io.speedvault/mcp
NPM · @SPEEDVAULT/MCP · SCANNED SEP 24
Run web performance audits, get code-level fixes, crawl for SEO, and read real-user Core Web Vitals.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 107 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability88
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1950 tokens (~97/item across 20 items; 18 tools + 2 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.speedvault/mcp server?
io.speedvault/mcp runs locally as an npm package, launched with npx -y @speedvault/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @speedvault/mcp
claude mcp add io-speedvault-mcp -- npx -y @speedvault/mcp
{
"mcpServers": {
"io-speedvault-mcp": {
"command": "npx",
"args": [
"-y",
"@speedvault/mcp"
]
}
}
} {
"servers": {
"io-speedvault-mcp": {
"command": "npx",
"args": [
"-y",
"@speedvault/mcp"
]
}
}
} codex mcp add io-speedvault-mcp -- npx -y @speedvault/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-speedvault-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@speedvault/mcp"
],
"enabled": true
}
}
} openclaw mcp add io-speedvault-mcp --command npx --arg -y --arg @speedvault/mcp
mcp_servers:
io-speedvault-mcp:
command: "npx"
args: ["-y", "@speedvault/mcp"] {
"McpServers": {
"io-speedvault-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@speedvault/mcp"
]
}
}
} assistant mcp add io-speedvault-mcp -t stdio -c npx -a -y @speedvault/mcp
{
"mcpServers": {
"io-speedvault-mcp": {
"command": "npx",
"args": [
"-y",
"@speedvault/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Sept 26 −3
- Stability: pass → 0.80 functional
- 22 Sept 26 0
- Stability: 0.97 → pass security
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed npm/@speedvault/mcp@1.0.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
account_status Account status ~25
Show your plan, remaining API credits, rate limit, and per-product entitlements.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| apiCreditsRemaining | number|null | – | Remaining API credits. |
| entitlements | object | – | Per-product entitlements (Metrix, AI Fixes, Audit/Crawl, RUM, Monitor). |
| plan | string | – | The account plan name. |
| rateLimit | object | – | Rate limit: requests per window. |
No examples provided.
add_domain Add a domain ~85
Register a new domain. Returns a verification token and instructions (meta tag or DNS TXT record). After adding, call verify_domain to prove ownership. A verified domain is required before you can crawl, monitor, or add RUM.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The domain to add, e.g. "example.com". |
| label | string | – | An optional label for the domain. |
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | The registered domain. |
| domainId | string | – | The id of the registered domain; pass to verify_domain. |
| instructions | object | – | Ownership-proof options: a meta tag and a DNS TXT record. |
| status | string | – | Verification status (e.g. pending). |
No examples provided.
compare_runs Compare two audit runs ~94
Return a structured diff of two completed audits: delta per metric (perf_score, LCP, FCP, TBT, CLS, SI, page_bytes, total_requests) with improved/regressed flags. Use this to see how a change affected performance before and after.
| Name | Type | Req | Description |
|---|---|---|---|
| auditId1 | string | yes | The first (before) audit id. |
| auditId2 | string | yes | The second (after) audit id. |
| Name | Type | Req | Description |
|---|---|---|---|
| auditId1 | string | yes | The first (before) audit id. |
| auditId2 | string | yes | The second (after) audit id. |
| metrics | object | – | Per-metric diff (perf_score, lcp, fcp, tbt, cls, speed_index, page_bytes, total_requests, …). |
| urlA | string | – | URL of the first audit. |
| urlB | string | – | URL of the second audit. |
No examples provided.
crawl_site Crawl a whole site (SpeedVault Audit) ~159
Start a full-site crawl that aggregates SEO + structure issues across pages (grouped by category/template) and computes a site score. Costs 1 credit. Returns a crawlId; poll with get_crawl (wait=true) to get the grouped issues once it finishes. NOTE: the domain must be verified first — use list_domains / add_domain / verify_domain.
| Name | Type | Req | Description |
|---|---|---|---|
| maxPages | integer | – | Cap pages crawled (clamped to your plan). |
| timeout | integer | – | Max seconds to wait when wait=true (default 120). |
| url | string | yes | The site root or any page on the site to crawl from. |
| wait | boolean | – | Wait for completion and return grouped issues (default false; crawls can be long). |
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | – | The crawl id; poll with get_crawl. |
| issues | object | – | Issue counts by severity. |
| pagesCrawled | number | – | Number of pages crawled. |
| score | number|null | – | Aggregate site score 0–100. |
| status | string | – | Crawl status: crawling, done, or error. |
| templates | array | – | Per-template issue breakdown (most-affected first). |
| url | string | – | The site/page the crawl started from. |
No examples provided.
create_monitor Create a scheduled monitor ~172
Add a URL to scheduled monitoring so SpeedVault re-audits it on a cadence and tracks regressions. Slot-limited by plan. NOTE: the domain must be verified first — use list_domains / add_domain / verify_domain.
| Name | Type | Req | Description |
|---|---|---|---|
| checkFrequency | string | – | How often to re-audit the URL (default daily). |
| device | string | – | Emulated device for the scheduled audit (default desktop). |
| label | string | – | An optional human-friendly label for this monitor (e.g. "Pricing page"). |
| location | string | – | Test region for the scheduled audit, e.g. "eu-west", "us-east", "ap-southeast". |
| url | string | yes | The absolute URL to monitor, e.g. https://example.com/pricing. Its domain must be verified first. |
| Name | Type | Req | Description |
|---|---|---|---|
| checkFrequency | string | – | The cadence the monitor runs at. |
| monitorId | string | – | The id of the newly created monitor. |
| url | string | – | The URL now under monitoring. |
No examples provided.
get_audit Get an audit ~78
Fetch a previously-started audit by id. Set wait=true to block until it completes.
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | yes | The audit id returned by run_audit. |
| timeout | integer | – | Max seconds to wait when wait=true (default 120). |
| wait | boolean | – | Block until the audit completes before returning (default false). |
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | – | The audit id. |
| cls | number|null | – | Cumulative Layout Shift (unitless). |
| fcpMs | number|null | – | First Contentful Paint in milliseconds. |
| lcpMs | number|null | – | Largest Contentful Paint in milliseconds. |
| pageBytes | number|null | – | Total page weight in bytes. |
| performanceScore | number|null | – | Lighthouse performance score 0–100. |
| requests | number|null | – | Total number of network requests. |
| speedIndexMs | number|null | – | Speed Index in milliseconds. |
| state | string | – | Audit state: queued, running, complete, or error. |
| structureScore | number|null | – | Structure (best-practices) score 0–100. |
| tbtMs | number|null | – | Total Blocking Time in milliseconds. |
| topOpportunities | array | – | Top prioritized improvement opportunities. |
| url | string | – | The URL that was audited. |
No examples provided.
get_crawl Get a site crawl ~82
Fetch a crawl by id with its score and grouped issues. wait=true blocks until done.
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | yes | The crawl id returned by crawl_site (or recheck_template). |
| timeout | integer | – | Max seconds to wait when wait=true (default 120). |
| wait | boolean | – | Block until the crawl completes before returning (default false). |
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | – | The crawl id; poll with get_crawl. |
| issues | object | – | Issue counts by severity. |
| pagesCrawled | number | – | Number of pages crawled. |
| score | number|null | – | Aggregate site score 0–100. |
| status | string | – | Crawl status: crawling, done, or error. |
| templates | array | – | Per-template issue breakdown (most-affected first). |
| url | string | – | The site/page the crawl started from. |
No examples provided.
get_fix_suggestions Get fix suggestions (performance, SEO, or media) ~223
Return prioritized, ACTIONABLE fixes. Two modes: • Performance: pass auditId (a completed run_audit). Each fix has the issue, impact, how to fix it, a code snippet where useful, and estimated savings. • SEO/media: pass crawlId (a completed crawl_site), optionally narrowed with issue_type (e.g. "description-missing", "next-gen-images", "image-alt-missing"). Each fix reports how many pages are affected, example URLs, how to fix it, and a ready-to-apply snippet (e.g. <picture>/WebP, <meta name="description">, alt="", unique <title>). This is what you apply to improve scores. Cached perf fixes are free; a fresh AI generation may cost credits.
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | – | A completed audit id (performance fixes). |
| crawlId | string | – | A completed crawl id (site-wide SEO + media fixes). |
| issue_type | string | – | With crawlId: target one issue group, e.g. "next-gen-images". |
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | – | The audit id (performance mode). |
| count | number | yes | Number of fixes returned. |
| crawlId | string | – | The crawl id (SEO/media mode). |
| fixes | array | yes | The actionable fixes to apply. |
| issueType | string | – | The issue_type filter that was applied (SEO mode). |
| mode | string | yes | Which fix mode produced these results. |
| note | string | – | An optional note when no fixes are available. |
| source | string | – | Where the fixes came from (e.g. cache or ai). |
No examples provided.
get_rum Get real-user Core Web Vitals (RUM) ~116
Return field (real-user) Core Web Vitals for a registered RUM site: p75 LCP/INP/CLS/FCP/TTFB with ratings, sample counts, and trends. Use list of sites from account first if you do not know the siteKey (call get_rum with no siteKey to list sites).
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look-back window in days (default 7). |
| siteKey | string | – | The RUM site key. Omit to list your RUM sites instead. |
| Name | Type | Req | Description |
|---|---|---|---|
| metrics | object | – | Field Core Web Vitals keyed by metric (lcp, inp, cls, fcp, ttfb) with p75 + sample count. |
| mode | string | yes | Whether a site list or a single-site summary was returned. |
| siteKey | string | – | The RUM site key (summary mode). |
| sites | array | – | Registered RUM sites (list mode). |
| totalSamples | number | – | Total real-user samples in the window. |
| windowDays | number | – | Look-back window in days (summary mode). |
No examples provided.
get_rum_embed Get the RUM beacon install snippet ~66
Return the <script> beacon snippet to install SpeedVault RUM on a site, so an agent building an app can wire up real-user Core Web Vitals collection. Paste it into the <head>.
| Name | Type | Req | Description |
|---|---|---|---|
| siteKey | string | yes | The RUM site key to install. |
| Name | Type | Req | Description |
|---|---|---|---|
| instructions | string | – | Human-readable install instructions. |
| siteKey | string | yes | The RUM site key the snippet is for. |
| snippet | string | – | The <script> beacon snippet to paste into <head>. |
No examples provided.
get_seo_fixes Get SEO fix recipes for a crawl ~97
Return actionable fix recipes for a completed site crawl. Each fix includes the issue, impact, how to fix it, a code snippet, and before/after showing the exact code change. Optionally narrow to one issue_type (e.g. "description-missing", "next-gen-images").
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | yes | A completed crawl id from crawl_site. |
| issue_type | string | – | Narrow to one issue type. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of fixes returned. |
| crawlId | string | yes | The crawl id these fixes belong to. |
| fixes | array | yes | The SEO fix recipes (with before/after where available). |
| issueType | string | – | The issue_type filter that was applied, if any. |
No examples provided.
get_seo_issues Get per-template SEO issues from a crawl ~93
Return the per-template issue breakdown from a completed site crawl. Shows each template (e.g. /products/:slug) with its page count and the SEO issues affecting it, including prevalence ("142 of 312 product pages have missing meta description") and priority scores. Use this after crawl_site to understand which templates need the most work.
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | yes | A completed crawl id from crawl_site. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of templates returned. |
| crawlId | string | yes | The crawl id these templates belong to. |
| templates | array | yes | Per-template issue breakdown. |
No examples provided.
list_audits List recent audits ~38
List the most recent audits run via the API for this account.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many to return (default 25). |
| Name | Type | Req | Description |
|---|---|---|---|
| audits | array | yes | Recent audits with id, URL, state, and performance score. |
| count | number | yes | Number of audits returned. |
No examples provided.
list_domains List verified domains ~46
List your domains with their verification status and linked product counts (RUM sites, monitors, analyses). Domains must be verified before you can crawl, monitor, or add RUM to them.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of domains returned. |
| domains | array | yes | Domains with verification status and linked product counts. |
No examples provided.
list_monitors List scheduled monitors ~25
List the URLs under scheduled monitoring (SpeedVault Monitor) with their latest score.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | Number of monitors returned. |
| monitors | array | yes | Scheduled monitors with id, URL, cadence, and latest score. |
No examples provided.
recheck_template Re-crawl a site (recheck after fixes) ~102
Trigger a re-crawl of a site that was previously crawled. Use this after applying SEO fixes from get_seo_fixes to verify improvements. Returns a new crawlId. Costs 1 credit.
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | yes | The original crawl id to re-crawl. |
| timeout | integer | – | Max seconds to wait when wait=true (default 120). |
| wait | boolean | – | Wait for the re-crawl to complete (default false). |
| Name | Type | Req | Description |
|---|---|---|---|
| crawlId | string | – | The NEW crawl id created by the re-crawl. |
| pagesCrawled | number | – | Number of pages crawled (once done). |
| score | number|null | – | Aggregate site score 0–100 (once done). |
| status | string | – | Crawl status: crawling, done, or error. |
| templates | array | – | Per-template issue breakdown (once done). |
| url | string | – | The site/page being re-crawled. |
No examples provided.
run_audit Run a performance audit (SpeedVault Metrix) ~211
Run a single-page Lighthouse performance audit on a URL and (by default) wait for it to complete, returning scores (performance/structure), Core Web Vitals (LCP/FCP/TBT/CLS/SI), page weight, and the top prioritized opportunities. Use this on the page you just built or changed. Costs 1 credit. After this, call get_fix_suggestions with the returned auditId for concrete code fixes.
| Name | Type | Req | Description |
|---|---|---|---|
| connection | string | – | Connection throttling preset. Omit to use the device default. |
| device | string | – | Emulated device (default desktop). |
| location | string | – | Test region: eu-west (Ireland, default), us-east (Virginia), ap-southeast (Singapore). |
| timeout | integer | – | Max seconds to wait when wait=true (default 120). |
| url | string | yes | The absolute URL to audit, e.g. https://example.com/pricing |
| wait | boolean | – | Block until the audit finishes (default true). |
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | – | The audit id; pass to get_fix_suggestions / get_audit / compare_runs. |
| cls | number|null | – | Cumulative Layout Shift (unitless). |
| fcpMs | number|null | – | First Contentful Paint in milliseconds. |
| lcpMs | number|null | – | Largest Contentful Paint in milliseconds. |
| pageBytes | number|null | – | Total page weight in bytes. |
| performanceScore | number|null | – | Lighthouse performance score 0–100. |
| requests | number|null | – | Total number of network requests. |
| speedIndexMs | number|null | – | Speed Index in milliseconds. |
| state | string | – | Audit state: queued, running, complete, or error. |
| structureScore | number|null | – | Structure (best-practices) score 0–100. |
| tbtMs | number|null | – | Total Blocking Time in milliseconds. |
| timedOut | boolean | – | True if the wait window elapsed before completion. |
| topOpportunities | array | – | Top prioritized improvement opportunities. |
| url | string | – | The URL that was audited. |
No examples provided.
verify_domain Verify a domain ~61
Verify ownership of a registered domain by checking for the meta tag or DNS TXT record. On success the domain becomes "active" and you can use it with all SpeedVault products.
| Name | Type | Req | Description |
|---|---|---|---|
| domainId | string | yes | The domain id from list_domains or add_domain. |
| Name | Type | Req | Description |
|---|---|---|---|
| instructions | object | – | Ownership-proof options to retry with if verification failed. |
| method | string | – | The method that verified ownership (meta_tag or dns_txt). |
| status | string | – | Resulting domain status (active when verified). |
| verified | boolean | – | True if ownership was confirmed. |
No examples provided.
What is the io.speedvault/mcp server?
io.speedvault/mcp is listed in the public MCP registry as io.speedvault/mcp. Run web performance audits, get code-level fixes, crawl for SEO, and read real-user Core Web Vitals. This page covers its npm package (@speedvault/mcp).
Is the io.speedvault/mcp server safe to use?
io.speedvault/mcp scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.speedvault/mcp server expose?
io.speedvault/mcp exposes 18 tools: run_audit, get_audit, list_audits, get_fix_suggestions, crawl_site, and 13 more. Their descriptions and schemas cost roughly 1,773 tokens of context every time the server is loaded.
Is the io.speedvault/mcp server still maintained?
io.speedvault/mcp is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.speedvault/mcp server under?
io.speedvault/mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.