Website Trust & Exposure Auditor

Passive, non-intrusive Website Trust & Exposure Auditor tool connected to Claude Desktop via MCP.

🔗 Live dashboard → sheiscypher.github.io/websec-search-auditor

Main command:

audit https://example.com

Produces: global score, risk prioritisation, remediation plan, HTML report, business impact, technical evidence.

Audit modules

Local installation (Claude Desktop)

git clone https://github.com/sheiscypher/websec-search-auditor
cd websec-search-auditor
pip install -r requirements.txt
cp .env.example .env
# Fill in .env if needed

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "websec-auditor": {
      "command": "python",
      "args": ["/absolute/path/to/websec-search-auditor/server.py"],
      "env": {}
    }
  }
}

Restart Claude Desktop. Type audit https://yoursite.com.

Deployment

Backend (Render)

1. Create a Web Service on render.com

2. Connect this GitHub repo

3. Render auto-detects render.yaml

4. Add JWT_SECRET env variable in Render Dashboard

5. Optional: NVD_API_KEY for CVE lookups

Dashboard (GitHub Pages)

1. Go to Settings > Pages in the repo

2. Source: GitHub Actions

3. Add VITE_API_URL variable in Settings > Environments > github-pages

4. Build triggers automatically on every push to main

Security

• Passive audit only — no modification of the target site

• Built-in SSRF protection

• Built-in indirect prompt injection protection

• 28/28 security tests passing

Licence

AGPL v3 — see SPEC-LICENSE