Front-End Checklist
REMOTE · MCP.FRONTENDCHECKLIST.IO · SCANNED OCT 5
Review frontend code and live pages against 386 quality-gated web development rules.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability89
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 18046 tokens (~44/item across 410 items; 11 tools + 399 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
- Supports UI / widget rendering.Pass
How do I install the Front-End Checklist MCP server?
Front-End Checklist is a hosted endpoint at https://mcp.frontendchecklist.io/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.frontendchecklist.io
claude mcp add --transport http thedaviddias-front-end-checklist 'https://mcp.frontendchecklist.io/'
{
"mcpServers": {
"thedaviddias-front-end-checklist": {
"url": "https://mcp.frontendchecklist.io/"
}
}
} {
"servers": {
"thedaviddias-front-end-checklist": {
"type": "http",
"url": "https://mcp.frontendchecklist.io/"
}
}
} [mcp_servers.thedaviddias-front-end-checklist] url = "https://mcp.frontendchecklist.io/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"thedaviddias-front-end-checklist": {
"type": "remote",
"url": "https://mcp.frontendchecklist.io/",
"enabled": true
}
}
} openclaw mcp add thedaviddias-front-end-checklist --url 'https://mcp.frontendchecklist.io/' --transport streamable-http
mcp_servers:
thedaviddias-front-end-checklist:
url: "https://mcp.frontendchecklist.io/" {
"McpServers": {
"thedaviddias-front-end-checklist": {
"Transport": "http",
"Url": "https://mcp.frontendchecklist.io/"
}
}
} assistant mcp add thedaviddias-front-end-checklist -t streamable-http -u 'https://mcp.frontendchecklist.io/'
{
"mcpServers": {
"thedaviddias-front-end-checklist": {
"type": "http",
"url": "https://mcp.frontendchecklist.io/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 1 Oct 26 76
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Oct 2026 · Probed https://mcp.frontendchecklist.io
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.frontendchecklist.io | CN=YR1,O=Let's Encrypt,C=US | 1 Oct 2026 | 30 Dec 2026 | RSA 2048 | SHA256-RSA | 66f8425542a571b10d0b552cfa4269e1c2f |
| SANs: mcp.frontendchecklist.io | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.frontendchecklist.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| frontendchecklist.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| content-security-policy | default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; img-src 'self' data: blob: https:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; frame-src 'self'; upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(), browsing-topics=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.frontendchecklist.io | Verified | 200 | |
| http (plaintext) | http://mcp.frontendchecklist.io | HTTPS enforced | 308 | https://mcp.frontendchecklist.io/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
audit_url Audit Live URL ~154
Fetches a public URL and audits its HTML against frontend best practice rules. **Use this tool** when you want to check a live website without manually pasting HTML. Automatically fetches the page source and runs the same heuristic checks as review_code. **Workflow:** Call audit_url with a public https:// URL → get back a prioritized issue list → use fix_rule for remediation guidance on each issue.
| Name | Type | Req | Description |
|---|---|---|---|
| focus | array | – | Optional: Focus review on specific categories (default: auto-detect from fetched HTML) |
| minPriority | string | – | Optional: Minimum priority level to report (default: medium) |
| url | string | yes | Public URL to audit. Must use https://. Private IPs and localhost are blocked. |
| Name | Type | Req | Description |
|---|---|---|---|
| error | string | – | – |
| issues | array | – | – |
| source | object | – | – |
| suggestions | array | – | – |
| summary | object | – | – |
No examples provided.
check_rule Check Rule Compliance ~144
Checks code against a specific frontend rule. **Use PROACTIVELY** when reviewing HTML/CSS/JS code to validate against frontend best practices. Without code, returns verification guidance. With code, performs heuristic analysis and reports compliance status. If issues are found, includes the fix prompt for immediate remediation. **Workflow:** Use after search_rules finds relevant rules, or when review_code flags a specific issue. Follow up with fix_rule for remediation steps or explain_rule to understand why the rule matters.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | Code snippet to analyze against the rule (optional) |
| slug | string | yes | The rule's slug (e.g., 'doctype', 'alt-text') |
| Name | Type | Req | Description |
|---|---|---|---|
| analysis | string | – | – |
| categories | array | – | – |
| checkPrompt | string | – | – |
| fixPrompt | string | – | – |
| message | string | – | – |
| slug | string | – | – |
| suggestions | array | – | – |
| title | string | – | – |
No examples provided.
explain_rule Explain Frontend Rule ~116
Retrieves the educational explanation for a frontend rule. **Use PROACTIVELY** when the user asks "why" about frontend practices, or when explaining code review feedback. Provides context on why the rule matters, its background, and impact on web development. Categories help connect related concepts. **Workflow:** Use when users question a recommendation, or after fix_rule to provide educational context. Pair with check_rule to validate understanding, or search_rules to find related best practices in the same category.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The rule's slug |
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | – |
| explainPrompt | string | – | – |
| message | string | – | – |
| slug | string | – | – |
| suggestions | array | – | – |
| title | string | – | – |
No examples provided.
fix_rule Get Rule Fix ~125
Retrieves the fix/implementation prompt for a specific rule. **Use PROACTIVELY** after identifying issues in frontend code to get step-by-step remediation guidance. Returns detailed instructions on how to fix the issue correctly, with priority level to help triage multiple issues. **Workflow:** Use after review_code or check_rule identifies issues. Pair with get_rule for complete context, or explain_rule to help users understand the importance of the fix.
| Name | Type | Req | Description |
|---|---|---|---|
| codeSnippet | string | – | Optional: code or HTML snippet for context-aware fix suggestion |
| slug | string | yes | The rule's slug |
| Name | Type | Req | Description |
|---|---|---|---|
| codeContext | string | – | – |
| fixPrompt | string | – | – |
| message | string | – | – |
| priority | string | – | – |
| slug | string | – | – |
| suggestions | array | – | – |
| title | string | – | – |
No examples provided.
get_checklist_rules Get Checklist Rules ~226
Returns full rule details for every rule in a curated checklist in a single call. **More efficient than calling get_rule N times** after get_workflow. Use when you need the complete rule content for an entire checklist to perform a comprehensive audit or code review. Available checklists: accessibility-essentials, comprehensive-audit, core-web-vitals, html-foundations, image-optimization, javascript-resilience, launch-checklist, performance-quick-wins, privacy-and-consent, security-audit, seo-audit, testing-checklist.
| Name | Type | Req | Description |
|---|---|---|---|
| checklist | string | yes | Checklist slug. Available: 'accessibility-essentials', 'comprehensive-audit', 'core-web-vitals', 'html-foundations', 'image-optimization', 'javascript-resilience', 'launch-checklist', 'performance-qu… |
| includeContent | boolean | – | Include full MDX body content (large). Default false returns title, description, prompts, and metadata only. |
| Name | Type | Req | Description |
|---|---|---|---|
| checklist | object | – | – |
| error | object | – | – |
| rules | array | – | – |
No examples provided.
get_quick_reference Get Quick Reference ~182
Returns a compact, actionable checklist of rules for a category. **Use PROACTIVELY** for CI/CD integration, quick audits, or generating checklists. Supports filtering by priority and multiple output formats. **Workflow:** Use for generating quick checklists before deployment or for team handoffs. Pair with check_rule to validate specific items, or get_rule for detailed guidance on any item.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | yes | The category to get a quick reference for (e.g., 'accessibility', 'performance', 'seo') |
| format | string | – | Output format (default: 'json'). Use 'markdown' for readable docs, 'checklist' for copy-paste task lists. |
| priorityFilter | string | – | Filter by priority level (default: 'critical+high'). Use 'all' for comprehensive lists, 'critical' for essentials only. |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| displayName | string | – | – |
| error | object | – | – |
| items | array | – | – |
| markdown | string | – | – |
| priorityFilter | string | – | – |
| totalCount | number | – | – |
No examples provided.
get_rule Get Rule Guidance ~182
Retrieves a single frontend development rule by its unique slug. **Use PROACTIVELY** when reviewing or debugging frontend code to get best practice guidance. Returns complete rule details including content, prompts (check/fix/explain), and metadata as Markdown with code examples. If the slug doesn't exist, returns suggestions for similar rules. **Workflow:** Use after review_code identifies issues, or after search_rules finds relevant rules. Follow up with check_rule to validate code, fix_rule to get remediation steps, or explain_rule to understand why it matters. **Related Rules:** This tool includes related rules in its response, helping you discover connected best practices and build comprehensive understanding.
| Name | Type | Req | Description |
|---|---|---|---|
| includeUrl | boolean | – | Include the rule's web URL in response (default: false) |
| slug | string | yes | The rule's unique slug (e.g., 'doctype', 'alt-text') |
| Name | Type | Req | Description |
|---|---|---|---|
| aiContext | string | – | – |
| categories | array | – | – |
| content | string | – | – |
| description | string | – | – |
| difficulty | string | – | – |
| estimatedTime | number | – | – |
| message | string | – | – |
| primaryCategory | string | – | – |
| priority | string | – | – |
| prompts | object | – | – |
| relatedRules | array | – | – |
| slug | string | – | – |
| sourceSummary | object | – | – |
| sources | array | – | – |
| subcategory | string | – | – |
| suggestions | array | – | – |
| title | string | – | – |
| url | string | – | – |
No examples provided.
get_workflow Get Audit Workflow ~209
Returns a curated, ordered sequence of rules for a specific checklist workflow. **Use PROACTIVELY** when performing comprehensive audits or setting up new projects. Available workflows: accessibility-essentials, comprehensive-audit, core-web-vitals, html-foundations, image-optimization, javascript-resilience, launch-checklist, performance-quick-wins, privacy-and-consent, security-audit, seo-audit, testing-checklist. **Workflow:** Use this tool FIRST to get a structured approach, then use get_rule for each step's details, and check_rule to validate code against each rule.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The checklist workflow slug. Available: 'accessibility-essentials', 'comprehensive-audit', 'core-web-vitals', 'html-foundations', 'image-optimization', 'javascript-resilience', 'launch-checklist', 'p… |
| Name | Type | Req | Description |
|---|---|---|---|
| criticalCount | number | – | – |
| description | string | – | – |
| difficulty | string | – | – |
| error | object | – | – |
| estimatedTime | string | – | – |
| highCount | number | – | – |
| icon | string | – | – |
| slug | string | – | – |
| steps | array | – | – |
| title | string | – | – |
| totalRules | number | – | – |
No examples provided.
list_categories List Rule Categories ~95
Lists all available rule categories with their rule counts. **Use PROACTIVELY** at the start of a frontend project review to understand what best practice areas are available (accessibility, performance, SEO, security, etc.) and plan a comprehensive code review strategy. **Workflow:** Use FIRST when starting a comprehensive audit. Follow up with search_rules to explore specific categories, or review_code to automatically check code against rules in those categories.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | – |
No examples provided.
review_code Review Frontend Code ~223
**PROACTIVE CODE REVIEW**: Runs a conservative, non-exhaustive static heuristic review of HTML/CSS/JS code against multiple frontend best practice rules simultaneously. **Use this tool FIRST** when reviewing, debugging, or improving any frontend code - it detects the code type and checks relevant rules it can prove from the snippet. Returns prioritized issues with fix guidance when static evidence is available, plus suggestions for rule retrieval when manual or rendered-state review is needed. **Workflow:** Use as the FIRST step for any code review. For each issue found, use fix_rule for remediation guidance or get_rule for complete context. If no issues are returned, treat that as "no provable static issue found", then follow suggestions with search_rules or get_rule before concluding the implementation is clean.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The HTML, CSS, or JavaScript code to review |
| focus | array | – | Optional: Focus review on specific categories (default: auto-detect from code) |
| minPriority | string | – | Optional: Minimum priority level to report (default: medium) |
| Name | Type | Req | Description |
|---|---|---|---|
| issues | array | – | – |
| suggestions | array | – | – |
| summary | object | – | – |
No examples provided.
search_rules Search Frontend Rules ~183
Searches and filters frontend development rules. **Use PROACTIVELY** when working on frontend code to find relevant best practices - search by technology (e.g., "react", "images"), concern (e.g., "accessibility", "performance"), or specific patterns. Returns summary information for each match - use get_rule for full details. **Workflow:** Use as a discovery tool before diving deeper. Start with list_categories to see available areas, then search_rules to find specific rules, then get_rule for complete details including code examples.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | Filter by categories (array) |
| cursor | string | – | Pagination cursor from previous response |
| limit | integer | – | Max results to return (default: 20, max: 100) |
| priorities | array | – | Filter by priorities (array) |
| query | string | – | Free-text search query |
| Name | Type | Req | Description |
|---|---|---|---|
| nextCursor | string | – | – |
| rules | array | – | – |
| totalCount | number | – | – |
No examples provided.
What is the Front-End Checklist MCP server?
Front-End Checklist is an MCP server listed in the public MCP registry as io.github.thedaviddias/front-end-checklist. Review frontend code and live pages against 386 quality-gated web development rules. This page covers its hosted endpoint (https://mcp.frontendchecklist.io).
Is the Front-End Checklist MCP server safe to use?
Front-End Checklist scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Front-End Checklist MCP server expose?
Front-End Checklist exposes 11 tools: review_code, audit_url, get_workflow, get_checklist_rules, get_quick_reference, and 6 more. Their descriptions and schemas cost roughly 1,839 tokens of context every time the server is loaded.
Does the Front-End Checklist MCP server require authentication?
No. We connected to Front-End Checklist without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Front-End Checklist MCP server still maintained?
Front-End Checklist is still listed as active in the MCP registry. We last reached this channel on 5 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.