# SiteVerdict — Website Audit Tools (npm · @siteverdict/mcp)

Website audits for AI agents: GDPR consent, speed, WCAG, SPF/DMARC and AI-search readiness.

- Trust score: 71/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `mcp.webrevenuescan.com`: 37/100, [markdown](https://verifymcp.io/servers/siteverdict-siteverdict/mcp.md), [page](https://verifymcp.io/servers/siteverdict-siteverdict/mcp)
- npm · `@siteverdict/mcp`: 71/100 (this document), [markdown](https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp.md), [page](https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp)

## Channel facts

- Registry: `npm`
- Package: `@siteverdict/mcp`
- Version: `0.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 7 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 4 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3796 tokens (~253/item across 15 items; 11 tools + 4 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).
  - Supports UI / widget rendering.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the SiteVerdict — Website Audit Tools MCP server?

SiteVerdict — Website Audit Tools runs locally as an npm package, launched with npx -y @siteverdict/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add siteverdict-siteverdict -- npx -y @siteverdict/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "siteverdict-siteverdict": {
      "command": "npx",
      "args": [
        "-y",
        "@siteverdict/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "siteverdict-siteverdict": {
      "command": "npx",
      "args": [
        "-y",
        "@siteverdict/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add siteverdict-siteverdict -- npx -y @siteverdict/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "siteverdict-siteverdict": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@siteverdict/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add siteverdict-siteverdict --command npx --arg -y --arg @siteverdict/mcp
```

### Hermes

```yaml
mcp_servers:
  siteverdict-siteverdict:
    command: "npx"
    args: ["-y", "@siteverdict/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "siteverdict-siteverdict": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@siteverdict/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add siteverdict-siteverdict -t stdio -c npx -a -y @siteverdict/mcp
```

### Other

```json
{
  "mcpServers": {
    "siteverdict-siteverdict": {
      "command": "npx",
      "args": [
        "-y",
        "@siteverdict/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-14 (score 71, +32)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail
- [functional] First check of Capabilities: pass
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100

### 2026-10-13 (score 39)

First indexed and scored.

## MCP tools (11)

### `audit_tracking_consent` (~373 tokens)

Audit tracking & cookie consent (GDPR / Consent Mode v2)

Loads the site in a real browser three ways (no click, Reject, Accept all) and reports which tags fire before consent or after Reject, tracking cookies set without consent, Google Consent Mode v2 signals, broken GA4/GTM tags, duplicate page_views and missing conversions. Returns a score, prioritised plain-English fixes and a link to the full HTML report. Use for GDPR/UK GDPR/PECR/ePrivacy cookie compliance and "why is my analytics data wrong" questions. Runs on the caller's own Apify account (APIFY_TOKEN) and is billed by Apify pay-per-event; nothing is charged by this server.

Input parameters:

- `internalPages` (integer): Extra internal pages to check per scenario (0 = home page only).
- `locale` (string): Browser language, e.g. en-GB, de-DE, fr-FR (banners are often localised).
- `maxCostUsd` (number): Spend cap for this run on YOUR Apify account (forwarded to Apify as maxTotalChargeUsd). Default from server config ($2).
- `scanMode` (string): "full" = 3 visits (no click / Reject / Accept all). "quick" = 1 visit, cheaper: tag inventory, pre-consent tracking and broken tags only.
- `timezoneId` (string): IANA time zone, e.g. Europe/London, Europe/Berlin, America/New_York.
- `url` (string, required): Public website URL, e.g. "https://example.com" (https:// is added if missing). Private/internal addresses are rejected.
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `scan_speed_and_revenue` (~328 tokens)

Scan page speed & estimate revenue lost to slowness

Measures Core Web Vitals (LCP, INP, CLS, TTFB) and page weight on key pages, finds the biggest speed bottlenecks (images, render-blocking scripts, third-party tags) and, if you give traffic and order value, estimates monthly revenue lost to slow pages. Returns a score, metrics, prioritised fixes and a full-report link. Runs on the caller's own Apify account (APIFY_TOKEN) and is billed by Apify pay-per-event; nothing is charged by this server.

Input parameters:

- `averageOrderValue` (number): Optional average order / lead value, for the revenue estimate.
- `conversionRatePct` (number): Optional current conversion rate in %, for the revenue estimate.
- `currency` (string): ISO currency code for money figures.
- `device` (string): Emulated device; Google ranks on mobile.
- `maxCostUsd` (number): Spend cap for this run on YOUR Apify account (forwarded to Apify as maxTotalChargeUsd). Default from server config ($2).
- `maxPages` (integer): Pages to test (home page + discovered key pages).
- `monthlyVisitors` (integer): Optional, for the revenue-loss estimate.
- `url` (string, required): Public website URL, e.g. "https://example.com" (https:// is added if missing). Private/internal addresses are rejected.
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `audit_accessibility_wcag` (~302 tokens)

Audit accessibility (WCAG 2.2 / European Accessibility Act)

Crawls pages in a real browser and runs axe-core WCAG 2.2 checks (A/AA/AAA), mapping issues to WCAG success criteria and EN 301 549 / European Accessibility Act duties. Returns a score, issue counts by impact, the affected pages and concrete code-level fixes, plus a full-report link. Automated testing finds a subset of WCAG issues; it does not replace a manual audit. Runs on the caller's own Apify account (APIFY_TOKEN) and is billed by Apify pay-per-event; nothing is charged by this server.

Input parameters:

- `includeBestPractices` (boolean): Also report axe "best-practice" rules that are not strict WCAG failures.
- `maxCostUsd` (number): Spend cap for this run on YOUR Apify account (forwarded to Apify as maxTotalChargeUsd). Default from server config ($2).
- `maxPages` (integer): Pages to crawl on the same host.
- `url` (string, required): Public website URL, e.g. "https://example.com" (https:// is added if missing). Private/internal addresses are rejected.
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.
- `wcagLevel` (string): Conformance level to test against (AA is the legal baseline in most regions).

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `check_domain_email_health` (~251 tokens)

Check domain & email health (SPF, DKIM, DMARC, TLS, DNS)

Checks a domain's email authentication and deliverability setup (MX, SPF, DKIM, DMARC policy, BIMI, MTA-STS/TLS-RPT), DNS hygiene (DNSSEC, CAA, nameservers) and HTTPS/TLS certificate expiry. Flags spoofing risk and Gmail/Yahoo bulk-sender requirement gaps with exact DNS records to add. Runs on the caller's own Apify account (APIFY_TOKEN) and is billed by Apify pay-per-event; nothing is charged by this server.

Input parameters:

- `dkimSelectors` (array): Optional DKIM selectors to test (e.g. "google", "selector1"). Common selectors are tried automatically.
- `domain` (string, required): Domain name, e.g. "example.com" (a URL or email address is accepted and reduced to its domain).
- `maxCostUsd` (number): Spend cap for this run on YOUR Apify account (forwarded to Apify as maxTotalChargeUsd). Default from server config ($2).
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `check_ai_search_readiness` (~235 tokens)

Check AI-search readiness (ChatGPT, Perplexity, Google AI Overviews)

Checks whether AI assistants and AI search engines can find, read and cite the site: robots.txt rules for GPTBot/ClaudeBot/PerplexityBot/Google-Extended, llms.txt, structured data (schema.org), server-rendered content, meta/canonical tags and sitemap. Returns a readiness score and prioritised fixes. Runs on the caller's own Apify account (APIFY_TOKEN) and is billed by Apify pay-per-event; nothing is charged by this server.

Input parameters:

- `maxCostUsd` (number): Spend cap for this run on YOUR Apify account (forwarded to Apify as maxTotalChargeUsd). Default from server config ($2).
- `maxPages` (integer): Pages to sample for content/structured-data checks.
- `url` (string, required): Public website URL, e.g. "https://example.com" (https:// is added if missing). Private/internal addresses are rejected.
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `full_website_audit` (~287 tokens)

Full website audit with prioritised fix plan

Runs the tracking & consent, speed & revenue, accessibility (WCAG 2.2), domain/email health and AI-search readiness checks IN PARALLEL on one website, then merges them into an overall score, an executive summary and a single fix list ranked by severity, legal/revenue impact and effort. Best first call for "audit my website" or "what should I fix first". Partial results are returned if one check fails. Starts one Apify run per check on the caller's Apify account (pay-per-event).

Input parameters:

- `checks` (array): Which checks to run (default: all five). domain_email uses the URL's domain.
- `device` (string): Emulated device for the speed and UX checks; Google ranks on mobile.
- `maxCostUsd` (number): Total spend cap across all runs on YOUR Apify account (split evenly per check). Default: $2 per check.
- `maxPages` (integer): Pages per crawler-based check (keeps cost and time down).
- `url` (string, required): Public website URL, e.g. "https://example.com" (https:// is added if missing). Private/internal addresses are rejected.
- `waitSecs` (integer): How long to wait for results before returning status "running" with a runId (the scan keeps going; use get_audit_results). Default 240.

Output parameters:

- `domain` (string)
- `dryRun` (boolean)
- `executiveSummary` (string)
- `fixPlan` (array)
- `grade` (string|null)
- `overallScore` (number|null)
- `sections` (array)
- `severityCounts` (object)
- `target` (string)
- `totalCostUsd` (number)

### `get_audit_results` (~86 tokens)

Get results of an earlier audit run

Fetches the status and results of an audit run that was still "running" when its tool returned (or any earlier run), by Apify runId. Does not start a new scan and costs nothing extra.

Input parameters:

- `check` (string, required): Which check the run belongs to (for parsing the results).
- `runId` (string, required): run.runId from an earlier result

Output parameters:

- `check` (string)
- `datasetUrl` (string)
- `dryRun` (boolean): true = sample data from the built-in mock, NOT a real scan
- `findings` (array)
- `findingsTotal` (integer)
- `grade` (string|null)
- `metrics` (object)
- `reportUrl` (string): Full report (HTML/JSON) in the Apify key-value store
- `run` (object)
- `score`
- `severityCounts` (object)
- `status` (string): "running" = the Actor is still working; call get_audit_results with run.runId later
- `summary` (string)
- `target` (string)

### `detect_tech_stack` (~479 tokens)

Detect website technology stack

Detects the technology stack of one or many websites from public signals: homepage HTML, script/stylesheet URLs, HTTP headers, cookie names, public DNS (MX, SPF, DMARC, NS, CNAME), TLS issuer and robots.txt. Returns per site the technologies found (category, confidence 0-100, version, evidence) plus convenience fields cms, ecommerce, analytics, advertising, hosting, cdn, emailProviders and dnsProvider. Covers 1,000+ technologies (CMS, ecommerce and Shopify apps, analytics, tag managers, ad pixels, consent tools, CRM, chat, payments, CDN, hosting, email providers). Filters build lists such as "Shopify stores not using Klaviyo" (onlySitesUsing / excludeSitesUsing). mode "http" (default) is fast and cheap; "browser" also catches tags injected by tag managers. Respects robots.txt and never bypasses bot protection: blocked sites return status "blocked" and are not charged. It analyses only the sites you pass; it cannot list every site using a technology. Runs an Apify Actor on the caller's own Apify account (billed by Apify pay-per-event, capped per run).

Input parameters:

- `checkDns` (boolean): Look up MX/NS/SPF/DMARC records to detect the email and DNS providers.
- `checkTls` (boolean): Read the TLS certificate issuer and expiry date.
- `excludeSitesUsing` (array): Drop sites using these, e.g. ["Klaviyo"]
- `extraPaths` (array): Extra paths per site, e.g. ["/pricing", "/cart"]
- `includeEvidence` (boolean): Include evidence strings (more tokens).
- `matchAll` (boolean): onlySitesUsing must ALL match (default: any).
- `minConfidence` (integer): Drop detections below this confidence (0-100).
- `mode` (string): "browser" renders in headless Chrome (more tags, costs more). Prefer http.
- `onlyCategories` (array): Keep only these categories, e.g. ["Booking & scheduling"]
- `onlySitesUsing` (array): Keep only sites using these technologies, e.g. ["Shopify"]
- `urls` (array, required): Domains or URLs, e.g. ["example.com", "https://shop.example.co.uk"]

Output parameters:

- `datasetUrl` (string)
- `disclaimer` (string)
- `dryRun` (boolean): true = built-in SAMPLE data from this server, NOT a real lookup
- `items` (array): Result records (trimmed for context). Records often carry a recordType discriminator.
- `itemsTotal` (integer)
- `notes` (array)
- `run` (object)
- `sampleData` (boolean): true = the Actor returned fictional sample rows (e.g. no credentials configured); never present as real
- `status` (string): "running" = still working; call get_run_results with run.runId later
- `summary` (string)
- `tool` (string)
- `truncated` (boolean): true = more records exist than are included here (see datasetUrl)

### `monitor_website_changes` (~606 tokens)

Check website uptime and changes since last check

Checks web pages for uptime and for changes since the last check. Per URL: up/down/blocked status, HTTP status, response time, TTFB, redirect chain, DNS result and TLS days-to-expiry; for pages checked before, a change verdict (baseline | no-change | changed) with a plain-English summary and a unified diffExcerpt. Detects text changes in the whole page or a CSS/XPath region, price changes, list items added/removed, keywords appearing/disappearing, SEO-critical changes (title, meta description, canonical, H1, noindex appearing), robots.txt/sitemap changes and, in browser mode, screenshot pixel differences. The FIRST call for a URL returns changeStatus "baseline": reuse the same stateStoreName on later calls to compare. Saves a private snapshot in the caller's Apify storage (nothing on the target site changes). Dates, times, UUIDs and copyright years are ignored by default; add ignorePatterns/excludeSelectors for false changes. Respects robots.txt; blocked pages are not charged. Browser mode costs 3x an HTTP check. Runs an Apify Actor on the caller's own Apify account (billed by Apify pay-per-event, capped per run).

Input parameters:

- `checkRobotsTxt` (boolean): Also compare the site's robots.txt.
- `checkSitemap` (boolean): Also compare the site's sitemap.xml.
- `contentSelector` (string): CSS selector of the region to compare
- `contentXPath` (string): XPath of the region to compare
- `excludeSelectors` (array): CSS selectors to ignore when comparing (e.g. ads, timestamps, carousels).
- `ignorePatterns` (array): Regexes masked before comparing
- `keywordAlertOn` (string): Alert when watched keywords appear, disappear, or both.
- `keywords` (array): Words or phrases to watch; reported when they appear or disappear.
- `minChangePercent` (number): Ignore text changes smaller than this percentage of the content.
- `mode` (string): "http" is fast and cheap; "browser" renders JavaScript and enables visual diffs (costs 3x).
- `monitors` (array): Optional per-URL settings that override the global ones.
- `resetBaseline` (boolean): Discard the saved snapshot and start a new baseline.
- `seoChecks` (boolean): Flag SEO-critical changes: title, meta description, canonical, H1, noindex.
- `stateStoreName` (string): Your snapshot namespace (e.g. a project name); reuse it to compare with earlier calls.
- `trackPrices` (boolean): Detect and compare prices on the page.
- `urls` (array, required): Pages to check, e.g. ["https://shop.example/pricing"]
- `visualDiff` (boolean): Compare screenshots pixel by pixel (browser mode only).
- `visualThresholdPercent` (number): Minimum percentage of changed pixels that counts as a visual change.

Output parameters:

- `datasetUrl` (string)
- `disclaimer` (string)
- `dryRun` (boolean): true = built-in SAMPLE data from this server, NOT a real lookup
- `items` (array): Result records (trimmed for context). Records often carry a recordType discriminator.
- `itemsTotal` (integer)
- `notes` (array)
- `run` (object)
- `sampleData` (boolean): true = the Actor returned fictional sample rows (e.g. no credentials configured); never present as real
- `status` (string): "running" = still working; call get_run_results with run.runId later
- `summary` (string)
- `tool` (string)
- `truncated` (boolean): true = more records exist than are included here (see datasetUrl)

### `fetch_clean_markdown` (~492 tokens)

Fetch web pages as clean Markdown with citations

Fetches public web pages and returns their main content as clean Markdown (no menus, ads, cookie banners or footers), plus title, author, published/modified dates, language, canonical URL, a heading outline and a ready-made citation. Tables stay Markdown tables; code blocks keep their language. Use it to read, quote or summarise a page or load documentation; cite citation.url. chunk:true returns heading-aware chunks for long pages; mode "sitemap"/"crawl" (with maxPages, includeGlobs like "/docs/**") reads several pages of one site; rendering "auto" only if a page comes back nearly empty. Respects publishers: obeys robots.txt, never bypasses paywalls, logins, CAPTCHAs or bot protection, honours noai/TDM opt-outs — such pages return status "blocked"/"paywalled" with a reason and NO content; do not retry them by other means. Runs an Apify Actor on the caller's own Apify account (billed by Apify pay-per-event, capped per run).

Input parameters:

- `chunk` (boolean): Return heading-aware chunks for long pages (for RAG).
- `chunkOverlap` (integer): Tokens of overlap between chunks.
- `chunkSize` (integer): Target chunk size in tokens when chunk is true.
- `contentSelector` (string): Optional CSS selector to force the content region.
- `excludeGlobs` (array): URL patterns to skip, e.g. "/blog/tag/**".
- `includeGlobs` (array): e.g. ["/docs/**"]
- `includeImages` (boolean): Keep image links in the Markdown.
- `includeLinks` (boolean): Keep hyperlinks in the Markdown (false = fewer tokens).
- `maxCharsPerPage` (integer): Server-side truncation of markdown per page; truncatedForAgent=true when cut.
- `maxDepth` (integer): How many links deep to follow in crawl mode.
- `maxPages` (integer): Cap for sitemap/crawl modes.
- `mode` (string): "urls" fetches the given pages; "sitemap" or "crawl" reads several pages of one site.
- `rendering` (string): "http" is fastest; use "auto" only if a page comes back nearly empty.
- `urls` (array, required): Page URLs (or site / sitemap URLs for mode sitemap/crawl).

Output parameters:

- `datasetUrl` (string)
- `disclaimer` (string)
- `dryRun` (boolean): true = built-in SAMPLE data from this server, NOT a real lookup
- `items` (array): Result records (trimmed for context). Records often carry a recordType discriminator.
- `itemsTotal` (integer)
- `notes` (array)
- `run` (object)
- `sampleData` (boolean): true = the Actor returned fictional sample rows (e.g. no credentials configured); never present as real
- `status` (string): "running" = still working; call get_run_results with run.runId later
- `summary` (string)
- `tool` (string)
- `truncated` (boolean): true = more records exist than are included here (see datasetUrl)

### `get_run_results` (~78 tokens)

Get results of an earlier data-tool run

Fetches the status and results of a run that was still "running" when a SiteVerdict data tool returned (by runId and tool name). Does not start a new run and costs nothing extra.

Input parameters:

- `runId` (string, required): run.runId from an earlier result
- `tool` (string, required): Which tool produced the run

Output parameters:

- `datasetUrl` (string)
- `disclaimer` (string)
- `dryRun` (boolean): true = built-in SAMPLE data from this server, NOT a real lookup
- `items` (array): Result records (trimmed for context). Records often carry a recordType discriminator.
- `itemsTotal` (integer)
- `notes` (array)
- `run` (object)
- `sampleData` (boolean): true = the Actor returned fictional sample rows (e.g. no credentials configured); never present as real
- `status` (string): "running" = still working; call get_run_results with run.runId later
- `summary` (string)
- `tool` (string)
- `truncated` (boolean): true = more records exist than are included here (see datasetUrl)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp#diagnostics

## Score history

- 2026-10-18: 71
- 2026-10-17: 71
- 2026-10-16: 71
- 2026-10-15: 71
- 2026-10-14: 71
- 2026-10-13: 39

## Common questions

### What is the SiteVerdict — Website Audit Tools MCP server?

SiteVerdict — Website Audit Tools is an MCP server listed in the public MCP registry as io.github.siteverdict/siteverdict. Website audits for AI agents: GDPR consent, speed, WCAG, SPF/DMARC and AI-search readiness. This page covers its npm package (@siteverdict/mcp).

### Is the SiteVerdict — Website Audit Tools MCP server safe to use?

SiteVerdict — Website Audit Tools scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SiteVerdict — Website Audit Tools MCP server expose?

SiteVerdict — Website Audit Tools exposes 11 tools: audit_tracking_consent, scan_speed_and_revenue, audit_accessibility_wcag, check_domain_email_health, check_ai_search_readiness, and 6 more. Their descriptions and schemas cost roughly 3,517 tokens of context every time the server is loaded.

### Is the SiteVerdict — Website Audit Tools MCP server still maintained?

SiteVerdict — Website Audit Tools is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the SiteVerdict — Website Audit Tools MCP server under?

SiteVerdict — Website Audit Tools declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@siteverdict/mcp
- Socket report: https://socket.dev/npm/package/@siteverdict/mcp
- Repository: https://github.com/siteverdict/siteverdict-mcp
- Changelog RSS feed: https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp.json
- HTML version of this page: https://verifymcp.io/servers/siteverdict-siteverdict/siteverdict-mcp