

### `list_findings` (~95 tokens)

List Findings

List findings (discovered issues) across your targets. Filter by status, severity, or target. Returns title, severity, status, test name, and AI enrichment if available.

Input parameters:

- `limit` (number): Max number of findings to return
- `severity` (string): Filter by severity
- `status` (string): Filter by finding status (default: OPEN)
- `targetId` (string): Filter by target ID

### `get_finding` (~38 tokens)

Get Finding Details

Get full details of a specific finding, including evidence, AI analysis, and recommended fix.

Input parameters:

- `findingId` (string, required): The finding ID

### `list_incidents` (~75 tokens)

List Incidents

List incidents (grouped operational issues) across your targets. Filter by status. Returns title, severity, status, findings count, and deployment correlation.

Input parameters:

- `limit` (number): Max number of incidents to return
- `status` (string): Filter by incident status
- `targetId` (string): Filter by target ID

### `get_incident` (~38 tokens)

Get Incident Details

Get full details of a specific incident including linked findings, AI analysis, and deployment correlation.

Input parameters:

- `incidentId` (string, required): The incident ID

### `list_runs` (~94 tokens)

List Runs

List recent test runs. Filter by target, status, or test slug. Returns run status, score, summary, duration, and finding count.

Input parameters:

- `limit` (number): Max number of runs to return
- `status` (string): Filter by run status
- `targetId` (string): Filter by target ID
- `testSlug` (string): Filter by test definition slug (e.g. "security-headers")

### `get_run` (~40 tokens)

Get Run Details

Get full details of a specific test run including metrics, score, summary, errors, and associated findings.

Input parameters:

- `runId` (string, required): The run ID

### `active_runs` (~41 tokens)

Active Runs

Get currently running and queued tests across all targets. Useful for checking what tests are in progress right now.

Input parameters:

- `targetId` (string): Filter by target ID

### `team_stats` (~74 tokens)

Team Statistics

Get team-wide overview statistics: total runs, pass rate, open findings, open incidents, average duration. Supports lifetime, monthly, or weekly periods.

Input parameters:

- `period` (string): Period filter: "lifetime", "2026-04" (monthly), or "2026-W14" (weekly). Defaults to lifetime.

### `target_stats` (~80 tokens)

Target Statistics

Get statistics for a specific target: runs, pass rate, findings, duration. Supports lifetime, monthly, or weekly periods.

Input parameters:

- `period` (string): Period filter: "lifetime", "2026-04" (monthly), or "2026-W14" (weekly). Defaults to lifetime.
- `targetId` (string, required): The target ID

### `daily_trends` (~70 tokens)

Daily Trends

Get daily time-series data for runs, findings, and average duration. Useful for identifying trends over time. Returns up to 90 days of data.

Input parameters:

- `days` (number): Number of days of history to return
- `targetId` (string): Filter by target ID (omit for team-wide)

### `get_site_map` (~108 tokens)

Get Site Map

Get the latest crawl snapshot for a target. Returns page inventory stats, SEO issues, broken pages/assets, response times, and a diff against the previous crawl. Optionally include page-level details.

Input parameters:

- `includePages` (boolean): Include individual page data (can be large). Default: false.
- `pageLimit` (number): Max pages to return when includePages is true
- `pageStatus` (string): Filter pages by status
- `targetId` (string, required): The target ID

### `list_maintenance_windows` (~38 tokens)

List Maintenance Windows

List maintenance windows for a target. Shows scheduled and recurring maintenance periods that suppress alerts.

Input parameters:

- `targetId` (string, required): The target ID

### `list_tests` (~72 tokens)

List Test Definitions

List all available test definitions (plugins). Shows slug, name, category, runner type, weight class, schedule, and enablement status. Useful for knowing which tests can be triggered.

Input parameters:

- `category` (string): Filter by test category
- `enabledOnly` (boolean): Only show enabled tests. Default: true.

### `trigger_test` (~94 tokens)

Trigger Test

Run a specific test against a target. Specify either the test definition ID or slug. The test is queued and executed asynchronously — use get_run to check status.

Input parameters:

- `targetId` (string, required): The target ID to test
- `testId` (string): Test definition ID (use this or testSlug)
- `testSlug` (string): Test slug e.g. "security-headers" (use this or testId)

### `trigger_all_tests` (~55 tokens)

Trigger All Tests

Run all enabled tests against a target as a scan workflow. All tests in the target's test profile are queued. Returns the workflow ID and list of queued runs.

Input parameters:

- `targetId` (string, required): The target ID to scan

### `acknowledge_incident` (~47 tokens)

Acknowledge Incident

Acknowledge an open incident to signal that someone is looking at it. Changes status from OPEN to ACKNOWLEDGED.

Input parameters:

- `incidentId` (string, required): The incident ID to acknowledge

### `resolve_incident` (~43 tokens)

Resolve Incident

Resolve an incident to mark it as handled. Changes status to RESOLVED and sets the closed timestamp.

Input parameters:

- `incidentId` (string, required): The incident ID to resolve

### `mute_finding` (~43 tokens)

Mute Finding

Mute an open finding to suppress it from dashboards and alerts. Status changes from OPEN to MUTED.

Input parameters:

- `findingId` (string, required): The finding ID to mute

### `create_maintenance_window` (~173 tokens)

Create Maintenance Window

Schedule a maintenance window for a target. During maintenance, alerts and notifications are suppressed. Supports one-time, daily, and weekly recurring windows.

Input parameters:

- `description` (string): Optional description
- `endsAt` (string, required): End time as ISO 8601 string, e.g. "2026-04-05T04:00:00Z"
- `isRecurring` (boolean): Whether this window repeats
- `name` (string, required): Name for the window, e.g. "Weekly deploy"
- `recurrence` (string): Recurrence pattern (required if isRecurring is true)
- `startsAt` (string, required): Start time as ISO 8601 string, e.g. "2026-04-05T02:00:00Z"
- `targetId` (string, required): The target ID

### `delete_maintenance_window` (~45 tokens)

Delete Maintenance Window

Remove a scheduled maintenance window.

Input parameters:

- `targetId` (string, required): The target ID (for access verification)
- `windowId` (string, required): The maintenance window ID to delete

### `record_deployment` (~130 tokens)

Record Deployment

Record a deployment event for a target. Deployments are auto-correlated with incidents created within 20 minutes. Useful for tracking releases and root-cause analysis.

Input parameters:

- `commitSha` (string): Git commit SHA
- `deployedBy` (string): Who deployed (name, email, or system)
- `description` (string): Deployment description or changelog
- `environment` (string): Environment, e.g. "production", "staging"
- `targetId` (string, required): The target ID
- `version` (string): Version string, e.g. "v2.4.1"

### `recompute_scores` (~54 tokens)

Recompute Composite Scores

Force recompute all composite scores (Security, SEO, Performance, Accessibility) for a target. Useful after manual changes or when scores seem stale.

Input parameters:

- `targetId` (string, required): The target ID to recompute scores for

### `list_automation_rules` (~62 tokens)

List Automation Rules

List all automation rules for the team. Rules automatically react to events (test failures, incidents, downtime) with configurable actions (escalate severity, suppress, rerun, webhook, notify).

Input parameters:

- `enabled` (boolean): Filter by enabled/disabled status

### `get_automation_rule` (~31 tokens)

Get Automation Rule

Get full details of a specific automation rule.

Input parameters:

- `ruleId` (string, required): The automation rule ID

### `create_automation_rule` (~149 tokens)

Create Automation Rule

Create an automation rule that reacts to events. Triggers: TEST_FAILED, TEST_RECOVERED, INCIDENT_CREATED, INCIDENT_RESOLVED, TARGET_DOWN, TARGET_RECOVERED. Actions: escalate (change severity), suppress (mute), rerun (schedule retry), notify, webhook, add_note.

Input parameters:

- `actions` (array, required): Actions to execute when triggered
- `conditions` (object): Optional conditions that must be met
- `name` (string, required): Rule name
- `priorityOrder` (integer): Priority order (lower = evaluated first)
- `targetId` (string): Optional target ID to scope rule to a specific target
- `trigger` (string, required): Event that triggers the rule

### `update_automation_rule` (~119 tokens)

Update Automation Rule

Update an existing automation rule. Any field not provided will remain unchanged.

Input parameters:

- `actions` (array): Updated actions
- `conditions` (object): Updated conditions
- `isEnabled` (boolean): Enable or disable the rule
- `name` (string): Updated rule name
- `priorityOrder` (integer): Updated priority order
- `ruleId` (string, required): The automation rule ID to update
- `targetId` (string|null): Updated target scope (null to remove target scoping)
- `trigger` (string): Updated trigger event

### `delete_automation_rule` (~31 tokens)

Delete Automation Rule

Permanently delete an automation rule.

Input parameters:

- `ruleId` (string, required): The automation rule ID to delete

### `list_journeys` (~67 tokens)

List Journeys

List custom browser test flows (journeys) for a target or all team targets. Journeys are multi-step Playwright tests that verify user flows like checkout, login, and search.

Input parameters:

- `targetId` (string): Filter by target ID. If omitted, lists all team journeys.

### `get_journey` (~31 tokens)

Get Journey

Get full details of a specific journey including all steps.

Input parameters:

- `journeyId` (string, required): The journey ID

### `create_journey` (~147 tokens)

Create Journey

Create a custom browser test flow for a target. Steps are executed sequentially in a Playwright browser. Supports actions: navigate, click, type, fill, select, assert, wait, screenshot, scroll, hover, use_fragment. Variables like {{LOGIN_EMAIL}} are resolved from the target secrets vault.

Input parameters:

- `description` (string): Journey description
- `name` (string, required): Journey name
- `platform` (string): Platform tag (e.g. "shopify", "woocommerce")
- `steps` (array, required): Ordered list of browser actions
- `targetId` (string, required): Target ID to create the journey for
- `timeoutSeconds` (number): Max execution time in seconds

### `update_journey` (~98 tokens)

Update Journey

Update a journey's name, settings, or steps. When steps are provided, all existing steps are replaced.

Input parameters:

- `description`: Updated description
- `isEnabled` (boolean): Enable or disable the journey
- `journeyId` (string, required): The journey ID to update
- `name` (string): Updated name
- `steps` (array): Replacement steps (replaces all existing steps)
- `timeoutSeconds` (number): Updated timeout

### `delete_journey` (~32 tokens)

Delete Journey

Permanently delete a journey and all its steps.

Input parameters:

- `journeyId` (string, required): The journey ID to delete

### `trigger_journey` (~47 tokens)

Trigger Journey

Execute a journey (custom browser test flow) against its target. The journey runs asynchronously — use get_run to check progress.

Input parameters:

- `journeyId` (string, required): The journey ID to trigger

### `list_scheduled_reports` (~31 tokens)

List Scheduled Reports

List all scheduled reports for the team. Reports are automatically generated and emailed on a daily or weekly basis.

### `create_scheduled_report` (~117 tokens)

Create Scheduled Report

Create a new scheduled email report. Reports include run stats, open findings, composite scores, and per-target status.

Input parameters:

- `dayOfWeek` (number): Day of week for WEEKLY reports (0=Sunday, 1=Monday, ..., 6=Saturday)
- `frequency` (string): How often to send
- `hourUtc` (number): Hour in UTC to send the report
- `name` (string): Report name
- `recipients` (string): Comma-separated email addresses. Empty = all team members.

### `update_scheduled_report` (~103 tokens)

Update Scheduled Report

Update an existing scheduled report. Any field not provided stays unchanged.

Input parameters:

- `dayOfWeek` (number): Updated day of week
- `enabled` (boolean): Enable or disable the report
- `frequency` (string): Updated frequency
- `hourUtc` (number): Updated hour UTC
- `name` (string): Updated name
- `recipients` (string): Updated comma-separated email list
- `reportId` (string, required): The scheduled report ID to update

### `delete_scheduled_report` (~31 tokens)

Delete Scheduled Report

Permanently delete a scheduled report.

Input parameters:

- `reportId` (string, required): The scheduled report ID to delete

### `get_team_settings` (~40 tokens)

Get Team Settings

Get the team's configuration including AI enrichment, uptime monitoring, severity escalation, run policies, notification coalescing, SEO, and Kloner Tasks integration settings.

### `update_team_settings` (~422 tokens)

Update Team Settings

Update team configuration. All fields are optional — only provided fields are changed. Covers: AI enrichment (model, temperature, auto-enrich, spending cap), uptime (timeout, thresholds), severity escalation (recurrence/age triggers), run policies (concurrency, timeouts), SEO (rank tracking, keyword strategy), notification coalescing (digest), and the kill switch (testsPaused).

Input parameters:

- `aiAutoEnrich` (boolean): Auto-enrich new findings with AI
- `aiCapAction` (string): Action when cap is reached
- `aiEnabled` (boolean): Enable/disable AI finding enrichment
- `aiModel` (string): OpenAI model for finding enrichment (e.g. gpt-4o-mini)
- `aiMonthlyCapUsd`: Monthly AI spending cap in USD (null = unlimited)
- `aiSourceReviewModel` (string): Model for AI source review plugin
- `defaultRunTimeoutMs` (number): Default run timeout in ms
- `defaultScheduleMultiplier` (number): Schedule frequency multiplier (< 1 = more frequent)
- `digestEnabled` (boolean): Enable notification alert coalescing
- `digestWindowSeconds` (number): Digest window duration in seconds
- `escalateInfoAgeDays` (number): Finding age in days before INFO→WARNING
- `escalateInfoRecurrence` (number): Finding recurrences before INFO→WARNING
- `escalateWarningAgeDays` (number): Finding age in days before WARNING→CRITICAL
- `escalateWarningRecurrence` (number): Finding recurrences before WARNING→CRITICAL
- `maxConcurrentRunsPerTarget` (number): Max concurrent test runs per target
- `seoRankCheckEnabled` (boolean): Enable Google rank tracking
- `testsPaused` (boolean): Kill switch — pauses ALL scheduled and manual test runs
- `uptimeDegradedThresholdMs` (number): Response time threshold for DEGRADED status
- `uptimeFailThreshold` (number): Consecutive failures before DOWN
- `uptimePingTimeoutMs` (number): Uptime ping timeout in ms

### `list_notification_rules` (~29 tokens)

List Notification Rules

List all notification alert rules for the team. Rules map event types + severity levels to notification channels.

### `create_notification_rule` (~139 tokens)

Create Notification Rule

Create a notification alert rule. Defines which events at which severity levels trigger notifications on which channels. Supports quiet hours and per-target scoping.

Input parameters:

- `channelTypes` (array, required): Channels to notify
- `enabled` (boolean): Whether the rule is active
- `eventTypes` (array, required): Events that trigger this rule
- `name` (string, required): Rule name
- `quietHoursEnd` (number): Quiet hours end (hour UTC)
- `quietHoursStart` (number): Quiet hours start (hour UTC)
- `severities` (array): Only trigger for these severities
- `targetId` (string): Scope to a specific target

### `update_notification_rule` (~84 tokens)

Update Notification Rule

Update a notification rule. Only provided fields are changed.

Input parameters:

- `channelTypes` (array)
- `enabled` (boolean)
- `eventTypes` (array)
- `name` (string)
- `quietHoursEnd`
- `quietHoursStart`
- `ruleId` (string, required): The notification rule ID
- `severities` (array)

### `delete_notification_rule` (~30 tokens)

Delete Notification Rule

Permanently delete a notification rule.

Input parameters:

- `ruleId` (string, required): The notification rule ID to delete

### `list_notification_channels` (~38 tokens)

List Notification Channels

List all notification channels (Email, Slack, Webhook, SMS, Web Push) configured for the team. Sensitive config values are redacted.

### `list_keywords` (~40 tokens)

List Target Keywords

List all SEO keywords tracked for a target, including latest Google rank position. Max 50 per target.

Input parameters:

- `targetId` (string, required): The target ID

### `add_keyword` (~82 tokens)

Add Keyword

Add an SEO keyword to track for a target. Max 50 keywords per target.

Input parameters:

- `isPrimary` (boolean): Mark as primary keyword
- `keyword` (string, required): The keyword to track
- `pageScope` (string): URL pathname pattern to scope the keyword to (e.g. /kategori/*)
- `targetId` (string, required): The target ID

### `remove_keyword` (~44 tokens)

Remove Keyword

Remove an SEO keyword from a target.

Input parameters:

- `keywordId` (string, required): The keyword ID to remove
- `targetId` (string, required): The target ID (for access verification)

### `start_load_test` (~181 tokens)

Start Load Test

Start a load test against a target. Max 100 concurrent connections, max 5 min duration, 1 test at a time per target, 60s cooldown between tests. Modes: HTTP_FLOOD (autocannon), BROWSER_USERS (Playwright), COMBINED (both). OWNER/ADMIN only.

Input parameters:

- `acknowledgeSharedOrigin` (boolean): Acknowledge blast radius if target shares a server with other monitored sites
- `concurrency` (number): Number of concurrent connections
- `duration` (number): Test duration in seconds
- `httpMethod` (string): HTTP method
- `mode` (string): Load test mode
- `rampUp` (number): Ramp-up time in seconds
- `targetId` (string, required): The target ID to load test
- `targetUrl` (string): Override URL (defaults to target URL)

### `cancel_load_test` (~32 tokens)

Cancel Load Test

Cancel a running load test.

Input parameters:

- `loadTestRunId` (string, required): The load test run ID to cancel

### `get_load_test` (~34 tokens)

Get Load Test Results

Get details and results of a load test run.

Input parameters:

- `loadTestRunId` (string, required): The load test run ID

### `list_load_tests` (~38 tokens)

List Load Test History

List recent load test runs for a target.

Input parameters:

- `limit` (number): Max results
- `targetId` (string, required): The target ID

### `list_secrets` (~70 tokens)

List Target Secrets

List secrets stored in a target's vault. Values are masked — only key names and labels are shown. Secrets are used by test plugins (e.g. LOGIN_EMAIL, LOGIN_PASSWORD for B2B shops, ga4_service_account for GA4).

Input parameters:

- `targetId` (string, required): The target ID

### `store_secret` (~120 tokens)

Store Secret

Store an encrypted secret in a target's vault. Common keys: LOGIN_EMAIL, LOGIN_PASSWORD (B2B shop auth), ga4_service_account (GA4 monitoring). Values are AES-256-GCM encrypted at rest.

Input parameters:

- `description` (string): Optional description
- `environment` (string): Environment scope
- `key` (string, required): Secret key (e.g. LOGIN_EMAIL)
- `label` (string, required): Human-readable label
- `targetId` (string, required): The target ID
- `value` (string, required): Secret value (will be encrypted)

### `rotate_secret` (~55 tokens)

Rotate Secret

Update the value of an existing secret.

Input parameters:

- `newValue` (string, required): New secret value
- `secretId` (string, required): The secret ID to rotate
- `targetId` (string, required): The target ID (for access verification)

### `delete_secret` (~47 tokens)

Delete Secret

Permanently delete a secret from a target's vault.

Input parameters:

- `secretId` (string, required): The secret ID to delete
- `targetId` (string, required): The target ID (for access verification)

### `list_page_fragments` (~50 tokens)

List Page Fragments

List all reusable page fragments for the team. Fragments are shared step sequences (e.g. "Login", "Dismiss Cookies") that can be inserted into multiple Journeys via the use_fragment action.

### `create_page_fragment` (~65 tokens)

Create Page Fragment

Create a reusable step sequence that can be shared across multiple Journeys. Fragment names must be unique per team.

Input parameters:

- `description` (string): Fragment description
- `name` (string, required): Fragment name (unique per team)
- `steps` (array, required): Ordered list of browser actions

### `update_page_fragment` (~59 tokens)

Update Page Fragment

Update a page fragment. When steps are provided, all existing steps are replaced.

Input parameters:

- `description`
- `fragmentId` (string, required): The fragment ID
- `name` (string): Updated name
- `steps` (array): Replacement steps

### `delete_page_fragment` (~29 tokens)

Delete Page Fragment

Permanently delete a page fragment.

Input parameters:

- `fragmentId` (string, required): The fragment ID to delete

### `create_target` (~197 tokens)

Create Target

Add a new website, API, or webshop target for monitoring with full onboarding. Automatically enables compatible tests, triggers an initial scan, and captures a page screenshot. Requires write scope (Free plan: 1 target). Use analyze_target first to detect platform and get test recommendations.

Input parameters:

- `environment` (string): Deployment environment
- `name` (string, required): Display name for the target
- `tags` (array): Optional tags for categorization
- `type` (string, required): Target type: WEBSITE, API, or WEBSHOP. Use analyze_target to auto-detect.
- `uptimeEnabled` (boolean): Enable background uptime monitoring
- `url` (string, required): URL to monitor, e.g. "https://example.com"
- `weight` (string): Business weight, used to rank findings by consequence: REVENUE_PATH (checkout, payment, signup), PUBLIC (customer-visible but not transactional), INTERNAL (staging, admin tooling).

### `update_target` (~198 tokens)

Update Target

Update a target's properties (name, URL, type, environment, business weight, tags, uptime toggle).

Input parameters:

- `environment` (string): New environment
- `name` (string): New display name
- `tags` (array): New tags (replaces existing)
- `targetId` (string, required): The target ID to update
- `type` (string): New target type
- `uptimeEnabled` (boolean): Toggle uptime monitoring
- `uptimeKeyword`: Keyword to verify in response body during uptime checks. When set, every uptime ping GETs the page and verifies this text appears (case-insensitive). If missing, the site is treated as DOWN even on H…
- `url` (string): New URL
- `weight` (string): New business weight: REVENUE_PATH, PUBLIC or INTERNAL. Changing this rescores the target's open findings so the consequence ranking updates immediately.

### `delete_target` (~58 tokens)

Delete Target

Permanently delete a target and all its associated data (runs, findings, incidents, artifacts). This cannot be undone.

Input parameters:

- `confirm` (boolean, required): Must be true to confirm deletion
- `targetId` (string, required): The target ID to delete

### `analyze_target` (~94 tokens)

Analyze Target

Fingerprint a URL and get test recommendations before creating a target. Detects platform (Shopify, WordPress, etc.), CDN, server stack, frontend framework, analytics, and B2B/ecommerce signals. Returns recommended tests with explanations. Use this before create_target to know what type to assign and which tests will be enabled.

Input parameters:

- `url` (string, required): URL to analyze, e.g. "https://example.com"

### `import_targets` (~60 tokens)

Import Targets

Bulk import up to 100 websites for monitoring. Each URL gets a target created with auto-enabled tests, initial scan, and screenshot capture. Partial success — failed URLs are reported individually without blocking others.

Input parameters:

- `items` (array, required): Array of targets to import

### `create_muting_rule` (~192 tokens)

Create Muting Rule

Create a rule to auto-mute findings matching a pattern. Existing open findings matching the rule are muted immediately. Supports muting by fingerprint pattern, test definition, or test+target combination.

Input parameters:

- `expiresAt` (string): Optional expiry as ISO 8601 string. Rule auto-expires after this time.
- `fingerprintPattern` (string): Substring to match in finding fingerprints (required for FINGERPRINT scope)
- `reason` (string): Reason for muting
- `scope` (string, required): FINGERPRINT: match by finding fingerprint substring. TEST_DEFINITION: mute all findings from a test. TEST_TARGET: mute findings from a specific test on a specific target.
- `targetId` (string): Target ID to scope the rule to (required for TEST_TARGET, optional for others)
- `testDefinitionId` (string): Test definition ID (required for TEST_DEFINITION and TEST_TARGET scopes)

### `system_health` (~41 tokens)

System Health

Get a comprehensive system health report: BullMQ queue depths, active/stuck runs, user sessions, notification delivery stats, and recent error counts. Requires admin scope.

### `update_test` (~90 tokens)

Update Test Definition

Enable or disable a test definition globally, or update its schedule/timeout. Requires admin scope.

Input parameters:

- `defaultSchedule` (string): Cron schedule (e.g. "0 */6 * * *")
- `enabled` (boolean): Enable or disable the test globally
- `slug` (string, required): Test plugin slug (e.g. "http-protocol-check")
- `timeout` (number): Timeout in milliseconds

### `enable_all_tests` (~51 tokens)

Enable All Tests

Enable all test definitions globally. Optionally filter by category to only enable tests in that category. Requires admin scope.

Input parameters:

- `category` (string): Only enable tests in this category. Omit to enable all.

### `disable_all_tests` (~51 tokens)

Disable All Tests

Disable all test definitions globally. Optionally filter by category to only disable tests in that category. Requires admin scope.

Input parameters:

- `category` (string): Only disable tests in this category. Omit to disable all.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp#diagnostics

## Score history

- 2026-08-20: 66
- 2026-08-19: 66
- 2026-08-18: 66
- 2026-08-17: 65
- 2026-08-16: 65
- 2026-08-15: 64
- 2026-08-14: 63
- 2026-08-13: 63
- 2026-08-12: 63
- 2026-08-11: 62
- 2026-08-10: 61

## Links

- Remote endpoint: https://api.teste.no/api/mcp
- Website: https://validoria.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-validoria-validoria-mcp/api-mcp