# Zevian (npm · zevian-mcp)

Audit a site for SEO and AI search, check localhost pages, and apply or open PRs for fixes.

- Trust score: 67/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-04

## Components

- npm · `zevian-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp.md), [page](https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp)

## Channel facts

- Registry: `npm`
- Package: `zevian-mcp`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 3 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1070 tokens (~133/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Zevian MCP server?

Zevian runs locally as an npm package, launched with npx -y zevian-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add tech-zevian-mcp -- npx -y zevian-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "tech-zevian-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zevian-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tech-zevian-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zevian-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add tech-zevian-mcp -- npx -y zevian-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tech-zevian-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "zevian-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tech-zevian-mcp --command npx --arg -y --arg zevian-mcp
```

### Hermes

```yaml
mcp_servers:
  tech-zevian-mcp:
    command: "npx"
    args: ["-y", "zevian-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "tech-zevian-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "zevian-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add tech-zevian-mcp -t stdio -c npx -a -y zevian-mcp
```

### Other

```json
{
  "mcpServers": {
    "tech-zevian-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zevian-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-04 (score 67, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-03 (score 52)

First indexed and scored.

## MCP tools (8)

### `list_sites` (~57 tokens)

List Zevian sites

Call this first, to get the site_id the other tools need. Lists the sites connected to this Zevian account with each site's SEO and AI scores, open issue count, connected GitHub repository, and whether the plan has paused it.

### `run_audit` (~172 tokens)

Audit a site

Call this to audit a connected site, or one page of it, with Zevian's crawler. Needs a site_id from list_sites. For localhost, staging or any page that is not published on the site's domain, use check_page instead. Waits up to about 45 seconds for the result; if the audit is still running it returns an audit_id, and you should call get_audit with it in a minute. It crawls the site but changes nothing on it.

Input parameters:

- `scope` (string): "full" audits the whole site (default). "page" audits one page, which needs url.
- `site_id` (string, required): The site's id, from list_sites.
- `url` (string): The page to audit, on the site's own domain. Only with scope "page".

### `get_audit` (~170 tokens)

Read an audit

Call this to read an audit started with run_audit: its status, scores and counts, and its issues worst first, each with an issue_id for get_fix. Filter by severity (error, warning, info) or category (seo, geo, aeo, schema). Lists up to 25 issues by default and 100 at most, with the total. If the audit is still running it says so: call it again in a minute.

Input parameters:

- `audit_id` (string, required): The audit's id, from run_audit.
- `category` (string): Only issues in this category.
- `limit` (integer): How many issues to return. Default 25.
- `severity` (string): Only issues of this severity.
- `status` (string): Issue status. Default: open.

### `get_fix` (~115 tokens)

Get the fix for an issue

Call this to get instructions for fixing one issue (an issue_id from get_audit or check_page): the kind of change, which files to look in, the exact target values and limits, and why. Apply it in the user's own repository: search for the current value before you edit, and follow the constraints. It returns instructions, not a diff. If the user would rather have Zevian make the change, use open_fix_pr.

Input parameters:

- `issue_id` (string, required): The issue's id, from get_audit.

### `open_fix_pr` (~160 tokens)

Open a pull request with Zevian

Opens one pull request on the user's connected GitHub repository that fixes 1 to 20 issues from the same site, using Zevian's GitHub App. This changes their repository: ask the user to confirm before you call it, and tell them which issues it will fix. It needs a key with write access, and counts against the monthly pull request allowance. Waits up to about 45 seconds; if the pull request is not open by then it returns a pr_id, so call get_fix_pr with it in a minute or two.

Input parameters:

- `issue_ids` (array, required): The issues to fix, from get_audit. All from the same site.
- `title` (string): The pull request title. Default: a short summary.

### `get_fix_pr` (~73 tokens)

Check a pull request

Call this to check a pull request started with open_fix_pr, when open_fix_pr returned a pr_id instead of a url: its status (queued, running, open, failed), its url once open, and the reason if it failed.

Input parameters:

- `pr_id` (string, required): The pr_id from open_fix_pr.

### `check_page` (~159 tokens)

Check a page before you deploy

Call this to check one page's SEO, including pages Zevian cannot reach: localhost, staging, or anything not yet published. The page is fetched from this machine (cookies and credentials are never sent, and sensitive response headers are removed before anything goes to Zevian), then analyzed. Returns the page's issues, each with its fix. It reads the HTML as served, so content a browser draws with JavaScript is not visible; the result says so when a page is mostly empty before JavaScript runs.

Input parameters:

- `include_fixes` (boolean): Include the fix for each issue (default true). Set false for a shorter answer.
- `url` (string, required): The page's address, such as http://localhost:3000/pricing.

### `get_impact` (~110 tokens)

See what the fixes achieved

Call this to see how a site performs in Search Console and Bing over the last N days (7 to 180, default 28), and the before and after of each merged Zevian pull request: clicks, impressions and position, where a positive position_gain means the page moved up. Needs a site_id from list_sites. Paid plans only.

Input parameters:

- `days` (integer): The period in days. Default 28.
- `site_id` (string, required): The site's id, from list_sites.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp#diagnostics

## Score history

- 2026-10-04: 67
- 2026-10-03: 52

## Common questions

### What is the Zevian MCP server?

Zevian is an MCP server listed in the public MCP registry as tech.zevian/mcp. Audit a site for SEO and AI search, check localhost pages, and apply or open PRs for fixes. This page covers its npm package (zevian-mcp).

### Is the Zevian MCP server safe to use?

Zevian scores 67 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Zevian MCP server expose?

Zevian exposes 8 tools: list_sites, run_audit, get_audit, get_fix, open_fix_pr, and 3 more. Their descriptions and schemas cost roughly 1,016 tokens of context every time the server is loaded.

### Is the Zevian MCP server still maintained?

Zevian is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Zevian MCP server under?

Zevian declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/zevian-mcp
- Socket report: https://socket.dev/npm/package/zevian-mcp
- Website: https://zevian.tech/mcp
- Changelog RSS feed: https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp.json
- HTML version of this page: https://verifymcp.io/servers/tech-zevian-mcp/zevian-mcp