Skip to main content
Glama

An MCP server that audits a finished web project in a real browser and writes a report another AI can fix code from. It opens the site with Playwright, crawls its pages, clicks the buttons, watches the console and the network, measures layout at several screen widths, runs axe-core for accessibility, checks SEO, images, fonts, performance and basic security, and gives every problem a stable ID, a CSS selector, evidence and a screenshot.

Run it again after the fix and it tells you what was fixed, what is new and what is still there.

Tested on Windows and Python 3.14. Other operating systems and Python versions have not been tested.

A real browser

Chromium via Playwright: real clicks, real layout, real network. Nothing is guessed from the source code.

Made for a fix loop

current.json with one record per problem: rule, page, selector or URL, evidence and a fingerprint that stays the same between runs.

Evidence, not opinions

Every finding says what was measured. Critical findings and warnings come with a screenshot, the element outlined in red.

Prioritized issues

Findings are grouped by cause: one root cause, its related issues, affected pages, impact 1-10 and a fix. Inferred links are marked as likely.

Regression view

Each run is compared with the previous one: ✅ Fixed, 🔴 New, ⚠️ Unchanged.

Safe by design

Read-only for your project, isolated browser context, navigation to other domains blocked, only passive security checks.

Installation

You need Python 3.10+ and an internet connection (Chromium is about 150 MB).

# 1. Create an environment and install straight from GitHub
python -m venv codecheck-env
codecheck-env/Scripts/pip install git+https://github.com/aleks-fw/CodeCheck-MCP.git      # Windows
# codecheck-env/bin/pip install git+https://github.com/aleks-fw/CodeCheck-MCP.git        # macOS / Linux

# 2. Download the browser for Playwright (once)
codecheck-env/Scripts/python -m playwright install chromium

Connect to Claude Code

claude mcp add --scope user codecheck -- "<path>/codecheck-env/Scripts/codecheck-mcp"

Connect to other clients (Claude Desktop, Cursor, ...)

{
  "mcpServers": {
    "codecheck": {
      "command": "<path>/codecheck-env/Scripts/codecheck-mcp",
      "env": { "CODECHECK_REPORTS_DIR": "<where reports go>" }
    }
  }
}

<path> is the absolute path to the folder where you created the environment. CODECHECK_REPORTS_DIR is optional (default ~/codecheck-reports). Restart the client and codecheck appears in its MCP list.

If you are an AI agent

Install by following llms-install.md.

Related MCP server: Vibetest Use

The fix loop: Build → Audit → Fix → Re-audit

  1. Build the site (or start it locally).

  2. Audit. Ask the agent: "Run audit_project on http://localhost:5173 with criticalSelectors ["#checkout"]". You get counts by severity, the critical findings, the top prioritized issue groups and the paths to report.md and current.json.

  3. Fix. "Read current.json and fix the critical findings and warnings. Use the selector, url and evidence of each finding to locate the code." Each finding names the rule, the page, the element or resource and what was observed, so the agent does not have to reproduce the bug first.

  4. Re-audit. Run audit_project again with the same url. The answer starts with Since the previous run: ✅ Fixed 3 · 🔴 New 0 · ⚠️ Unchanged 12; repeat until nothing critical is left.

A finding only counts as fixed if the new run checked the same category, page and viewport; otherwise it is listed as "not rechecked", so a narrower run never reports false fixes.

Tools

Tool

Parameters

What it does

audit_project

url, maxPages=10, viewports=[375, 768, 1280], checks=all, criticalSelectors=[], outputDir

Full audit for the fix loop, see below

compare_reports

previous, current (paths to JSON reports)

Fixed / New / Unchanged between any two audit_project reports

full_qa

target, max_pages=10

Quick QA with the checks below, report in Russian

test_interactions

target, max_pages

Dead buttons, disabled controls that react, covered buttons, forms, double submit, broken anchors

test_layout

target, max_pages, widths=[320, 375, 768, 1024, 1440]

Overlapping and clipped text, horizontal scroll, contrast (also on images), tap targets under 44 px

test_fonts

target, max_pages

Font families, outlier fonts, failed web fonts, size sprawl, heading hierarchy

test_images

target, max_pages

Broken, stretched, blurry, heavy images, missing alt

quick_security

target, max_pages=3

Secrets in files and git history, .env in git, headers, cookies, mixed content

url / target is a URL or a path to a project folder or file; for a folder a temporary local server is started.

audit_project

Parameter

Default

Meaning

url

required

Site URL or project folder / file

maxPages

10

Pages to crawl, same origin only

viewports

[375, 768, 1280]

Screen widths in px (heights 812, 1024, 800)

checks

all

Any of interaction, layout, images, fonts, console, accessibility, seo, performance, security, network

criticalSelectors

[]

Selectors of key actions (e.g. #checkout); if one does nothing on click, the finding is critical

outputDir

<CODECHECK_REPORTS_DIR>/<project>

Where current.json, previous.json, report.md and screenshots/ go

Example call:

{
  "url": "http://127.0.0.1:8765/",
  "criticalSelectors": ["#checkout"],
  "viewports": [375, 768, 1280]
}

Answer (real run on examples/demo-shop with criticalSelectors: ["#checkout", "#place-order"], second run after adding a missing <title>):

CodeCheck audit of http://127.0.0.1:8765/: 9 page(s), viewports 375x812, 768x1024, 1280x800.
Critical: 8 · Warnings: 5 · Notices: 31

Critical:
- CC-001 `interaction/no-effect` on /buttons.html: Clicking #checkout does nothing
- CC-002 `interaction/action-request-failed` on /cart.html: Clicking #place-order sends POST /api/order, which answers HTTP 500
- CC-003 `interaction/action-request-failed` on /checkout.html: Clicking #place-order sends POST /api/order, which answers HTTP 500
- CC-004 `console/uncaught-exception` on /errors.html: Uncaught exception: ReferenceError: cartItems is not defined
- CC-005 `accessibility/image-alt` on /media.html: Images must have alternative text
- CC-006 `network/api-5xx` on /api.html: API request returned HTTP 500
- CC-007 `network/api-5xx` on /checkout.html: API request returned HTTP 500
- CC-008 `network/script-failed` on /media.html: JavaScript file did not load

Top issues (5 of 17 groups):
- G-01 🔴 CRITICAL · impact 10/10 · API request returned HTTP 500 (/api/order) · pages: /cart.html, /checkout.html · 3 related
- G-02 🔴 CRITICAL · impact 10/10 · Clicking #checkout does nothing · pages: /buttons.html
- G-03 🔴 CRITICAL · impact 9/10 · Uncaught exception: ReferenceError: cartItems is not defined · pages: /errors.html
- G-04 🔴 CRITICAL · impact 9/10 · API request returned HTTP 500 (/api/orders) · pages: /api.html
- G-05 🔴 CRITICAL · impact 9/10 · JavaScript file did not load (/js/missing.js) · pages: /media.html

Since the previous run: ✅ Fixed 1 · 🔴 New 0 · ⚠️ Unchanged 44
Fixed:
  CC-013 `seo/missing-title` on `/notitle.html`: Page has no title

Report: .../report.md
JSON: .../current.json
Screenshots: .../screenshots

The top group in the same report.md:

## Prioritized Issues

### 🔴 CRITICAL — API request returned HTTP 500 (/api/order)

- **Impact:** 10/10 (severity 8, breaks a function or exposes data +1, on several pages +1,
  key action (criticalSelectors) +1, causes other issues +1)
- **Category:** functionality
- **Affected pages:** `/cart.html`, `/checkout.html`
- **Root cause:** GET http://127.0.0.1:8765/api/order answered HTTP 500 on /checkout.html. (CC-007)
- **Related issues:**
  - CC-002 `interaction/action-request-failed` on `/cart.html`: Clicking #place-order sends POST /api/order,
    which answers HTTP 500 (confirmed: the click sends a request to the same failing endpoint /api/order)
  - CC-003 `interaction/action-request-failed` on `/checkout.html`: Clicking #place-order sends POST /api/order,
    which answers HTTP 500 (confirmed: the click sends a request to the same failing endpoint /api/order)
  - CC-010 `console/error` on `/checkout.html`: console.error: Could not load the order summary: GET /api/order
    returned 500 (confirmed: the error text mentions /api/order)
- **Recommendation:** The API endpoint in evidence fails on the server: check its server logs, fix the handler,
  and make the page show an error state when the request fails.
- **Evidence:** screenshots: [screenshots/CC-002.png](screenshots/CC-002.png), ... · urls:
  `http://127.0.0.1:8765/api/order` · selectors: `#place-order` · requests:
  `POST http://127.0.0.1:8765/api/order → 500`, `GET http://127.0.0.1:8765/api/order → 500` · console:
  `Could not load the order summary: GET /api/order returned 500`

Below it come the Summary, every finding by severity and category (with its own screenshot and evidence), the list of tested pages and one recommendation per rule that was found.

Prioritized Issues

After all checks, findings are merged into groups, one per cause, and sorted by severity, then impact, then the number of affected pages. Links between findings come only from the findings themselves:

Link

Based on

Marked

The same problem on several pages

same resource URL, or same rule and selector, or same message

same group

A failing request and a click that sends a request to the same endpoint

same URL path

confirmed

A failing request and a console error that names its URL

the URL in the error text

confirmed

A heavy file and the page weight

the file is in the page's largest downloads

confirmed

A missing script and "is not defined" errors or dead buttons on the page

same page

likely

An uncaught exception and a dead button on the page

same page

likely

A failing request and a console error about a request that does not name the URL

same page

likely

A missing stylesheet and layout findings; a slow request and a slow load

same page

likely

If every link of a group is confirmed, the report says Root cause; if any link is inferred, it says Likely root cause. Console errors are recorded while the page loads, before the clicks, so they are never linked to requests sent by a click.

Each group has:

  • severity: CRITICAL (a critical finding), HIGH (a warning about functionality or security), MEDIUM (another warning), LOW (notices only);

  • category: functionality, responsive, performance, accessibility, security, visual or other;

  • impact 1-10: 8 / 5 / 2 for critical / warning / notice, +1 if it breaks a function or exposes data, +1 on several pages or +2 on most pages, +1 for a key action from criticalSelectors, +1 if it causes 2+ other issues; the parts are listed next to the number;

  • affected pages, root cause, related issues (each with the reason of the link), recommendation and evidence (screenshots, URLs, selectors, requests with status, console text).

In current.json the groups are under groups:

{
  "id": "G-01", "title": "API request returned HTTP 500 (/api/order)", "severity": "CRITICAL",
  "category": "functionality", "impact": 10, "impactBasis": {"severity": 8, "on several pages": 1, "...": 1},
  "affectedPages": ["/cart.html", "/checkout.html"],
  "rootCause": {"text": "GET http://127.0.0.1:8765/api/order answered HTTP 500 on /checkout.html.",
                "confirmed": true, "finding": "CC-007", "rule": "network/api-5xx"},
  "relatedIssues": [{"finding": "CC-002", "rule": "interaction/action-request-failed", "page": "/cart.html",
                     "message": "...", "confirmed": true,
                     "link": "the click sends a request to the same failing endpoint /api/order"}],
  "recommendation": "...", "evidence": {"screenshots": [], "urls": [], "selectors": [], "requests": [], "console": []},
  "findings": ["CC-002", "CC-003", "CC-007", "CC-010"]
}

Finding format (current.json)

interface Finding {
  id: string;           // CC-001, CC-002... numbered within the run
  fingerprint: string;  // stable hash of rule + page + (selector or url) for comparing runs
  severity: "critical" | "warning" | "notice";
  category: "interaction" | "layout" | "images" | "fonts" | "console"
          | "accessibility" | "seo" | "performance" | "security" | "network";
  rule: string;         // e.g. "seo/missing-title"
  page: string;         // e.g. "/checkout"
  message: string;      // short description
  details: string;      // what exactly was observed
  selector?: string;    // shortest unique CSS selector
  url?: string;         // for resources and requests
  viewport?: string;    // e.g. "375x812"
  screenshot?: string;  // relative path, critical and warning only
  evidence?: Record<string, unknown>;  // status, size, duration, stack...
}

current.json also holds the run metadata (tool, version, project, url, date, pages, viewports, checks, errors, summary), the groups described above and, from the second run on, a comparison block with the fingerprints of fixed, new and unchanged findings.

What audit_project checks

Category

Rules (severity)

console

uncaught exception (critical), unhandled promise rejection (warning), console.error (warning); stack and source file:line, repeats counted

network

API 5xx (critical), API 4xx (warning, except 401/403 on a login page), JS/CSS failed (critical), image/font failed (warning), request failed (warning), request over 1 s / 3 s (notice / warning)

seo

missing or empty title, missing meta description, missing lang, no <h1> (warning); several <h1>, skipped heading levels, no canonical, no favicon, no Open Graph, no robots.txt / sitemap.xml (notice)

images

image did not load, missing alt (warning); file over 200 KB / 1 MB (notice / warning); natural size over 2× the displayed size (notice)

accessibility

axe-core WCAG 2.x A/AA rules (critical / serious / moderate+minor → critical / warning / notice); onclick elements unreachable by keyboard, no visible focus on Tab (warning)

layout

horizontal scroll with the deepest element past the edge (warning), text clipped by overflow: hidden (notice), tap targets under 24×24 px at 375 px (notice); every viewport

fonts

@font-face font failed to load (warning), text shown in a fallback because the declared font never loaded (notice)

performance

load over 3 s, LCP over 2.5 / 4 s, CLS over 0.1 / 0.25, page over 3 MB, over 100 requests, JS file over 500 KB, CSS file over 150 KB; thresholds in thresholds.py

interaction

clicks up to 20 buttons, href="#" / javascript: links and role="button" per page on a fresh load and watches 2 s for navigation, URL change, requests, DOM changes, dialogs, new tabs; skips logout / delete; critical for criticalSelectors. If the click works but the request it sends fails, interaction/action-request-failed (critical for 5xx, warning for 4xx; 401/403 and 4xx from an empty form are ignored). A critical selector that was never clicked is reported too: critical if it matched no element on any page, warning if it was hidden, invalid, destructive or past the click limit

security

plain HTTP (not localhost), mixed content (warning); no CSP, no nosniff, no HSTS (notice); cookies without Secure or session cookies without HttpOnly (warning); public source maps (notice)

If axe and another check find the same thing (for example a missing alt or lang), it is reported once.

Try it on the demo shop

examples/demo-shop is a small site with deliberate bugs (script errors, a broken image and script, APIs that answer 500, horizontal scroll on phones, a dead checkout button, "Place order" buttons whose request fails, a page without a title) and a clean home page.

python examples/demo-shop/serve.py 8765
# then ask your agent: run audit_project on http://127.0.0.1:8765/ with criticalSelectors ["#checkout", "#place-order"]

Architecture

codecheck_mcp/
  server.py                 MCP tools
  browser.py                Playwright launch, local server for folders, external-domain blocking
  checks/                   checks of the quick tools (full_qa, test_*)
  audit/
    runner.py               audit_project: crawl, run checks per viewport, merge duplicates, write reports
    thresholds.py           every threshold in one place
    core/                   finding, fingerprint, selector, screenshot, crawler, session (events per page)
    checks/                 one module per category; each has run(page, ctx) -> list[Finding]
    report/                 json_report, markdown, diff, priority (grouping)
  vendor/axe.min.js         axe-core 4.13.0, unmodified (MPL-2.0)

Every page is loaded once per viewport; console and network events are recorded before the page starts loading, then each check reads the same page. Checks are registered in audit/checks/__init__.py.

Safety of the server itself

  • Read-only: the project under test is never modified.

  • Pages open in an isolated browser context, without your cookies or sessions.

  • Navigation to other domains is blocked; audit_project does not fill in or submit forms with data and skips buttons that look like logout or delete.

  • Security checks are passive: they read headers, cookies and public files, and never attack the site.

  • Secrets found by quick_security are masked in reports.

  • Test only your own projects, or sites you have the owner's permission to test.

Known limitations

  • A full audit_project takes about 30 s for a small site; pages with many dead buttons take longer (up to 2 s per click). Lower maxPages or narrow checks for large sites.

  • Console, network, SEO, images, fonts, accessibility, performance and security run at the widest viewport only; layout runs at every viewport.

  • Server headers and cookies are not checked for a local folder (they come from the temporary server, not from your project).

  • Only the onclick attribute is seen, not listeners added with addEventListener.

  • Sizes are transferred bytes: a local folder is served without compression, so real hosting may be lighter.

  • The comparison is with the previous run in the same output folder only.

Roadmap

  • Optional session setup (cookies or a login script) to audit pages behind a login.

  • Check console and network at every viewport.

  • A max duration limit for very large sites.

  • Test on macOS and Linux.

Development

pip install -e ".[dev]"
python -m playwright install chromium
pytest tests -q
ruff check codecheck_mcp tests
mypy codecheck_mcp

The tests use pages with deliberate bugs, clean pages that must produce no findings, and regressions found on real sites. See CONTRIBUTING.md.

License

MIT, see LICENSE. codecheck_mcp/vendor/axe.min.js is axe-core by Deque Systems, MPL-2.0, see codecheck_mcp/vendor.

Available Tools

8 tools
audit_projectAudit ProjectA

Audit a web project for an automated fix loop (Build → Audit → Fix → Re-audit). url: site URL or path to the project folder/file. maxPages: same-origin pages to crawl. viewports: widths in px (default 375, 768, 1280). checks: categories (default all). criticalSelectors: selectors of key actions; a dead one is critical. outputDir: where current.json, report.md and screenshots/ go (default: a folder per project in CODECHECK_REPORTS_DIR). Returns counts by severity, the critical findings and paths to the files.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
checksNo
maxPagesNo
outputDirNo
viewportsNo
criticalSelectorsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, and it delivers: it states side effects (writes current.json, report.md, screenshots/), where output goes by default (CODECHECK_REPORTS_DIR), and that a dead criticalSelector counts as critical. It doesn't mention auth, rate limits, or crawling cost, but the core behavioral contract is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Each sentence earns its place: the purpose appears in the first clause, then a compact per-parameter mapping, then a short output summary. No filler, no restatement of schema details, and the most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a web-crawling audit tool, the description covers inputs, side effects, defaults, env-dependent output location, and the return summary. It could add the accepted check-category values and note that the tool may make network requests to the target, but it is otherwise self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description compensates by explaining every parameter with operationally useful detail: maxPages scopes to same-origin pages, viewports are widths with defaults, checks is categories, criticalSelectors has real semantics, and outputDir defines file outputs. Without this, an agent would only have names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description leads with a specific verb and resource ('Audit a web project') and frames it within Build → Audit → Fix → Re-audit, which clearly separates it from the sibling testing tools. The rest of the description reinforces the audit scope without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for an automated fix loop' implies this belongs in a build/audit/fix cycle, but it never explicitly says when to prefer this over siblings such as full_qa or quick_security, nor when not to use it. The use case is clear, but exclusions and alternatives are left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compare_reportsCompare ReportsA

Compare two audit_project JSON reports (paths to current.json / previous.json files) by fingerprint. Returns Fixed, New, Unchanged and findings the newer run did not recheck.

ParametersJSON Schema
NameRequiredDescriptionDefault
currentYes
previousYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden of behavioral disclosure. It does disclose the output categories (Fixed, New, Unchanged, and findings not rechecked), which is useful. However, it does not mention side effects, permissions, read-only behavior, or any potential state changes. For a comparison tool, this is not critical, but the lack of explicit safety or side-effect disclosure prevents a higher score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the purpose and then the key output behavior. Every word earns its place, with no redundancy or filler. This is an appropriate size for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple input schema (two required strings), an existing output schema, and the tool's read-only nature implied by comparison, the description covers the essential purpose, parameters, and return categories. It could add a note on prerequisites or limitations, but it is largely complete for an agent to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so by explaining that the two parameters are file paths to current.json and previous.json, giving concrete meaning to the otherwise generic string type. This is helpful, though it could specify path format or usage constraints. Still, it clearly adds value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Compare'), a resource ('two audit_project JSON reports'), and a distinguishing mechanism ('by fingerprint'). This clearly differentiates the tool from the sibling audit/test tools (full_qa, test_interactions, audit_project, etc.) by focusing on comparison rather than execution or testing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: when an agent has two audit_project report files and needs to see differences. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide exclusions or conditions. The sibling names suggest distinct purposes, but no routing guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

full_qaFull QaB

Полный QA: кнопки, вёрстка (5 ширин экрана), шрифты, изображения и лёгкая проверка безопасности.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, and it only lists coverage areas. It does not state what happens during execution, whether it mutates anything, what the output looks like, how pages are traversed, or what 'light security check' actually entails. This is a meaningful gap for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact, front-loaded single line with no filler. It efficiently communicates the tool's scope, though it is somewhat telegram-style and omits critical parameter context while remaining concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and 0% schema coverage, the description is insufficiently complete. It does not define the target input, explain max_pages, or describe expected behavior. The output schema exists but is not shown, so the agent still lacks the information needed to confidently invoke full_qa.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description mentions neither 'target' nor 'max_pages'. The required target parameter is completely unexplained, and max_pages is not connected to the stated QA scope. An agent cannot determine what value to pass without external knowledge.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly defines the tool's coverage: buttons, layout at 5 screen widths, fonts, images, and light security checks. This goes beyond the tautological title and intuitively reads as a composite QA sweep. It lacks an explicit verb like 'runs' or 'performs', but the scope is still specific and distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The listed domains map directly to the sibling tools (test_interactions, test_layout, test_fonts, test_images, quick_security), making it clear that full_qa is the all-in-one alternative. However, it does not explicitly say when to prefer a single sibling over full_qa, such as for a focused or faster check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quick_securityQuick SecurityC

Лёгкая безопасность: секреты в файлах и истории git, .env в git, заголовки, cookies, mixed content.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior, but it only lists topics. It does not say whether the tool modifies anything, what it returns, how deep it scans, or whether it is read-only. 'Light security' hints at scope but is not a real behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and free of filler, but it is closer to a tagline than a structured tool definition. It front-loads the security theme yet omits essential operational details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the presence of an output schema, the description is incomplete for a 2-parameter tool with undocumented parameters and no annotations. It fails to clarify the target resource or the meaning of max_pages, and it gives no guidance on invocation context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage and the description does not mention target or max_pages at all. An agent cannot tell what format target should take or what max_pages controls, so the description adds no semantic value for parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names concrete security concerns—secrets in files and git history, .env exposure, headers, cookies, and mixed content—making it recognizable as a security-check tool. It is distinct from the QA-focused siblings, though it lacks an explicit verb such as 'scan' or 'check'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's security scope implies it should be used for security checks rather than the layout/font/image/interaction testing done by siblings. However, it never explicitly states when to choose this tool or when to avoid it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

test_fontsTest FontsD

Шрифты: единообразие семейств и размеров, незагрузившиеся веб-шрифты, иерархия заголовков.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

D1.8/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It fails to state whether the tool is read-only or performs mutations, what side effects it may have (e.g., does it crawl pages, take screenshots?), or any operational constraints. The description provides no behavioral transparency beyond the topic list, leaving the agent uninformed about the tool's execution characteristics. There is no contradiction, but the lack of information is a severe gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler, which is concise. However, it is overly brief to the point of under-specification, but conciseness itself is fine. The topic list is front-loaded, but the lack of elaboration means it sacrifices clarity for brevity, yet it earns a 4 for effective brevity without redundant text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the existence of an output schema, the description need not explain return values, but it must explain how to invoke the tool. With 0% schema coverage, the parameters are undocumented, the purpose is vague, and there are no usage guidelines. For a tool with two parameters and no annotations, this is completely inadequate. The description leaves critical information about input semantics and tool behavior undisclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning the schema provides no descriptions for 'target' or 'max_pages'. The tool description does not compensate by explaining what 'target' refers to (e.g., URL, page?) or how 'max_pages' limits the test. Neither parameter is documented anywhere, making it impossible for an agent to know what values to supply. The description adds no semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a vague list of font-related concerns ('uniformity of families and sizes, unloaded web fonts, heading hierarchy') without a clear verb or explicit statement of what the tool does. It implies testing, but does not say 'tests' or 'checks' directly. It does not distinguish itself from sibling tools like test_layout or test_images, which could overlap in visual testing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. The description only lists font issues, but does not explain the context or conditions under which an agent should invoke it (e.g., when checking typography specifically). The sibling names provide some context but are not referenced. No exclusions or alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

test_imagesTest ImagesC

Изображения (только измеримое): битые, искажённые, мыльные, тяжёлые, без alt.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It lists what is inspected but does not state whether the tool only reads data, how it navigates pages, what limits apply, or whether any side effects occur. There is no contradiction because annotations are absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise and front-loads the core idea without filler. However, the brevity comes at the cost of omitting parameter semantics and usage guidance, so it is under-specified rather than efficiently complete.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return structure is likely covered, but the description leaves parameter meanings, invocation context, and selection criteria unexplained. For a QA tool competing with five siblings, this level of detail is insufficient for confident tool selection and use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never mentions 'target' or 'max_pages'. 'Target' is ambiguous (URL, directory, or selector?), and 'max_pages' is only documented via its schema default, leaving the agent to infer its meaning and relationship to the tool's behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource (images) and a specific set of defect categories: broken, distorted, blurry, heavy, and missing alt. The qualifier 'только измеримое' (only measurable) narrows scope and distinguishes it from broader QA siblings, though it lacks an explicit verb like 'test' or 'check'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus siblings such as test_layout, test_fonts, or test_interactions. The image-domain cue is implicit, but there are no explicit conditions, exclusions, or alternative recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

test_interactionsTest InteractionsC

Кнопки и ссылки: мёртвые кнопки, отключённые, что всё равно реагируют, перекрытые, формы, битые якоря.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It lists what is checked but not how the tool behaves—whether it clicks, submits forms, navigates pages, or produces side effects. No limits or safety characteristics are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence that packs many concrete test categories without filler. It is efficiently sized, though its brevity comes at the cost of needed behavioral and parameter context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema may cover return values, but the input contract is opaque and annotations are absent. For a tool that likely drives browser interactions, the description omits target semantics, pagination behavior, and operational side effects, making it incomplete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description never mentions target or max_pages. An agent cannot infer whether target is a URL, selector, or element ID, nor how max_pages affects crawling. Neither the schema nor the description compensates for this gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates concrete interaction targets—buttons, links, forms, and broken anchors—and specific failure modes like dead, disabled-but-reactive, and overlapped elements. This distinguishes it from the layout/font/image sibling tools by domain, though it does not explicitly name any alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to choose test_interactions versus full_qa or quick_security. There are no prerequisites, exclusions, or context signals indicating when this tool is the right fit, so an agent must infer usage entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

test_layoutTest LayoutC

Вёрстка: наложение текста, обрезанный текст, горизонтальный скролл, контраст, мелкие зоны нажатия. widths: ширины экрана в px (по умолчанию 320, 375, 768, 1024, 1440).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
widthsNo
max_pagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure, but it only lists what areas the tool inspects. It does not state whether the operation is read-only, how results are returned, whether a browser/page must already be open, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the layout concerns appear first, then the widths parameter details. It is terse to the point of being skeletal, but it wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description is not complete enough for reliable invocation: the required target parameter is undefined, and the relationship to sibling tools is unstated. An agent would have to guess what to pass as target and when to prefer this over full_qa.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It usefully explains widths (screen widths in px, with defaults), but says nothing about the required target parameter or max_pages, leaving the most important inputs ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource (layout) and enumerates specific checks it performs: text overlap, truncated text, horizontal scroll, contrast, small tap targets. This gives an agent a concrete sense of what the tool covers, though it never states an explicit verb like 'tests' and doesn't name sibling tools to forestall confusion with full_qa or test_fonts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over siblings such as full_qa, test_fonts, or test_interactions. The listed layout issues imply a use case, but the description leaves the selection decision entirely to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.3.0
    • Addedaudit_project
    • Addedcompare_reports
  2. 6 tool updatesv0.1.0
    • First observedfull_qa
    • First observedquick_security
    • First observedtest_fonts
    • First observedtest_images
    • First observedtest_interactions
    • First observedtest_layout

TDQS

C2.7/5.0

Scored across 8 tools

Disambiguation2/5

full_qa overlaps heavily with the individual test_* tools and quick_security, since it bundles the same checks. audit_project also subsumes most of these checks, making it unclear when to use the broad tools versus the granular ones.

Naming Consistency3/5

The test_* tools follow a consistent pattern, but full_qa, quick_security, audit_project, and compare_reports break it. The mix of adjective_noun, verb_noun, and test_* styles creates a somewhat inconsistent naming scheme.

Tool Count4/5

8 tools is a reasonable count for a QA/audit server. However, full_qa and audit_project duplicate much of the test_* suite, so the same functionality could be consolidated slightly.

Completeness4/5

The set covers interactions, layout, fonts, images, security, full audits, and report comparison, forming a solid QA workflow. Minor gaps like dedicated performance or SEO checks exist, but they are not essential to the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    Not graded
    maintenance
    Provides comprehensive website validation across performance, accessibility, SEO, and security dimensions using multiple testing services including WebPageTest, Google PageSpeed Insights, Axe DevTools, Mozilla Observatory, and SSL Labs. Enables automated website health assessments through browser automation and API integrations.
    12
    3 npm
    1
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Browser-based QA testing for AI-built software. Agents open real browsers (via Selenium), navigate pages, fill forms, click buttons, and report findings. Two modes: targeted tests (30-90s) and full-site discovery scans (3-15min).
    -