Skip to main content
Glama

Run a cloud audit

run_audit
Destructive

Run a cloud audit of a website (crawl + 300+ rule analysis + report). Only for sites the user owns or is authorized to test. Credits are spent as the audit runs (pay-as-you-go). The dry run is optional: pass confirm: true on the first call to start straight away. Without confirm, an audit whose estimate is over the org's auto-run threshold comes back as status "confirmation_required" with the estimate to show the user; one at or under the threshold just starts. That response carries "sufficient": true means the organization can pay, so show the estimate and call again with confirm: true; false means it cannot, and the response then carries the cost, the balance, the credit reset date and an upgrade_url for that organization. Relay those, and do NOT retry with confirm: true, which is refused. Pick the audit with level: quick (25 pages from the seed and sitemaps with external link checks, without the cloud checks), surface (100 pages, one per URL pattern, with the cloud checks and external link checks) or full (500 pages, every page it can reach; Pro and Team only: on the Free plan a full request crawls one page per URL pattern instead, up to the plan's page ceiling, and says so in level_notice). Without level the website's own level applies (a new website starts on surface). Every level checks external links, quick included, unless the website's external link setting or this run's external_links turns them off; each distinct external link the cloud verifies costs 1 credit (a link it cannot verify costs nothing), at most one per page of the page budget, and the estimate includes it. Use max_pages to size the crawl (max_pages: 1 audits just the entry URL, the cheapest run). Audits are asynchronous and take minutes: poll get_audit_status with the returned run_id, then fetch results with get_report. The website is registered automatically on first audit. A started run carries a schedule field describing the site's recurring audits: when state is active say so, since each of those runs costs credits, and settings_url is where the user turns them off. pending_first_audit: true means they switch on by themselves after this site's first successful audit, estimated_cost is the most they spend per run, week and month, and update_website_settings with schedule "off" turns them off.

Input Schema

NameRequiredDescriptionDefault
urlYesWebsite URL to audit, e.g. https://example.com (scheme optional).
kindNoClassify the site: 'owned' for something the user runs and monitors, 'prospect' for a lead or competitor audited once. Filterable in list_websites so a prospect cleanup can never sweep up a live site. Unclassified sites read as 'owned'. Ignored when ephemeral is true (an ephemeral site never joins the list).
levelNoAudit level for this run: quick (25 pages, without the cloud checks), surface (100 pages with the cloud checks and external link checks) or full (500 pages). Default: the website's own level. Do not combine with coverage.
scopeNoWhich URLs to audit. 'discover' (the default) follows links from the pages it finds. 'sitemap' audits only the URLs the site's sitemap publishes, which is what you want when the sitemap is the list the user cares about and link discovery would spend the budget elsewhere. Overrides the website's stored setting for this run only.
renderNoRender pages in a headless browser (default true). Catches JavaScript-dependent issues.
confirmNoApprove the credit spend. Set true to start immediately. Omitting it returns an estimate first for anything over the auto-run threshold, and starts the audit anyway for anything at or under it.
coverageNoDeprecated, use level. The old cloud depth: fast (10 pages), surface (50), deep (250) or full (500), each with the cloud checks, keeping the website's own overrides.
ephemeralNoOne-shot check: run the audit and return the report without adding the site to the organization's website list, and without consuming a slot against the plan's website limit. Use for any 'just check this URL' audit the user is not going to monitor. The site is removed automatically once the audit finishes; get_audit_status and get_report keep working on the run_id. Ignored if the domain is already registered, in which case the audit runs against the existing tracked site (nothing is ever deleted) and the response reports ephemeral: false.
max_pagesNoCap the crawl at this many pages for this run. Overrides the coverage profile's page count, so max_pages: 1 audits just the entry URL for the cheapest possible run. A value above the plan's per-audit page ceiling is clamped to the ceiling and reported back in a notice, not rejected.
max_creditsNoSpend guard: refuse to start if the upper-bound estimate exceeds this many credits.
external_linksNoCheck links to other sites for this run: true at any level, false to skip them (default: the website's setting). Each distinct external link the cloud verifies costs 1 credit (a link it cannot verify costs nothing), at most one per page of the run's page budget, and the estimate includes that. Skipped links are listed as not checked in the report.
internal_linksNoStatus-check internal link targets the crawl did not fetch (a HEAD request each, a one-byte GET only when the server refuses HEAD, following redirects that stay in scope; free; it never requests links that look like actions or carry a token). Default: the website's setting, on unless switched off. Pass false for a site whose links change state when requested.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / render / description
      Previous value: -"Render pages in a headless browser (default true). Catches JavaScript-dependent issues; costs extra credits per page."New value: +"Render pages in a headless browser (default true). Catches JavaScript-dependent issues."
  2. Changed1 schema field changed
    • changedInput schema / properties / external_links / description
      Previous value: -"Check links to other sites for this run: true at any level, false to skip them (default: the website's setting). Each distinct external link checked costs 1 credit, at most one per page of the run's page budget, and the estimate includes that. Skipped links are listed as not checked in the report."New value: +"Check links to other sites for this run: true at any level, false to skip them (default: the website's setting). Each distinct external link the cloud verifies costs 1 credit (a link it cannot verify costs nothing), at most one per page of the run's page budget, and the estimate includes that. Skipped links are listed as not checked in the report."
  3. Changed1 schema field changed
    • addedInput schema / properties / internal_links
      Added value: +{
      +  "description": "Status-check internal link targets the crawl did not fetch (a HEAD request each, a one-byte GET only when the server refuses HEAD, following redirects that stay in scope; free; it never requests links that look like actions or carry a token). Default: the website's setting, on unless switched off. Pass false for a site whose links change state when requested.",
      +  "type": "boolean"
      +}
  4. Changed1 schema field changed
    • addedInput schema / properties / external_links
      Added value: +{
      +  "description": "Check links to other sites for this run: true at any level, false to skip them (default: the website's setting). Each distinct external link checked costs 1 credit, at most one per page of the run's page budget, and the estimate includes that. Skipped links are listed as not checked in the report.",
      +  "type": "boolean"
      +}
  5. Changed1 schema field changed
    • addedInput schema / additionalProperties
      Added value: +{}
  6. Changed2 schema fields changed
    • changedInput schema / properties / coverage / description
      Previous value: -"Crawl coverage profile (default fast, 10 pages). Deeper coverage crawls more pages and costs more credits."New value: +"Deprecated, use level. The old cloud depth: fast (10 pages), surface (50), deep (250) or full (500), each with the cloud checks, keeping the website's own overrides."
    • addedInput schema / properties / level
      Added value: +{
      +  "description": "Audit level for this run: quick (25 pages, without the cloud checks), surface (100 pages with the cloud checks and external link checks) or full (500 pages). Default: the website's own level. Do not combine with coverage.",
      +  "enum": [
      +    "quick",
      +    "surface",
      +    "full"
      +  ],
      +  "type": "string"
      +}
  7. Changed4 schema fields changed
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • removedInput schema / additionalProperties
      Removed value: -false
    • addedInput schema / properties / max_credits / maximum
      Added value: +9007199254740991
    • addedInput schema / properties / max_pages / maximum
      Added value: +9007199254740991
  8. Changed1 schema field changed
    • addedInput schema / properties / scope
      Added value: +{
      +  "description": "Which URLs to audit. 'discover' (the default) follows links from the pages it finds. 'sitemap' audits only the URLs the site's sitemap publishes, which is what you want when the sitemap is the list the user cares about and link discovery would spend the budget elsewhere. Overrides the website's stored setting for this run only.",
      +  "enum": [
      +    "discover",
      +    "sitemap"
      +  ],
      +  "type": "string"
      +}
  9. Changed2 schema fields changed
    • addedInput schema / properties / ephemeral
      Added value: +{
      +  "description": "One-shot check: run the audit and return the report without adding the site to the organization's website list, and without consuming a slot against the plan's website limit. Use for any 'just check this URL' audit the user is not going to monitor. The site is removed automatically once the audit finishes; get_audit_status and get_report keep working on the run_id. Ignored if the domain is already registered, in which case the audit runs against the existing tracked site (nothing is ever deleted) and the response reports ephemeral: false.",
      +  "type": "boolean"
      +}
    • addedInput schema / properties / kind
      Added value: +{
      +  "description": "Classify the site: 'owned' for something the user runs and monitors, 'prospect' for a lead or competitor audited once. Filterable in list_websites so a prospect cleanup can never sweep up a live site. Unclassified sites read as 'owned'. Ignored when ephemeral is true (an ephemeral site never joins the list).",
      +  "enum": [
      +    "owned",
      +    "prospect"
      +  ],
      +  "type": "string"
      +}
  10. Changed3 schema fields changed
    • changedInput schema / properties / confirm / description
      Previous value: -"Approve the credit spend. Omit on the first call to see the estimate; set true to start the audit after the user approves."New value: +"Approve the credit spend. Set true to start immediately. Omitting it returns an estimate first for anything over the auto-run threshold, and starts the audit anyway for anything at or under it."
    • changedInput schema / properties / coverage / description
      Previous value: -"Crawl coverage profile (default fast). Deeper coverage crawls more pages and costs more credits."New value: +"Crawl coverage profile (default fast, 10 pages). Deeper coverage crawls more pages and costs more credits."
    • addedInput schema / properties / max_pages
      Added value: +{
      +  "description": "Cap the crawl at this many pages for this run. Overrides the coverage profile's page count, so max_pages: 1 audits just the entry URL for the cheapest possible run. A value above the plan's per-audit page ceiling is clamped to the ceiling and reported back in a notice, not rejected.",
      +  "minimum": 1,
      +  "type": "integer"
      +}
  11. First observed

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavior beyond the annotations: credit consumption, confirmation_required responses, sufficient true/false handling, cost and balance fields, upgrade_url, asynchronous runtime, automatic website registration, and recurring schedule costs. This is exactly the kind of mutation, cost, and multi-step workflow context an agent needs for a destructive, open-world tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and nearly every sentence carries actionable information for a complex, credit-spending audit tool. It is dense and presented as a single long paragraph, so it would benefit from clearer structure, but it avoids obvious filler given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given twelve parameters, no output schema, and annotations that only flag mutation/open-world/destructive behavior, the description is unusually complete. It explains the async workflow, confirmation edge cases, funding failures, level behavior, external-link costs, automatic registration, and recurring-audit schedule implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all twelve parameters. The description still adds meaningful semantics for key parameters, including level tradeoffs, full-plan restrictions, max_pages: 1 as the cheapest run, external-link credit costs, and confirm behavior, though it does not discuss every parameter such as kind, scope, render, ephemeral, max_credits, or internal_links.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource: run a cloud audit of a website, including crawl, rule analysis, and report. It distinguishes this from sibling tools by identifying it as the audit starter and by naming the follow-up tools get_audit_status and get_report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit usage conditions and exclusions: only for owned or authorized sites, optional confirm behavior, when to use dry runs, and how to choose level and max_pages. It also routes the agent to get_audit_status for polling and get_report for results, and explicitly says not to retry with confirm when funds are insufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.