Sitelemetry

Security audit

audit_security

Run a security posture audit of a website you own or are authorized to assess. By default it uses only public DNS/email, domain registration, TLS, HTTP-header, HTTPS/MITM, technology and transport-delivery signals. You may explicitly select additional account-available modules; protected modules require verified-target authorization, while active modules remain unavailable unless the operator enables active MCP scanning. Returns findings with severity, evidence and fixes.

Input Schema

TableJSON Schema

Name	Required	Description
`lang`	No	Report language (default en): en, tr, es, de, fr, pt, it, ja, zh.
`target`	Yes	Target website URL or domain you own / are authorized to audit (e.g. https://example.com).
`modules`	No	Optional security modules. The default uses public posture signals only. Explicit protected modules require verified-target authorization and remain subject to account and hosted active-scan policy.
`profile`	No	Scan depth. Depth selection (passive/deep/all) is available only on a self-hosted server; the hosted transport runs a fixed non-intrusive baseline.

Output Schema

TableJSON Schema

Name	Required	Description
`kind`	Yes	Audit pillar represented by this result.
`grade`	Yes	Human-readable grade, or null when unavailable.
`score`	Yes	Measured score from 0 to 100, or null when unavailable.
`total`	Yes	Total findings produced before response truncation.
`counts`	Yes	Finding totals grouped by normalized severity.
`target`	Yes	Canonical audited target.
`findings`	Yes	Prioritized findings with evidence, impact, and remediation.
`passingChecks`	Yes	Number of checks that passed or reported protection.
`returnedFindings`	Yes	Number of findings included in this response.
`findingsTruncated`	Yes	True when additional findings exist outside this response.

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description meaningfully supplements the annotations by explaining the default passive-only behavior, the distinction between account-available and protected modules, and the requirement that active scanning be operator-enabled. This is valuable behavioral context beyond readOnlyHint=false and destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense yet compact. It front-loads the core purpose, then covers default behavior, module policy, active-scan restrictions, and output shape in only two sentences. Every clause contributes useful selection or invocation information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers target authorization, default behavior, module categories, active-scan availability, and output semantics. It does not enumerate which of the 27 modules are protected vs. account-available vs. active, and that mapping would be useful, but because the schema exposes the module list, the description is still reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is strong. The description adds extra meaning beyond the schema by explaining the default public-signal posture, module authorization categories, and the operator gating on active scans. This helps an agent reason about module selection without simply repeating property names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run a security posture audit of a website you own or are authorized to assess.' This clearly identifies what the tool does and separates it from sibling audit tools like audit_performance, audit_seo, and audit_accessibility.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete guidance on when the tool applies (owned/authorized targets), what the default audit includes, and how to opt into additional modules. It does not explicitly say when to use another sibling tool, but it does provide clear authorization and activation gating.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Sitelemetry tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0

Disambiguation5/5

Each audit tool targets a distinct dimension of site health (accessibility, AI visibility, integrations, performance, security, SEO), with audit_full explicitly composing them. The boundaries are clearly described, so there is no realistic ambiguity in choosing which tool to invoke.

Naming Consistency5/5

All seven tools follow the exact same verb_noun snake_case pattern with audit_ as a prefix, followed by a descriptive domain element. This creates an entirely predictable and consistent naming convention.

Tool Count5/5

Seven tools is a well-scoped count for a site auditing server: six specialized audits plus one composite full audit. No tool feels redundant, and the set is neither too thin nor too heavy for its stated purpose.

Completeness5/5

The tool surface covers all major established audit domains—accessibility, AI visibility, integrations/unwanted trackers, SEO, performance, and security. The full audit ties everything together with summaries and fixes, creating a complete audit-fix-retest lifecycle without obvious gaps.

Resources

Need Help?