Zevian
NPM · ZEVIAN-MCP · SCANNED OCT 4
Audit a site for SEO and AI search, check localhost pages, and apply or open PRs for fixes.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 3 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1070 tokens (~133/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the Zevian MCP server?
Zevian runs locally as an npm package, launched with npx -y zevian-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · zevian-mcp
claude mcp add tech-zevian-mcp -- npx -y zevian-mcp
{
"mcpServers": {
"tech-zevian-mcp": {
"command": "npx",
"args": [
"-y",
"zevian-mcp"
]
}
}
} {
"servers": {
"tech-zevian-mcp": {
"command": "npx",
"args": [
"-y",
"zevian-mcp"
]
}
}
} codex mcp add tech-zevian-mcp -- npx -y zevian-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"tech-zevian-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"zevian-mcp"
],
"enabled": true
}
}
} openclaw mcp add tech-zevian-mcp --command npx --arg -y --arg zevian-mcp
mcp_servers:
tech-zevian-mcp:
command: "npx"
args: ["-y", "zevian-mcp"] {
"McpServers": {
"tech-zevian-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"zevian-mcp"
]
}
}
} assistant mcp add tech-zevian-mcp -t stdio -c npx -a -y zevian-mcp
{
"mcpServers": {
"tech-zevian-mcp": {
"command": "npx",
"args": [
"-y",
"zevian-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 3 Oct 26 52
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Analysed npm/zevian-mcp@0.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 3 packages
| Packages resolved | 3 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_page Check a page before you deploy ~159
Call this to check one page's SEO, including pages Zevian cannot reach: localhost, staging, or anything not yet published. The page is fetched from this machine (cookies and credentials are never sent, and sensitive response headers are removed before anything goes to Zevian), then analyzed. Returns the page's issues, each with its fix. It reads the HTML as served, so content a browser draws with JavaScript is not visible; the result says so when a page is mostly empty before JavaScript runs.
| Name | Type | Req | Description |
|---|---|---|---|
| include_fixes | boolean | – | Include the fix for each issue (default true). Set false for a shorter answer. |
| url | string | yes | The page's address, such as http://localhost:3000/pricing. |
No output schema declared.
No examples provided.
get_audit Read an audit ~170
Call this to read an audit started with run_audit: its status, scores and counts, and its issues worst first, each with an issue_id for get_fix. Filter by severity (error, warning, info) or category (seo, geo, aeo, schema). Lists up to 25 issues by default and 100 at most, with the total. If the audit is still running it says so: call it again in a minute.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | string | yes | The audit's id, from run_audit. |
| category | string | – | Only issues in this category. |
| limit | integer | – | How many issues to return. Default 25. |
| severity | string | – | Only issues of this severity. |
| status | string | – | Issue status. Default: open. |
No output schema declared.
No examples provided.
get_fix Get the fix for an issue ~115
Call this to get instructions for fixing one issue (an issue_id from get_audit or check_page): the kind of change, which files to look in, the exact target values and limits, and why. Apply it in the user's own repository: search for the current value before you edit, and follow the constraints. It returns instructions, not a diff. If the user would rather have Zevian make the change, use open_fix_pr.
| Name | Type | Req | Description |
|---|---|---|---|
| issue_id | string | yes | The issue's id, from get_audit. |
No output schema declared.
No examples provided.
get_fix_pr Check a pull request ~73
Call this to check a pull request started with open_fix_pr, when open_fix_pr returned a pr_id instead of a url: its status (queued, running, open, failed), its url once open, and the reason if it failed.
| Name | Type | Req | Description |
|---|---|---|---|
| pr_id | string | yes | The pr_id from open_fix_pr. |
No output schema declared.
No examples provided.
get_impact See what the fixes achieved ~110
Call this to see how a site performs in Search Console and Bing over the last N days (7 to 180, default 28), and the before and after of each merged Zevian pull request: clicks, impressions and position, where a positive position_gain means the page moved up. Needs a site_id from list_sites. Paid plans only.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | The period in days. Default 28. |
| site_id | string | yes | The site's id, from list_sites. |
No output schema declared.
No examples provided.
list_sites List Zevian sites ~57
Call this first, to get the site_id the other tools need. Lists the sites connected to this Zevian account with each site's SEO and AI scores, open issue count, connected GitHub repository, and whether the plan has paused it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
open_fix_pr Open a pull request with Zevian ~160
Opens one pull request on the user's connected GitHub repository that fixes 1 to 20 issues from the same site, using Zevian's GitHub App. This changes their repository: ask the user to confirm before you call it, and tell them which issues it will fix. It needs a key with write access, and counts against the monthly pull request allowance. Waits up to about 45 seconds; if the pull request is not open by then it returns a pr_id, so call get_fix_pr with it in a minute or two.
| Name | Type | Req | Description |
|---|---|---|---|
| issue_ids | array | yes | The issues to fix, from get_audit. All from the same site. |
| title | string | – | The pull request title. Default: a short summary. |
No output schema declared.
No examples provided.
run_audit Audit a site ~172
Call this to audit a connected site, or one page of it, with Zevian's crawler. Needs a site_id from list_sites. For localhost, staging or any page that is not published on the site's domain, use check_page instead. Waits up to about 45 seconds for the result; if the audit is still running it returns an audit_id, and you should call get_audit with it in a minute. It crawls the site but changes nothing on it.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | – | "full" audits the whole site (default). "page" audits one page, which needs url. |
| site_id | string | yes | The site's id, from list_sites. |
| url | string | – | The page to audit, on the site's own domain. Only with scope "page". |
No output schema declared.
No examples provided.
What is the Zevian MCP server?
Zevian is an MCP server listed in the public MCP registry as tech.zevian/mcp. Audit a site for SEO and AI search, check localhost pages, and apply or open PRs for fixes. This page covers its npm package (zevian-mcp).
Is the Zevian MCP server safe to use?
Zevian scores 67 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Zevian MCP server expose?
Zevian exposes 8 tools: list_sites, run_audit, get_audit, get_fix, open_fix_pr, and 3 more. Their descriptions and schemas cost roughly 1,016 tokens of context every time the server is loaded.
Is the Zevian MCP server still maintained?
Zevian is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Zevian MCP server under?
Zevian declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.