io.github.vdalhambra/siteaudit-mcp
PYPI · SITEAUDIT-MCP · SCANNED SEP 20
SEO, performance, and security audits for any URL — no API keys required
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 23 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 159 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 946 tokens (~86/item across 11 items; 11 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.vdalhambra/siteaudit-mcp server?
io.github.vdalhambra/siteaudit-mcp runs locally as a PyPI package, launched with uvx siteaudit-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · siteaudit-mcp
claude mcp add vdalhambra-siteaudit-mcp -- uvx siteaudit-mcp
{
"mcpServers": {
"vdalhambra-siteaudit-mcp": {
"command": "uvx",
"args": [
"siteaudit-mcp"
]
}
}
} {
"servers": {
"vdalhambra-siteaudit-mcp": {
"command": "uvx",
"args": [
"siteaudit-mcp"
]
}
}
} codex mcp add vdalhambra-siteaudit-mcp -- uvx siteaudit-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vdalhambra-siteaudit-mcp": {
"type": "local",
"command": [
"uvx",
"siteaudit-mcp"
],
"enabled": true
}
}
} openclaw mcp add vdalhambra-siteaudit-mcp --command uvx --arg siteaudit-mcp
mcp_servers:
vdalhambra-siteaudit-mcp:
command: "uvx"
args: ["siteaudit-mcp"] {
"McpServers": {
"vdalhambra-siteaudit-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"siteaudit-mcp"
]
}
}
} assistant mcp add vdalhambra-siteaudit-mcp -t stdio -c uvx -a siteaudit-mcp
{
"mcpServers": {
"vdalhambra-siteaudit-mcp": {
"command": "uvx",
"args": [
"siteaudit-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.80 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 −3
- Stability: pass → 0.80 functional
- 10 Sept 26 +1
- Stability: 0.97 → pass security
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/siteaudit-mcp@1.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 23 packages
| Packages resolved | 23 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
accessibility_audit Accessibility Audit ~96
Run WCAG accessibility checks on a URL. Returns a score (0-100) and detailed findings on: - Missing alt text on images - Form inputs without labels - Heading hierarchy issues - Color contrast hints (limited without rendering) - ARIA attribute usage - Language declaration - Skip links - Focus indicators (heuristic)
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to audit (e.g., 'example.com') |
Structured output declared, but exposes no named fields.
No examples provided.
check_links Check Links ~126
Scan a page for broken links — find 404s, redirects, timeouts, and server errors. Extracts all links (internal + external) from the page, checks each with a HEAD request, and groups results by status: working (2xx), redirects (3xx), client errors (4xx), server errors (5xx), and timeouts. Checks up to 50 links concurrently for speed. Results cached for 5 minutes.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to scan for broken links (e.g., 'example.com' or 'https://example.com') |
Structured output declared, but exposes no named fields.
No examples provided.
check_robots_txt Check Robots Txt ~52
Check and analyze a site's robots.txt file. Shows which paths are allowed/disallowed, sitemaps referenced, and crawl-delay settings.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Website URL or domain to check robots.txt |
Structured output declared, but exposes no named fields.
No examples provided.
compare_sites Compare Sites ~66
Compare SEO and performance scores of multiple websites side by side. Useful for competitive analysis — see how your site stacks up against competitors across SEO, performance, and security.
| Name | Type | Req | Description |
|---|---|---|---|
| urls | string | yes | Comma-separated URLs to compare (e.g., 'example.com,competitor.com') |
Structured output declared, but exposes no named fields.
No examples provided.
competitor_gap_analysis Competitor Gap Analysis ~61
Analyze SEO/security/performance gaps vs competitors. Returns areas where competitors outperform your site, with specific recommendations for improvement.
| Name | Type | Req | Description |
|---|---|---|---|
| competitor_urls | string | yes | Comma-separated competitor URLs (up to 5) |
| your_url | string | yes | Your website URL |
Structured output declared, but exposes no named fields.
No examples provided.
full_audit Full Audit ~75
Run a comprehensive audit on a URL — SEO, performance, and security in one call. Returns a unified score (0-100) plus detailed results for each category. This is the most complete analysis available.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to audit (e.g., 'example.com' or 'https://example.com') |
Structured output declared, but exposes no named fields.
No examples provided.
lighthouse_audit Lighthouse Audit ~130
Run Google Lighthouse via PageSpeed Insights API — get performance, accessibility, SEO, and best-practices scores plus Core Web Vitals (LCP, INP, CLS). Returns Lighthouse scores (0-100), Core Web Vitals with ratings, and the top 5 performance optimization opportunities ranked by potential time savings. This uses Google's real Lighthouse engine — the same tool Chrome DevTools uses. Takes 15-30 seconds to complete.
| Name | Type | Req | Description |
|---|---|---|---|
| strategy | string | – | 'mobile' or 'desktop' (default: mobile) |
| url | string | yes | URL to audit with Google Lighthouse |
Structured output declared, but exposes no named fields.
No examples provided.
performance_audit Performance Audit ~55
Check page performance — response time, page size, compression, caching. Returns server response time, page size, compression status, redirect chain analysis, and caching header review.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to check for performance |
Structured output declared, but exposes no named fields.
No examples provided.
schema_validator Schema Validator ~66
Extract and validate Schema.org structured data (JSON-LD, microdata). Returns all structured data found on the page with validation hints and a breakdown by schema type. Critical for rich snippets in SERPs.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to check for structured data (Schema.org) |
Structured output declared, but exposes no named fields.
No examples provided.
security_audit Security Audit ~66
Run a security audit on a URL. Checks HTTPS, HSTS, CSP, X-Frame-Options, cookie flags, SSL certificate validity and expiration, server disclosure, and other security headers. Returns score + fixes needed.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to check for security |
Structured output declared, but exposes no named fields.
No examples provided.
seo_audit Seo Audit ~70
Run an SEO-focused audit on a URL. Checks title tags, meta descriptions, headings, images alt text, internal/external links, canonical URLs, Open Graph, structured data, mobile viewport, and content length. Returns score + actionable recommendations.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to analyze for SEO |
Structured output declared, but exposes no named fields.
No examples provided.
What is the io.github.vdalhambra/siteaudit-mcp server?
io.github.vdalhambra/siteaudit-mcp is listed in the public MCP registry as io.github.vdalhambra/siteaudit-mcp. SEO, performance, and security audits for any URL, no API keys required. This page covers its PyPI package (siteaudit-mcp).
Is the io.github.vdalhambra/siteaudit-mcp server safe to use?
io.github.vdalhambra/siteaudit-mcp scores 67 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.vdalhambra/siteaudit-mcp server expose?
io.github.vdalhambra/siteaudit-mcp exposes 11 tools: full_audit, seo_audit, security_audit, performance_audit, compare_sites, and 6 more. Their descriptions and schemas cost roughly 863 tokens of context every time the server is loaded.
Is the io.github.vdalhambra/siteaudit-mcp server still maintained?
io.github.vdalhambra/siteaudit-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.