online.pageaudit/pageaudit
REMOTE · PAGEAUDIT.ONLINE
Technical SEO, passive security and page-delivery audits with evidence and suggested fixes.
Available components
Last scanned (10 hours ago)
Scores higher than 79% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (track_search_queries). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 10016 tokens (~161/item across 62 items; 62 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management95
- Stability check failed: schema churn in the 30 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 43 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 63 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Tool “add_site” rewrote its description, which is the text the model reads security
- Tool “disconnect_search_console” rewrote its description, which is the text the model reads security
- Tool “search_console” rewrote its description, which is the text the model reads security
- Tool coverage: 89% → 100% ▲ functional
- Server version: cddf9cdf → c11d2e6a functional
- “check_domain” reworded the description of “guest_token” cosmetic
- “create_tab” reworded the description of “guest_token” cosmetic
- “domain_status” reworded the description of “guest_token” cosmetic
- “generate_domain_fix_prompt” reworded the description of “guest_token” cosmetic
- “generate_fix_prompt” reworded the description of “guest_token” cosmetic
- “generate_site_fix_prompt” reworded the description of “guest_token” cosmetic
- “get_audit” reworded the description of “guest_token” cosmetic
- “get_fix_prompt” reworded the description of “guest_token” cosmetic
- “lab_result” reworded the description of “guest_token” cosmetic
- “lab_test” reworded the description of “guest_token” cosmetic
- “list_audit_fix_prompts” reworded the description of “guest_token” cosmetic
- “list_domain_fix_prompts” reworded the description of “guest_token” cosmetic
- “list_site_fix_prompts” reworded the description of “guest_token” cosmetic
- “list_tabs” reworded the description of “guest_token” cosmetic
- “prompt_allowance” reworded the description of “guest_token” cosmetic
- “run_tab” reworded the description of “guest_token” cosmetic
- “tab_history” reworded the description of “guest_token” cosmetic
- 4 Nov 26 +2
- The server rewrote its instructions, which are the text every model session reads security
- The server now declares the “prompts” capability functional
- First check of Schema quality: 100 functional
- New prompt “company_website” functional
- New prompt “website_check” functional
- New prompt “website_fixes” functional
- New prompt “website_monitoring” functional
- New prompt “website_release” functional
- Server version: 5a4f32c1 → cddf9cdf functional
- 3 Nov 26 0
- Tool “generate_domain_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “generate_site_fix_prompt” rewrote its description, which is the text the model reads security
- Server version: 2907948d → 5a4f32c1 functional
- 2 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “audit_url” rewrote its description, which is the text the model reads security
- Tool “generate_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “get_api_x402_audit” rewrote its description, which is the text the model reads security
- Server version: abee796d → 2907948d functional
- 1 Nov 26 0
- Tool “cancel_plan” rewrote its description, which is the text the model reads security
- Server version: b48c6e84 → abee796d functional
- 31 Oct 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- New tool “configure_journeys”, which the server declares destructive security
- Tool “add_site” rewrote its description, which is the text the model reads security
- Tool “ai_search_visibility” rewrote its description, which is the text the model reads security
- Tool “apply_domain_alerts” rewrote its description, which is the text the model reads security
- Tool “audit_site” rewrote its description, which is the text the model reads security
- Tool “audit_url” rewrote its description, which is the text the model reads security
- Tool “check_domain” rewrote its description, which is the text the model reads security
- Tool “configure_domain_dns” rewrote its description, which is the text the model reads security
- Tool “configure_domain_monitor” rewrote its description, which is the text the model reads security
- Tool “contact” rewrote its description, which is the text the model reads security
- Tool “create_tab” rewrote its description, which is the text the model reads security
- Tool “domain_portfolio” rewrote its description, which is the text the model reads security
- Tool “generate_domain_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “generate_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “generate_site_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “get_audit” rewrote its description, which is the text the model reads security
- Tool “get_fix_prompt” rewrote its description, which is the text the model reads security
- Tool “lab_test” rewrote its description, which is the text the model reads security
- Tool “list_audit_fix_prompts” rewrote its description, which is the text the model reads security
- Tool “list_domain_fix_prompts” rewrote its description, which is the text the model reads security
- Tool “list_site_fix_prompts” rewrote its description, which is the text the model reads security
- Tool “preview_domain_alerts” rewrote its description, which is the text the model reads security
- Tool “prompt_allowance” rewrote its description, which is the text the model reads security
- Tool “run_tab” rewrote its description, which is the text the model reads security
- Tool “set_domain_expiry” rewrote its description, which is the text the model reads security
- Tool “watch_tab” rewrote its description, which is the text the model reads security
- Tool “weekly_site_report” rewrote its description, which is the text the model reads security
- Schema quality: 122 → 143 ▼ functional
- Server version: 84f2e158 → b48c6e84 functional
- New tool “billing” functional
- New tool “buy_plan” functional
- New tool “cancel_plan” functional
- New tool “get_api_x402_audit” functional
- New tool “list_plans” functional
- New tool “pricing” functional
- “generate_domain_fix_prompt” added an optional parameter “credit_token” cosmetic
- “generate_fix_prompt” added an optional parameter “credit_token” cosmetic
- “generate_site_fix_prompt” added an optional parameter “credit_token” cosmetic
- “contact” reworded the description of “pagamento” cosmetic
- 30 Oct 26 0
- Server version: 803660fb → 84f2e158 functional
- 29 Oct 26 0
- Server version: a6bda025 → 803660fb functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://pageaudit.online/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=pageaudit.online | CN=YE2,O=Let's Encrypt,C=US | 23 Sept 2026 | 22 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 5f34d6e669846828382b84d52fc17e58e76 |
| SANs: pageaudit.online, www.pageaudit.online | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of pageaudit.online. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| online. | present | 30961 | 13 | Verified |
| pageaudit.online. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains |
| x-content-type-options | nosniff |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://pageaudit.online/mcp | Verified | 200 | |
| http (plaintext) | http://pageaudit.online/mcp | HTTPS enforced | 301 | https://pageaudit.online/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
review_connection Review connection ~165
Requires the account session, current X-Organization-Id and CSRF for writes. Start a TLS review of the saved HTTPS origin using current domain monitoring rights. At most three starts per account and UTC day, one per site. A repeated request reuses today's review. Do not claim complete safety from a partial result. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts per UTC day. Retries return the same review. The scanner samples one public IP, with three stages and a 170-second deadline. Partial results do not establish safety. GET never starts a scan. The shared realtime channel reports stage changes. Reports expire after 26 hours.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Owned tab ID from list_tabs. |
No output schema declared.
No examples provided.
run_tab Run tab ~88
Re-audits the tab's URL. Consumes the same daily allowance as `POST /api/audit` — past it, 402 with `accepts[]`.
| Name | Type | Req | Description |
|---|---|---|---|
| guest_token | string | yes | Private owner token returned by guest creation. Sent in X-Guest-Token; reuse it for this owner's resources. |
| id | string | yes | ID of the tab to re-audit. |
No output schema declared.
No examples provided.
save_ai_search_queries Save ai search queries ~108
Save up to ten searches for the weekly report to track (three without a watch package). Saves use the expected version. Without a current watch package, an account tracks up to three searches. Uses the shared 240 writes per site and UTC day.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site owned by this account. |
| queries | array | yes | One to ten distinct searches, 1 to 128 characters each. |
| version | integer | yes | 0 initially; then the current settings version. |
No output schema declared.
No examples provided.
save_weekly_site_report Save weekly site report ~180
Turn the weekly report of a site on or off and set up to 3 competitors. Turning on needs a watch package in force. Turning on needs a watch package in force and a free site in it (409 with `limit` and `plans` otherwise). The first report runs right away; later ones run a week after the last. A new competitor gets its base this week and its new pages from the next. Saves use the expected version.
| Name | Type | Req | Description |
|---|---|---|---|
| competitors | array | yes | Up to 3 competitor sites (any address; the report reads the origin's /sitemap.xml). |
| id | string | yes | Site owned by this account. |
| paused | boolean | yes | `false` turns the weekly report on; `true` turns it off. |
| version | integer | yes | 0 the first time; then `settings.version`. |
No output schema declared.
No examples provided.
search_console Search console ~277
Read own-site keywords, opportunities at average positions 4–20, up to 20 tracked queries and daily history. Check dates, partial coverage and collection failure before proposing edits. These are not market search volumes. The sample covers 28 days, at most 50 queries and 50 pages. Use queries for keyword research and opportunities for average positions 4–20. The terms array adds daily history and 7-day comparisons for up to 20 selected queries. Coverage is partial: impressions are for this property, not market search volume. Positions are impression-weighted averages, not fixed SERP ranks. Credentials and raw provider responses are not returned. Returns: { available, connected, property, last_attempt_at, last_success_at, next_run_at, error, stale, snapshot{property,period,checked_at,queries,pages,coverage}, opportunities[{query,clicks,impressions,ctr,position}], terms[{query,last_alert_at,analysis,series}] } Example: await fetch("$ORIGIN/api/sites/SITE_ID/search-console").then(r => r.json()); Errors: 401: account_required or session_ended; 403: account_required or invalid_csrf; 404: site_not_found; 503: sites_unavailable
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site ID from list_sites or add_site. |
No output schema declared.
No examples provided.
set_domain_expiry Set domain expiry ~154
Requires the account session, current X-Organization-Id and CSRF for writes. Set or remove the private manual expiry. It does not change the registry data or confirm renewal payment. Send manual_expires_on, dns, or both. Omitted settings are preserved. DNS requires both selectors and rotating_addresses. A manual date does not change registry data or confirm renewal payment. An identical retry is idempotent. A conflicting revision returns 409.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Owned tab ID from list_tabs. |
| manual_expires_on | string|null | yes | YYYY-MM-DD, or null to remove. |
| revision | integer | yes | Current revision from the corresponding settings or monitor. Use zero for the first change. |
No output schema declared.
No examples provided.
sync_search_console Sync search console ~72
Collect a due sample. Repeated calls cannot bypass the daily reservation. The hourly schedule uses the same durable reservation. A failure preserves the last good sample and schedules the next attempt 24 hours later. This route cannot force an extra collection.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site ID from list_sites or add_site. |
No output schema declared.
No examples provided.
tab_history Tab history ~172
The tab's previous runs and what changed between each one and the one before it (score delta, findings that appeared and that disappeared). Every run has always been kept; this is where you read the series. Each entry carries the score, the counts and a `change` with the point delta and the findings that appeared (`broke`) or disappeared (`fixed`) since the previous run — compared by finding code, never by message. Runs older than the watch feature are matched by URL.
| Name | Type | Req | Description |
|---|---|---|---|
| guest_token | string | yes | Private owner token returned by guest creation. Sent in X-Guest-Token; reuse it for this owner's resources. |
| id | string | yes | ID of the tab whose runs you want. |
| limit | number | – | how many runs, newest first (default 20, max 100) |
No output schema declared.
No examples provided.
track_search_queries Track search queries ~116
Replace the site's tracked query selection (up to 20). Read search_console first to preserve existing selections. Removed queries keep their stored history. E-mail alerts require an active site package. Accepts up to 20 exact queries. Removed queries become inactive; their stored history is retained. Saving schedules the Search Console connection for collection. E-mail delivery requires an active site package.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site ID from list_sites or add_site. |
| terms | array | yes | Unique exact queries, each 1–300 characters. |
No output schema declared.
No examples provided.
watch_tab Watch tab ~234
Turns the daily watch on or off for a tab: it re-audits the page once a day and e-mails when the score drops or a new error/warning appears. Needs the signed-in account (its browser session cookie); a guest token gets 403 `account_required`. When a plan ends, the pages beyond the account's limit pause until the next purchase. With `monitor: true` the page is re-audited once a day and an e-mail goes out when the score drops or a new error/warning appears — never on an improvement. Watching needs an account (the alert has to reach someone) and each account watches a limited number of pages. When a plan ends, the pages beyond the account's limit pause (the oldest stay) until the next purchase.
| Name | Type | Req | Description |
|---|---|---|---|
| guest_token | string | yes | guest pa_… — refused: a guest has no e-mail to warn |
| id | string | yes | ID of the tab to change. |
| monitor | boolean | yes | true watches, false stops watching |
| monitor_email | string | – | where the alert goes; empty = account e-mail |
No output schema declared.
No examples provided.
weekly_site_report Weekly site report ~138
Read the weekly report of a site: what changed since last week, the new pages of up to 3 competitors and every finding. Reading never runs the report. Once a week the report checks the first 500 URLs of the site's sitemap, says what changed since the week before (new and fixed problems, new pages) and lists the new pages of up to 3 competitor sitemaps. It comes with the watch packages: one site for every 25 paid pages. Reading never runs the report.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site owned by this account. |
| lang | string | – | optional: pt for the texts in Portuguese |
No output schema declared.
No examples provided.
weekly_site_report_history Weekly site report history ~61
Read one weekly report of a site's history by its id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Site owned by this account. |
| lang | string | – | optional: pt for the texts in Portuguese |
| report | string | yes | A report id from history. |
No output schema declared.
No examples provided.
How do I install the online.pageaudit/pageaudit MCP server?
online.pageaudit/pageaudit is a hosted endpoint at https://pageaudit.online/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · pageaudit.online
claude mcp add --transport http online-pageaudit-pageaudit 'https://pageaudit.online/mcp'
What is the online.pageaudit/pageaudit MCP server?
online.pageaudit/pageaudit is an MCP server listed in the public MCP registry as online.pageaudit/pageaudit. Technical SEO, passive security and page-delivery audits with evidence and suggested fixes. This page covers its hosted endpoint (https://pageaudit.online/mcp).
Is the online.pageaudit/pageaudit MCP server safe to use?
online.pageaudit/pageaudit scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the online.pageaudit/pageaudit MCP server expose?
online.pageaudit/pageaudit exposes 62 tools: list_sites, add_site, get_site, search_console, track_search_queries, and 57 more. Their descriptions and schemas cost roughly 9,473 tokens of context every time the server is loaded.
Does the online.pageaudit/pageaudit MCP server require authentication?
No. We connected to online.pageaudit/pageaudit without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the online.pageaudit/pageaudit MCP server still maintained?
online.pageaudit/pageaudit is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.