Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@mcpx-digital/site-health Check HTTP status for https://example.com and https://example.com/missing"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for polite, permission-based site health checks.
Check HTTP status codes, find broken same-origin links, review SEO basics, and inspect common security headers — from Cursor, Claude Desktop, or any MCP client.
Permission required. Only use this server on sites you own or have explicit permission to test. All tools are defensive / informational only. This package does not include exploit payloads, attack procedures, SQLi/XSS scanners, or other offensive tooling.
npx -y @mcpx-digital/site-healthPublish note: The package is prepared for npm as
@mcpx-digital/site-health. If it is not on the registry yet, publish from this repo (npm publish --access public) after logging into an account with access to the@mcpx-digitalscope. Until then you can run from a local clone or GitHub.
Fallback package name (if the @mcpx-digital scope is unavailable): @theoryofshadows/site-health-mcp.
Related MCP server: webcheck-mcp
mcp.json exampleAdd to your Cursor MCP config (e.g. ~/.cursor/mcp.json or project .cursor/mcp.json):
{
"mcpServers": {
"site-health": {
"command": "npx",
"args": ["-y", "@mcpx-digital/site-health"]
}
}
}Local clone (no npm publish required):
{
"mcpServers": {
"site-health": {
"command": "node",
"args": ["/absolute/path/to/site-health-mcp/index.js"]
}
}
}Tool | What it does |
| Check status codes for a list of URLs (max 25), with polite delay |
| Same-origin crawl from a start URL, max depth 2, polite delay; report 4xx/5xx |
| Title, meta description, canonical present? + simple length / H1 hints |
| Checklist of CSP, HSTS, X-Frame-Options, etc. — presence/absence only |
HTTP/HTTPS only
Max depth 2 for crawls; max 40 pages
Polite default delay (~400ms) between requests
Custom User-Agent identifying this tool
No paid APIs — plain Node.js fetch + @modelcontextprotocol/sdk
“Check HTTP status for https://example.com and https://example.com/missing”
“Crawl https://mysite.com for broken links (depth 2)”
“Run SEO basics on https://mysite.com/blog/post”
“Which security headers are present on https://mysite.com?”
git clone https://github.com/TheoryofShadows/site-health-mcp.git
cd site-health-mcp
npm install
npm test
node index.js # stdio MCP serverSuggested listing price: $5–$9.
Ensure the package is published to npm (@mcpx-digital/site-health).
List on MCPX with install command:
npx -y @mcpx-digital/site-health
Emphasize: permission-based, defensive only, zero paid APIs, MIT.
MIT © TheoryofShadows
Same-origin crawl from a start URL (max depth 2), polite delay, report 4xx/5xx and fetch errors. Only use on sites you own or have explicit permission to test. Defensive/informational checks only — no exploit or attack tooling.
| Name | Required | Description | Default |
|---|---|---|---|
| delayMs | No | Polite delay between page fetches in ms (default 400). | |
| maxDepth | No | Crawl depth 0–2 (default 2, hard-capped at 2). | |
| maxPages | No | Max pages to fetch (default 40, hard-capped at 40). | |
| startUrl | Yes | Start URL (must be http/https). Crawl stays on the same origin. | |
| timeoutMs | No | Per-request timeout in ms (default 12000). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and handles it reasonably: it discloses the depth cap, polite delay behavior, same-origin restriction, authorization requirement, and that it reports 4xx/5xx and fetch errors. It does not quantify rate limits beyond the delay or describe the exact output shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: it front-loads what the tool does, then constrains usage with the authorization and defensive-only caveats. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter crawl tool with no output schema and no annotations, the description covers scope, caps, and safety well. It stops short of describing the returned report structure or pagination/truncation behavior at the 40-page cap, but nothing critical to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so every parameter is already documented in the schema. The description only echoes max depth and polite delay, adding no syntax, format, or interaction detail beyond what the schema provides — the baseline 3 for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (crawl) and resource (same-origin links), plus the output (4xx/5xx and fetch errors). It is clearly distinct from the sibling tools http_status, seo_basics, and security_headers, which each target different concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a strong precondition ('Only use on sites you own or have explicit permission to test') and scopes it as defensive/informational only. It does not explicitly contrast with the sibling tools or describe when a single-page check (http_status) would be preferable, so the guidance is contextual rather than alternative-routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check HTTP status codes for a list of URLs (max 25). Polite delay between requests. Only use on sites you own or have explicit permission to test. Defensive/informational checks only — no exploit or attack tooling.
| Name | Required | Description | Default |
|---|---|---|---|
| urls | Yes | HTTP/HTTPS URLs to check (max 25). | |
| delayMs | No | Delay between requests in ms (default 400, max 5000). | |
| timeoutMs | No | Per-request timeout in ms (default 12000). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose behavioral traits: a 25-URL cap, a deliberate rate-limiting behavior ('polite delay between requests'), and a legal/ethical authorization requirement. It is a read-only informational check, so the safety profile is inherently clear, but it omits any statement of what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action and scope. Every sentence carries weight (limit, rate behavior, authorization), with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward three-parameter read tool with full schema coverage, this covers purpose, limits, rate behavior, and authorization. The main remaining gap is that, with no output schema, the description never states the shape of the result (e.g., per-URL status), leaving the return format to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so delayMs and timeoutMs are already fully documented in the schema. The description only reinforces the max-25 limit and adds no syntax, format, or default detail beyond the schema, making the baseline of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Check') and resource ('HTTP status codes') with scope ('a list of URLs, max 25'). It is clearly distinguishable from siblings like seo_basics or security_headers by what it inspects, though it never names those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a real precondition ('Only use on sites you own or have explicit permission to test') and a scope restriction ('defensive/informational checks only'), which rules out misuse. However, it gives no guidance on when to choose this over the sibling tools broken_links, seo_basics, or security_headers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Checklist of common security headers present/absent (CSP, HSTS, X-Frame-Options, etc.). DEFENSIVE/INFORMATIONAL ONLY — does not probe, exploit, or attack. Only use on sites you own or have explicit permission to test. Defensive/informational checks only — no exploit or attack tooling.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL whose response headers to inspect. | |
| timeoutMs | No | Request timeout in ms (default 12000). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that the tool is defensive/informational and does not probe, exploit, or attack, and the timeoutMs parameter implies a live network request. However it does not say whether redirects are followed, whether it requires any auth, or what the request costs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The header scope is front-loaded well, but the safety statement is duplicated almost verbatim ('DEFENSIVE/INFORMATIONAL ONLY — does not probe, exploit, or attack' then 'Defensive/informational checks only — no exploit or attack tooling'). One of the two sentences could be cut without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-only inspection tool with full schema coverage and no output schema, the description adequately conveys what is checked and the safety boundary. The missing piece is what the response looks like (per-header pass/fail list), which is only loosely implied by 'checklist'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (url and timeoutMs) are already documented with their meaning and defaults in the schema. The description adds no format, validation, or URL-normalization details beyond that. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: checking presence/absence of common security headers, with concrete examples (CSP, HSTS, X-Frame-Options). An agent can distinguish this from http_status, broken_links, and seo_basics by the resource inspected, though the description never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a constraint ('only use on sites you own or have explicit permission to test') rather than routing guidance. There is no statement of when to prefer this over http_status or broken_links, so the user must infer the use case from the purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch an HTML page and report title, meta description, canonical link, and basic length/H1 checks. Only use on sites you own or have explicit permission to test. Defensive/informational checks only — no exploit or attack tooling.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | HTML page URL to inspect. | |
| timeoutMs | No | Request timeout in ms (default 12000). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the network-fetch behavior and the ownership/permission precondition, which is genuinely useful. But it omits operational traits such as redirect handling, robots.txt/rate-limit behavior, and what happens on timeout or non-HTML responses.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The functional description is front-loaded and the safety constraint follows immediately after; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey the return shape, and it does by naming the four reported artifacts. It stops short of covering failure modes or how the length/H1 checks are expressed, which leaves a minor gap for a network-fetching tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the schema already documents 'url' and 'timeoutMs' including its default. The description adds no syntax, format, or constraint detail beyond what the schema provides, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('Fetch an HTML page') followed by an explicit enumeration of what it reports (title, meta description, canonical link, length/H1 checks). That output list cleanly separates it from siblings like security_headers and http_status without needing to consult either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an authorization constraint ('Only use on sites you own or have explicit permission to test') and a scope limit ('Defensive/informational checks only'), which is real usage guidance. However, it never says when to prefer this over the sibling tools (http_status, broken_links, security_headers), so alternative selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0broken_linkshttp_statussecurity_headersseo_basicsScored across 4 tools
http_status and broken_links both report HTTP status codes, but one targets a provided list while the other crawls same-origin; descriptions clarify the boundary. seo_basics and security_headers are clearly distinct from each other and the other tools.
All tools use consistent snake_case noun phrases (http_status, broken_links, seo_basics, security_headers) with no mixing of conventions. The pattern is predictable and readable.
Four focused tools exactly match the site-health domain, each covering a distinct diagnostic area. No tool feels redundant or out of place for the stated purpose.
The set covers status codes, broken links, SEO basics, and security headers, which are core site health checks. However, it lacks common diagnostics like redirect chains, SSL/TLS certificate validity, performance, or accessibility—minor gaps for a comprehensive suite.
Security, SEO and AI-visibility scanner for web apps · free scans and focused checks via MCP.
Scan any website or MCP server for agent readiness: 0-100 score, a fix per failing check. Free.
Site crawl + tech stack + DNS + SSL + WHOIS — five web-intel layers in one MCP.
Free technical-SEO audit MCP: crawl a site, run checks, return an LLM-ready shareable report.
