CertScore.ai — Light mode
Server Details
No-account public website privacy risk scans with 20 new scans/day and free recent-result reuse.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
- Repository
- ergoveritas1-alt/certscore.ai
- GitHub Stars
- 0
Glama MCP Gateway
Connect through Glama MCP Gateway for full control over tool access and complete visibility into every call.
Full call logging
Every tool call is logged with complete inputs and outputs, so you can debug issues and audit what your agents are doing.
Tool access control
Enable or disable individual tools per connector, so you decide what your agents can and cannot do.
Managed credentials
Glama handles OAuth flows, token storage, and automatic rotation, so credentials never expire on your clients.
Usage analytics
See which tools your agents call, how often, and when, so you can understand usage patterns and catch anomalies.
Tool Definition Quality
Average 4.5/5 across 3 of 3 tools scored.
Each tool has a clearly distinct role: scan_site initiates, get_scan_status polls progress, get_scan_bundle retrieves results. No overlap in purpose or output.
All tool names follow the verb_noun pattern: scan_site, get_scan_status, get_scan_bundle. Consistent and predictable.
Three tools perfectly cover the scan lifecycle: start, check status, fetch results. No redundancy or bloat.
The core workflow of starting, polling, and retrieving is complete. Minor gap: no explicit cancel/abort tool, but not essential for the primary use case.
Available Tools
3 toolsget_scan_bundleGet scan bundleARead-onlyInspect
Call after completed or completed_limited status. summary returns the canonical overview without finding bodies; findings reserves space for compact findings; evidence reserves findings plus bounded evidence digests and references; full adds all available bounded sections. Every response declares detail and byte-budget metadata, omittedSections, retrieval URLs, and nextRecommendedMaxBytes when truncated. Never interpret no-go, not-observed, or limited coverage as proof of compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | Response detail. Defaults to summary; evidence and full opt into heavier retained context. | |
| scanId | Yes | Stable CertScore scan ID. | |
| maxBytes | No | Maximum serialized structured response size in bytes. Defaults to 50000. | |
| maxFindings | No | Maximum compact findings to return. Defaults to 5 for summary and 20 otherwise. | |
| maxPreConsentRows | No | Maximum pre-consent inventory rows when evidence is requested. Defaults to 20. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| noGo | No | |
| type | Yes | |
| error | Yes | |
| links | No | |
| score | Yes | |
| detail | Yes | |
| domain | Yes | |
| scanId | Yes | |
| status | Yes | |
| timing | Yes | |
| summary | Yes | |
| coverage | No | |
| findings | Yes | |
| createdAt | Yes | |
| reportUrl | Yes | |
| riskLevel | Yes | |
| startedAt | Yes | |
| disclaimer | Yes | |
| fullReport | No | |
| completedAt | Yes | |
| mcpMetadata | Yes | |
| scoreStatus | Yes | |
| scoreVersion | Yes | |
| scoreUpdatedAt | Yes | |
| evidenceSummary | No | |
| scanTimeSeconds | Yes | |
| findingsMetadata | Yes | |
| resultDisposition | No | |
| recommendedNextTool | Yes | |
| recommendedNextAction | Yes | |
| observationOnlyDisclaimer | Yes | |
| preConsentCookiesTrackers | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the readOnlyHint/openWorldHint annotations by explaining exactly what every response contains: detail and byte-budget metadata, omittedSections, retrieval URLs, and nextRecommendedMaxBytes when truncated. It also adds a critical interpretive warning about not treating no-go/not-observed/limited coverage as proof of compliance, which is valuable behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-organized: precondition first, then detail levels, then response metadata, then an interpretive warning. Every sentence earns its place, and there is no redundant repetition of schema or annotation information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity—multiple detail levels, byte budgets, truncation, and open-world caveats—the description covers the essential operational context. Preconditions, return behavior, metadata, and a critical interpretation warning are all present, and the output schema covers the exact return structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers all parameters with 100% description coverage, so the baseline is 3. The description adds meaningful semantics for the 'detail' parameter by explaining what summary, findings, evidence, and full actually return, and it contextualizes maxBytes via the nextRecommendedMaxBytes hint. It does not elaborate on maxFindings or maxPreConsentRows, but their schema descriptions are sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies when to call the tool (after completed or completed_limited status) and what it returns at different detail levels, but it does not explicitly distinguish it from sibling tools like get_scan_status or scan_site. The verbs 'returns', 'reserves', and 'adds' convey the core retrieval purpose well.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit timing guidance ('Call after completed or completed_limited status') and explains when different detail levels are appropriate. However, it does not mention alternative tools or situations where this tool should not be used, so it lacks full exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_scan_statusGet scan statusARead-onlyInspect
Poll with only the stable scanId returned by scan_site. Active responses include phase, heartbeat, estimated progress, stalled state, and retry delay. Terminal responses include the canonical score, risk, coverage, timestamps, report URL, and an explicit next action. Stop polling at any terminal status.
| Name | Required | Description | Default |
|---|---|---|---|
| scanId | Yes | Stable CertScore scan ID returned by scan_site. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | No | |
| noGo | No | |
| type | No | |
| error | Yes | |
| jobId | No | |
| links | No | |
| phase | No | |
| score | No | |
| domain | No | |
| scanId | No | |
| status | No | |
| scan_id | No | |
| stalled | No | |
| coverage | No | |
| createdAt | No | |
| reportUrl | No | |
| riskLevel | No | |
| startedAt | No | |
| completedAt | No | |
| scoreStatus | No | |
| scoreVersion | No | |
| lastUpdatedAt | No | |
| phaseStartedAt | No | |
| scoreUpdatedAt | No | |
| lastHeartbeatAt | No | |
| progressPercent | No | |
| scanTimeSeconds | No | |
| resultDisposition | No | |
| retryAfterSeconds | No | |
| progressIsEstimate | No | |
| recommendedNextTool | Yes | |
| recommendedNextAction | Yes | |
| estimatedRemainingSeconds | No | |
| observationOnlyDisclaimer | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint and openWorldHint annotations already indicating safety, the description adds valuable behavioral detail: it enumerates active response fields (phase, heartbeat, estimated progress, stalled state, retry delay) and terminal response fields (score, risk, coverage, timestamps, report URL, next action), plus the stop-polling rule. This goes beyond annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the action verb. Every sentence adds value: what to poll, what responses look like, and when to stop. No wasted words or redundancy with schema/annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter polling tool with an output schema, the description covers the full lifecycle: how to initiate polling, what to expect in both active and terminal states, and the stopping condition. It is complete without needing to describe return formats since the output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the scanId parameter is fully documented in the schema. The description merely repeats the schema's note that scanId is stable and returned by scan_site, adding no new semantic meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Poll') and resource ('stable scanId returned by scan_site'). It distinguishes itself from siblings by defining its scope as a status polling tool tied to scan_site, which is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: poll only with the stable scanId from scan_site and stop at any terminal status. However, it does not explicitly mention when to use the sibling tool get_scan_bundle instead, so it lacks an explicit exclusion or alternative comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_siteScan siteAInspect
First call. Starts or reuses a public-web scan and waits up to 45 seconds by default. If status is queued, running, or finalizing, retain scanId and poll get_scan_status using only that scanId. Stop polling at completed, completed_limited, failed, expired, or rate_limited. For usable completion, call get_scan_bundle. No-go and limited coverage are observations, never proof of compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public URL or domain to scan. | |
| scanFrom | No | Optional scan execution context for newly queued scans. | |
| freshness | No | Use latest to reuse recent scans or refresh to request a new scan when eligible. | |
| maxWaitSeconds | No | Maximum time to wait before returning the still-running job. Defaults to 45 seconds; never turns an active scan into an error. | |
| waitForCompletion | No | Wait for a completed scan resource in this tool call. Defaults to true. Set false only for an explicitly asynchronous workflow. |
Output Schema
| Name | Required | Description |
|---|---|---|
| noGo | No | |
| type | Yes | |
| error | Yes | |
| jobId | No | |
| score | No | |
| domain | No | |
| scanId | No | |
| status | Yes | |
| coverage | No | |
| scanFrom | No | |
| createdAt | No | |
| riskLevel | No | |
| startedAt | No | |
| completedAt | No | |
| scoreStatus | No | |
| scoreVersion | No | |
| scoreUpdatedAt | No | |
| scanTimeSeconds | No | |
| resultDisposition | No | |
| recommendedNextTool | Yes | |
| recommendedNextAction | Yes | |
| observationOnlyDisclaimer | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond the annotations, such as the 45-second default wait, scan reuse via freshness, the need to poll with the exact scanId, and the caveat that no-go/limited coverage observations are not proof of compliance. This goes well beyond the openWorldHint and readOnlyHint annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description packs a full workflow into four dense, purposeful sentences. It front-loads the primary action ('First call') and then provides ordered, actionable follow-up steps without any filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the complete lifecycle: scan initiation, waiting behavior, polling statuses, terminal conditions, and the next-step call to get_scan_bundle. It also addresses edge cases like scan reuse and status interpretation, making it fully sufficient given the rich output schema and sibling context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% coverage of all five parameters, including detailed descriptions, enum values, and constraints. The description adds minimal new parameter-level detail, only indirectly referencing maxWaitSeconds and waitForCompletion, so it meets the baseline for high schema coverage but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb phrase 'starts or reuses' and identifies the resource as a 'public-web scan', clearly distinguishing it from the sibling follow-up tools. It explicitly labels itself as 'First call', which immediately signals its role in the workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit workflow instructions: retain the scanId, poll get_scan_status, stop at terminal statuses, and call get_scan_bundle for usable completion. It also clarifies when to use waitForCompletion=false for an asynchronous workflow, giving clear context for when this tool should be used versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Claim this connector by publishing a /.well-known/glama.json file on your server's domain with the following structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"maintainers": [{ "email": "your-email@example.com" }]
}The email address must match the email associated with your Glama account. Once published, Glama will automatically detect and verify the file within a few minutes.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Servers
- AlicenseAqualityDmaintenanceAudit any website for privacy, security, accessibility, and performance issues — with scores, grades, and actionable fix instructions. No account required.Last updated317MIT
- Alicense-qualityCmaintenanceScans public URLs for compliance and security issues such as leaked API keys, exposed files, missing privacy pages, and security headers, helping developers identify gaps before launch.Last updatedMIT
- Alicense-qualityCmaintenanceHelps individuals analyze privacy policies and verify if a website's technical behavior matches its stated privacy practices.Last updatedMIT
- Flicense-qualityBmaintenancePassive website security and trust auditor that checks for security, SEO, AI surface, email, and other exposures, producing a score and remediation plan.Last updated