superaudit-mcp

MCP (Model Context Protocol) server that exposes SuperAudit's real, free audit as a tool that any MCP-compatible AI agent can call.

With this, an external developer can ask their own agent (Claude, or another MCP client) for things like "audit this website with SuperAudit" without talking to anyone on the SuperAudit team — the tool calls the public production endpoint directly.

What it does

Exposes a single tool: audit_website.

• Input:

  • url (required): domain or URL to audit, e.g. "minegocio.es" or "https://minegocio.es".

  • raw_json (optional, boolean, defaults to false): if true, in addition to the readable summary it returns the full JSON exactly as SuperAudit delivers it (all modules, all scores, the plans).

• What it does internally: calls POST https://superaudit.airpagents.pro/api/quick-audit with { "web": "<url>" } — the same public endpoint SuperAudit's landing page uses today for the free scan. It needs no key or token.

• Output: a text summary with the global score (0-100), the score for each of the ~27 modules (SEO, security, legal/GDPR, Core Web Vitals, WCAG accessibility, generative AI positioning, WordPress/CVEs, OWASP Top 10, etc.), the main issues detected and the paid plan SuperAudit recommends based on the result.

Related MCP server: foglift-mcp

Known limits (important)

• The public endpoint has a limit of 10 requests per minute per IP on the SuperAudit server. If exceeded, the tool returns an error indicating so — it does not retry automatically to avoid overloading the service.

• The backend caches each audited domain for 24 hours, so re-auditing the same website shortly after is instant.

• A "cold" audit (uncached domain) can easily take several seconds: the client waits up to 90s before considering the attempt failed.

• The backend validates that the URL points to a real public domain (blocks private IPs/localhost as an SSRF measure) — if the website doesn't exist or isn't online, the tool returns a readable error, not a silent failure.

Installation (for an external developer)

Requirements: Node.js 18 or higher.

git clone <este repositorio>   # o simplemente copia esta carpeta
cd superaudit-mcp
npm install
npm run build

This generates dist/index.js, which is the MCP server binary (it speaks over stdio, the standard MCP transport).

Try it standalone (optional)

npm run build
node dist/index.js

The process stays waiting on stdio — that's normal, that's how MCP servers work. It connects from an MCP client, it's not used as an interactive CLI.

How to connect it to an MCP client

Claude Code

claude mcp add superaudit -- node "/ruta/completa/a/superaudit-mcp/dist/index.js"

Claude Desktop

Edit the Claude Desktop configuration file (claude_desktop_config.json) and add:

{
  "mcpServers": {
    "superaudit": {
      "command": "node",
      "args": ["/ruta/completa/a/superaudit-mcp/dist/index.js"]
    }
  }
}

Restart Claude Desktop. The audit_website tool will appear available for the agent to use when the conversation requires it (e.g. "audit minegocio.es with SuperAudit").

Any other MCP client

Any client that supports MCP servers over stdio can launch node dist/index.js as the server command — it requires no additional configuration or environment variables.

Environment variables (optional)

• SUPERAUDIT_BASE_URL: defaults to https://superaudit.airpagents.pro. It only makes sense to change it to point to your own test environment.

No API key is needed: the endpoint this tool uses is the same one SuperAudit's public landing page uses for the free scan.

Development

npm install
npm run build   # compila TypeScript → dist/

There are no automated tests in this initial deliverable — it was verified manually with a real MCP client (handshake initialize + tools/list

• tools/call) against the production endpoint.