codecheck
This server is an MCP-based web project auditor that runs real-browser checks, generates detailed fixable reports, and compares runs for an automated fix loop.
audit_project: Crawls a site, clicks buttons, watches console/network, tests multiple viewports, and runs checks for interaction, layout, images, fonts, accessibility, SEO, performance, security, and network.
compare_reports: Compares two audit JSON reports by fingerprint to show Fixed, New, Unchanged, and not-rechecked findings.
test_interactions: Finds dead/disabled/overlapped buttons, form issues, double-submit risks, and broken anchors.
test_layout: Detects text overlap/clipping, horizontal scroll, contrast problems, and tiny tap targets at multiple screen widths.
test_fonts: Checks font consistency, failed web fonts, size sprawl, and heading hierarchy.
test_images: Detects broken, stretched, blurry, oversized images and missing alt text.
quick_security: Checks for secrets in files/git, .env exposure, insecure headers, cookies, and mixed content.
Produces stable finding IDs, CSS selectors, evidence, screenshots, severity counts, prioritized root-cause groups, and regression summaries for repeatable fix/re-audit workflows.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codecheckRun full_qa on https://example.com and summarize the issues"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that audits a finished web project in a real browser and writes a report another AI can fix code from. It opens the site with Playwright, crawls its pages, clicks the buttons, watches the console and the network, measures layout at several screen widths, runs axe-core for accessibility, checks SEO, images, fonts, performance and basic security, and gives every problem a stable ID, a CSS selector, evidence and a screenshot.
Run it again after the fix and it tells you what was fixed, what is new and what is still there.
Tested on Windows and Python 3.14. Other operating systems and Python versions have not been tested.
A real browser | Chromium via Playwright: real clicks, real layout, real network. Nothing is guessed from the source code. |
Made for a fix loop |
|
Evidence, not opinions | Every finding says what was measured. Critical findings and warnings come with a screenshot, the element outlined in red. |
Prioritized issues | Findings are grouped by cause: one root cause, its related issues, affected pages, impact 1-10 and a fix. Inferred links are marked as likely. |
Regression view | Each run is compared with the previous one: ✅ Fixed, 🔴 New, ⚠️ Unchanged. |
Safe by design | Read-only for your project, isolated browser context, navigation to other domains blocked, only passive security checks. |
Installation
You need Python 3.10+ and an internet connection (Chromium is about 150 MB).
# 1. Create an environment and install straight from GitHub
python -m venv codecheck-env
codecheck-env/Scripts/pip install git+https://github.com/aleks-fw/CodeCheck-MCP.git # Windows
# codecheck-env/bin/pip install git+https://github.com/aleks-fw/CodeCheck-MCP.git # macOS / Linux
# 2. Download the browser for Playwright (once)
codecheck-env/Scripts/python -m playwright install chromiumConnect to Claude Code
claude mcp add --scope user codecheck -- "<path>/codecheck-env/Scripts/codecheck-mcp"Connect to other clients (Claude Desktop, Cursor, ...)
{
"mcpServers": {
"codecheck": {
"command": "<path>/codecheck-env/Scripts/codecheck-mcp",
"env": { "CODECHECK_REPORTS_DIR": "<where reports go>" }
}
}
}<path> is the absolute path to the folder where you created the environment. CODECHECK_REPORTS_DIR is optional
(default ~/codecheck-reports). Restart the client and codecheck appears in its MCP list.
If you are an AI agent
Install by following llms-install.md.
Related MCP server: Vibetest Use
The fix loop: Build → Audit → Fix → Re-audit
Build the site (or start it locally).
Audit. Ask the agent: "Run audit_project on http://localhost:5173 with criticalSelectors ["#checkout"]". You get counts by severity, the critical findings, the top prioritized issue groups and the paths to
report.mdandcurrent.json.Fix. "Read current.json and fix the critical findings and warnings. Use the selector, url and evidence of each finding to locate the code." Each finding names the rule, the page, the element or resource and what was observed, so the agent does not have to reproduce the bug first.
Re-audit. Run
audit_projectagain with the sameurl. The answer starts withSince the previous run: ✅ Fixed 3 · 🔴 New 0 · ⚠️ Unchanged 12; repeat until nothing critical is left.
A finding only counts as fixed if the new run checked the same category, page and viewport; otherwise it is listed as "not rechecked", so a narrower run never reports false fixes.
Tools
Tool | Parameters | What it does |
|
| Full audit for the fix loop, see below |
|
| Fixed / New / Unchanged between any two |
|
| Quick QA with the checks below, report in Russian |
|
| Dead buttons, disabled controls that react, covered buttons, forms, double submit, broken anchors |
|
| Overlapping and clipped text, horizontal scroll, contrast (also on images), tap targets under 44 px |
|
| Font families, outlier fonts, failed web fonts, size sprawl, heading hierarchy |
|
| Broken, stretched, blurry, heavy images, missing |
|
| Secrets in files and git history, |
url / target is a URL or a path to a project folder or file; for a folder a temporary local server is started.
audit_project
Parameter | Default | Meaning |
| required | Site URL or project folder / file |
|
| Pages to crawl, same origin only |
|
| Screen widths in px (heights 812, 1024, 800) |
| all | Any of |
|
| Selectors of key actions (e.g. |
|
| Where |
Example call:
{
"url": "http://127.0.0.1:8765/",
"criticalSelectors": ["#checkout"],
"viewports": [375, 768, 1280]
}Answer (real run on examples/demo-shop with criticalSelectors: ["#checkout", "#place-order"], second run after adding a missing <title>):
CodeCheck audit of http://127.0.0.1:8765/: 9 page(s), viewports 375x812, 768x1024, 1280x800.
Critical: 8 · Warnings: 5 · Notices: 31
Critical:
- CC-001 `interaction/no-effect` on /buttons.html: Clicking #checkout does nothing
- CC-002 `interaction/action-request-failed` on /cart.html: Clicking #place-order sends POST /api/order, which answers HTTP 500
- CC-003 `interaction/action-request-failed` on /checkout.html: Clicking #place-order sends POST /api/order, which answers HTTP 500
- CC-004 `console/uncaught-exception` on /errors.html: Uncaught exception: ReferenceError: cartItems is not defined
- CC-005 `accessibility/image-alt` on /media.html: Images must have alternative text
- CC-006 `network/api-5xx` on /api.html: API request returned HTTP 500
- CC-007 `network/api-5xx` on /checkout.html: API request returned HTTP 500
- CC-008 `network/script-failed` on /media.html: JavaScript file did not load
Top issues (5 of 17 groups):
- G-01 🔴 CRITICAL · impact 10/10 · API request returned HTTP 500 (/api/order) · pages: /cart.html, /checkout.html · 3 related
- G-02 🔴 CRITICAL · impact 10/10 · Clicking #checkout does nothing · pages: /buttons.html
- G-03 🔴 CRITICAL · impact 9/10 · Uncaught exception: ReferenceError: cartItems is not defined · pages: /errors.html
- G-04 🔴 CRITICAL · impact 9/10 · API request returned HTTP 500 (/api/orders) · pages: /api.html
- G-05 🔴 CRITICAL · impact 9/10 · JavaScript file did not load (/js/missing.js) · pages: /media.html
Since the previous run: ✅ Fixed 1 · 🔴 New 0 · ⚠️ Unchanged 44
Fixed:
CC-013 `seo/missing-title` on `/notitle.html`: Page has no title
Report: .../report.md
JSON: .../current.json
Screenshots: .../screenshotsThe top group in the same report.md:
## Prioritized Issues
### 🔴 CRITICAL — API request returned HTTP 500 (/api/order)
- **Impact:** 10/10 (severity 8, breaks a function or exposes data +1, on several pages +1,
key action (criticalSelectors) +1, causes other issues +1)
- **Category:** functionality
- **Affected pages:** `/cart.html`, `/checkout.html`
- **Root cause:** GET http://127.0.0.1:8765/api/order answered HTTP 500 on /checkout.html. (CC-007)
- **Related issues:**
- CC-002 `interaction/action-request-failed` on `/cart.html`: Clicking #place-order sends POST /api/order,
which answers HTTP 500 (confirmed: the click sends a request to the same failing endpoint /api/order)
- CC-003 `interaction/action-request-failed` on `/checkout.html`: Clicking #place-order sends POST /api/order,
which answers HTTP 500 (confirmed: the click sends a request to the same failing endpoint /api/order)
- CC-010 `console/error` on `/checkout.html`: console.error: Could not load the order summary: GET /api/order
returned 500 (confirmed: the error text mentions /api/order)
- **Recommendation:** The API endpoint in evidence fails on the server: check its server logs, fix the handler,
and make the page show an error state when the request fails.
- **Evidence:** screenshots: [screenshots/CC-002.png](screenshots/CC-002.png), ... · urls:
`http://127.0.0.1:8765/api/order` · selectors: `#place-order` · requests:
`POST http://127.0.0.1:8765/api/order → 500`, `GET http://127.0.0.1:8765/api/order → 500` · console:
`Could not load the order summary: GET /api/order returned 500`Below it come the Summary, every finding by severity and category (with its own screenshot and evidence), the list of tested pages and one recommendation per rule that was found.
Prioritized Issues
After all checks, findings are merged into groups, one per cause, and sorted by severity, then impact, then the number of affected pages. Links between findings come only from the findings themselves:
Link | Based on | Marked |
The same problem on several pages | same resource URL, or same rule and selector, or same message | same group |
A failing request and a click that sends a request to the same endpoint | same URL path | confirmed |
A failing request and a console error that names its URL | the URL in the error text | confirmed |
A heavy file and the page weight | the file is in the page's largest downloads | confirmed |
A missing script and "is not defined" errors or dead buttons on the page | same page | likely |
An uncaught exception and a dead button on the page | same page | likely |
A failing request and a console error about a request that does not name the URL | same page | likely |
A missing stylesheet and layout findings; a slow request and a slow load | same page | likely |
If every link of a group is confirmed, the report says Root cause; if any link is inferred, it says Likely root cause. Console errors are recorded while the page loads, before the clicks, so they are never linked to requests sent by a click.
Each group has:
severity: CRITICAL (a critical finding), HIGH (a warning about functionality or security), MEDIUM (another warning), LOW (notices only);
category:
functionality,responsive,performance,accessibility,security,visualorother;impact 1-10: 8 / 5 / 2 for critical / warning / notice, +1 if it breaks a function or exposes data, +1 on several pages or +2 on most pages, +1 for a key action from
criticalSelectors, +1 if it causes 2+ other issues; the parts are listed next to the number;affected pages, root cause, related issues (each with the reason of the link), recommendation and evidence (screenshots, URLs, selectors, requests with status, console text).
In current.json the groups are under groups:
{
"id": "G-01", "title": "API request returned HTTP 500 (/api/order)", "severity": "CRITICAL",
"category": "functionality", "impact": 10, "impactBasis": {"severity": 8, "on several pages": 1, "...": 1},
"affectedPages": ["/cart.html", "/checkout.html"],
"rootCause": {"text": "GET http://127.0.0.1:8765/api/order answered HTTP 500 on /checkout.html.",
"confirmed": true, "finding": "CC-007", "rule": "network/api-5xx"},
"relatedIssues": [{"finding": "CC-002", "rule": "interaction/action-request-failed", "page": "/cart.html",
"message": "...", "confirmed": true,
"link": "the click sends a request to the same failing endpoint /api/order"}],
"recommendation": "...", "evidence": {"screenshots": [], "urls": [], "selectors": [], "requests": [], "console": []},
"findings": ["CC-002", "CC-003", "CC-007", "CC-010"]
}Finding format (current.json)
interface Finding {
id: string; // CC-001, CC-002... numbered within the run
fingerprint: string; // stable hash of rule + page + (selector or url) for comparing runs
severity: "critical" | "warning" | "notice";
category: "interaction" | "layout" | "images" | "fonts" | "console"
| "accessibility" | "seo" | "performance" | "security" | "network";
rule: string; // e.g. "seo/missing-title"
page: string; // e.g. "/checkout"
message: string; // short description
details: string; // what exactly was observed
selector?: string; // shortest unique CSS selector
url?: string; // for resources and requests
viewport?: string; // e.g. "375x812"
screenshot?: string; // relative path, critical and warning only
evidence?: Record<string, unknown>; // status, size, duration, stack...
}current.json also holds the run metadata (tool, version, project, url, date, pages, viewports,
checks, errors, summary), the groups described above and, from the second run on, a comparison block with the fingerprints of fixed,
new and unchanged findings.
What audit_project checks
Category | Rules (severity) |
console | uncaught exception (critical), unhandled promise rejection (warning), |
network | API 5xx (critical), API 4xx (warning, except 401/403 on a login page), JS/CSS failed (critical), image/font failed (warning), request failed (warning), request over 1 s / 3 s (notice / warning) |
seo | missing or empty title, missing meta description, missing |
images | image did not load, missing |
accessibility | axe-core WCAG 2.x A/AA rules (critical / serious / moderate+minor → critical / warning / notice); |
layout | horizontal scroll with the deepest element past the edge (warning), text clipped by |
fonts |
|
performance | load over 3 s, LCP over 2.5 / 4 s, CLS over 0.1 / 0.25, page over 3 MB, over 100 requests, JS file over 500 KB, CSS file over 150 KB; thresholds in thresholds.py |
interaction | clicks up to 20 buttons, |
security | plain HTTP (not localhost), mixed content (warning); no CSP, no |
If axe and another check find the same thing (for example a missing alt or lang), it is reported once.
Try it on the demo shop
examples/demo-shop is a small site with deliberate bugs (script errors, a broken image and script, APIs that answer 500, horizontal scroll on phones, a dead checkout button, "Place order" buttons whose request fails, a page without a title) and a clean home page.
python examples/demo-shop/serve.py 8765
# then ask your agent: run audit_project on http://127.0.0.1:8765/ with criticalSelectors ["#checkout", "#place-order"]Architecture
codecheck_mcp/
server.py MCP tools
browser.py Playwright launch, local server for folders, external-domain blocking
checks/ checks of the quick tools (full_qa, test_*)
audit/
runner.py audit_project: crawl, run checks per viewport, merge duplicates, write reports
thresholds.py every threshold in one place
core/ finding, fingerprint, selector, screenshot, crawler, session (events per page)
checks/ one module per category; each has run(page, ctx) -> list[Finding]
report/ json_report, markdown, diff, priority (grouping)
vendor/axe.min.js axe-core 4.13.0, unmodified (MPL-2.0)Every page is loaded once per viewport; console and network events are recorded before the page starts loading,
then each check reads the same page. Checks are registered in audit/checks/__init__.py.
Safety of the server itself
Read-only: the project under test is never modified.
Pages open in an isolated browser context, without your cookies or sessions.
Navigation to other domains is blocked;
audit_projectdoes not fill in or submit forms with data and skips buttons that look like logout or delete.Security checks are passive: they read headers, cookies and public files, and never attack the site.
Secrets found by
quick_securityare masked in reports.Test only your own projects, or sites you have the owner's permission to test.
Known limitations
A full
audit_projecttakes about 30 s for a small site; pages with many dead buttons take longer (up to 2 s per click). LowermaxPagesor narrowchecksfor large sites.Console, network, SEO, images, fonts, accessibility, performance and security run at the widest viewport only; layout runs at every viewport.
Server headers and cookies are not checked for a local folder (they come from the temporary server, not from your project).
Only the
onclickattribute is seen, not listeners added withaddEventListener.Sizes are transferred bytes: a local folder is served without compression, so real hosting may be lighter.
The comparison is with the previous run in the same output folder only.
Roadmap
Optional session setup (cookies or a login script) to audit pages behind a login.
Check console and network at every viewport.
A
max durationlimit for very large sites.Test on macOS and Linux.
Development
pip install -e ".[dev]"
python -m playwright install chromium
pytest tests -q
ruff check codecheck_mcp tests
mypy codecheck_mcpThe tests use pages with deliberate bugs, clean pages that must produce no findings, and regressions found on real sites. See CONTRIBUTING.md.
License
MIT, see LICENSE. codecheck_mcp/vendor/axe.min.js is axe-core
by Deque Systems, MPL-2.0, see codecheck_mcp/vendor.
Available Tools
8 toolsaudit_projectAudit ProjectA
Audit a web project for an automated fix loop (Build → Audit → Fix → Re-audit). url: site URL or path to the project folder/file. maxPages: same-origin pages to crawl. viewports: widths in px (default 375, 768, 1280). checks: categories (default all). criticalSelectors: selectors of key actions; a dead one is critical. outputDir: where current.json, report.md and screenshots/ go (default: a folder per project in CODECHECK_REPORTS_DIR). Returns counts by severity, the critical findings and paths to the files.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| checks | No | ||
| maxPages | No | ||
| outputDir | No | ||
| viewports | No | ||
| criticalSelectors | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, and it delivers: it states side effects (writes current.json, report.md, screenshots/), where output goes by default (CODECHECK_REPORTS_DIR), and that a dead criticalSelector counts as critical. It doesn't mention auth, rate limits, or crawling cost, but the core behavioral contract is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Each sentence earns its place: the purpose appears in the first clause, then a compact per-parameter mapping, then a short output summary. No filler, no restatement of schema details, and the most important scoping information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a web-crawling audit tool, the description covers inputs, side effects, defaults, env-dependent output location, and the return summary. It could add the accepted check-category values and note that the tool may make network requests to the target, but it is otherwise self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description compensates by explaining every parameter with operationally useful detail: maxPages scopes to same-origin pages, viewports are widths with defaults, checks is categories, criticalSelectors has real semantics, and outputDir defines file outputs. Without this, an agent would only have names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description leads with a specific verb and resource ('Audit a web project') and frames it within Build → Audit → Fix → Re-audit, which clearly separates it from the sibling testing tools. The rest of the description reinforces the audit scope without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for an automated fix loop' implies this belongs in a build/audit/fix cycle, but it never explicitly says when to prefer this over siblings such as full_qa or quick_security, nor when not to use it. The use case is clear, but exclusions and alternatives are left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compare_reportsCompare ReportsA
Compare two audit_project JSON reports (paths to current.json / previous.json files) by fingerprint. Returns Fixed, New, Unchanged and findings the newer run did not recheck.
| Name | Required | Description | Default |
|---|---|---|---|
| current | Yes | ||
| previous | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden of behavioral disclosure. It does disclose the output categories (Fixed, New, Unchanged, and findings not rechecked), which is useful. However, it does not mention side effects, permissions, read-only behavior, or any potential state changes. For a comparison tool, this is not critical, but the lack of explicit safety or side-effect disclosure prevents a higher score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose and then the key output behavior. Every word earns its place, with no redundancy or filler. This is an appropriate size for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema (two required strings), an existing output schema, and the tool's read-only nature implied by comparison, the description covers the essential purpose, parameters, and return categories. It could add a note on prerequisites or limitations, but it is largely complete for an agent to correctly invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so by explaining that the two parameters are file paths to current.json and previous.json, giving concrete meaning to the otherwise generic string type. This is helpful, though it could specify path format or usage constraints. Still, it clearly adds value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Compare'), a resource ('two audit_project JSON reports'), and a distinguishing mechanism ('by fingerprint'). This clearly differentiates the tool from the sibling audit/test tools (full_qa, test_interactions, audit_project, etc.) by focusing on comparison rather than execution or testing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: when an agent has two audit_project report files and needs to see differences. However, it does not explicitly state when to use this tool versus alternatives, nor does it provide exclusions or conditions. The sibling names suggest distinct purposes, but no routing guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
full_qaFull QaB
Полный QA: кнопки, вёрстка (5 ширин экрана), шрифты, изображения и лёгкая проверка безопасности.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, and it only lists coverage areas. It does not state what happens during execution, whether it mutates anything, what the output looks like, how pages are traversed, or what 'light security check' actually entails. This is a meaningful gap for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact, front-loaded single line with no filler. It efficiently communicates the tool's scope, though it is somewhat telegram-style and omits critical parameter context while remaining concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and 0% schema coverage, the description is insufficiently complete. It does not define the target input, explain max_pages, or describe expected behavior. The output schema exists but is not shown, so the agent still lacks the information needed to confidently invoke full_qa.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description mentions neither 'target' nor 'max_pages'. The required target parameter is completely unexplained, and max_pages is not connected to the stated QA scope. An agent cannot determine what value to pass without external knowledge.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines the tool's coverage: buttons, layout at 5 screen widths, fonts, images, and light security checks. This goes beyond the tautological title and intuitively reads as a composite QA sweep. It lacks an explicit verb like 'runs' or 'performs', but the scope is still specific and distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The listed domains map directly to the sibling tools (test_interactions, test_layout, test_fonts, test_images, quick_security), making it clear that full_qa is the all-in-one alternative. However, it does not explicitly say when to prefer a single sibling over full_qa, such as for a focused or faster check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quick_securityQuick SecurityC
Лёгкая безопасность: секреты в файлах и истории git, .env в git, заголовки, cookies, mixed content.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavior, but it only lists topics. It does not say whether the tool modifies anything, what it returns, how deep it scans, or whether it is read-only. 'Light security' hints at scope but is not a real behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and free of filler, but it is closer to a tagline than a structured tool definition. It front-loads the security theme yet omits essential operational details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the presence of an output schema, the description is incomplete for a 2-parameter tool with undocumented parameters and no annotations. It fails to clarify the target resource or the meaning of max_pages, and it gives no guidance on invocation context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage and the description does not mention target or max_pages at all. An agent cannot tell what format target should take or what max_pages controls, so the description adds no semantic value for parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names concrete security concerns—secrets in files and git history, .env exposure, headers, cookies, and mixed content—making it recognizable as a security-check tool. It is distinct from the QA-focused siblings, though it lacks an explicit verb such as 'scan' or 'check'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool's security scope implies it should be used for security checks rather than the layout/font/image/interaction testing done by siblings. However, it never explicitly states when to choose this tool or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_fontsTest FontsD
Шрифты: единообразие семейств и размеров, незагрузившиеся веб-шрифты, иерархия заголовков.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It fails to state whether the tool is read-only or performs mutations, what side effects it may have (e.g., does it crawl pages, take screenshots?), or any operational constraints. The description provides no behavioral transparency beyond the topic list, leaving the agent uninformed about the tool's execution characteristics. There is no contradiction, but the lack of information is a severe gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, which is concise. However, it is overly brief to the point of under-specification, but conciseness itself is fine. The topic list is front-loaded, but the lack of elaboration means it sacrifices clarity for brevity, yet it earns a 4 for effective brevity without redundant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema, the description need not explain return values, but it must explain how to invoke the tool. With 0% schema coverage, the parameters are undocumented, the purpose is vague, and there are no usage guidelines. For a tool with two parameters and no annotations, this is completely inadequate. The description leaves critical information about input semantics and tool behavior undisclosed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema provides no descriptions for 'target' or 'max_pages'. The tool description does not compensate by explaining what 'target' refers to (e.g., URL, page?) or how 'max_pages' limits the test. Neither parameter is documented anywhere, making it impossible for an agent to know what values to supply. The description adds no semantic meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a vague list of font-related concerns ('uniformity of families and sizes, unloaded web fonts, heading hierarchy') without a clear verb or explicit statement of what the tool does. It implies testing, but does not say 'tests' or 'checks' directly. It does not distinguish itself from sibling tools like test_layout or test_images, which could overlap in visual testing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. The description only lists font issues, but does not explain the context or conditions under which an agent should invoke it (e.g., when checking typography specifically). The sibling names provide some context but are not referenced. No exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_imagesTest ImagesC
Изображения (только измеримое): битые, искажённые, мыльные, тяжёлые, без alt.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It lists what is inspected but does not state whether the tool only reads data, how it navigates pages, what limits apply, or whether any side effects occur. There is no contradiction because annotations are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and front-loads the core idea without filler. However, the brevity comes at the cost of omitting parameter semantics and usage guidance, so it is under-specified rather than efficiently complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the return structure is likely covered, but the description leaves parameter meanings, invocation context, and selection criteria unexplained. For a QA tool competing with five siblings, this level of detail is insufficient for confident tool selection and use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions 'target' or 'max_pages'. 'Target' is ambiguous (URL, directory, or selector?), and 'max_pages' is only documented via its schema default, leaving the agent to infer its meaning and relationship to the tool's behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (images) and a specific set of defect categories: broken, distorted, blurry, heavy, and missing alt. The qualifier 'только измеримое' (only measurable) narrows scope and distinguishes it from broader QA siblings, though it lacks an explicit verb like 'test' or 'check'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus siblings such as test_layout, test_fonts, or test_interactions. The image-domain cue is implicit, but there are no explicit conditions, exclusions, or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_interactionsTest InteractionsC
Кнопки и ссылки: мёртвые кнопки, отключённые, что всё равно реагируют, перекрытые, формы, битые якоря.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It lists what is checked but not how the tool behaves—whether it clicks, submits forms, navigates pages, or produces side effects. No limits or safety characteristics are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence that packs many concrete test categories without filler. It is efficiently sized, though its brevity comes at the cost of needed behavioral and parameter context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema may cover return values, but the input contract is opaque and annotations are absent. For a tool that likely drives browser interactions, the description omits target semantics, pagination behavior, and operational side effects, making it incomplete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description never mentions target or max_pages. An agent cannot infer whether target is a URL, selector, or element ID, nor how max_pages affects crawling. Neither the schema nor the description compensates for this gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description enumerates concrete interaction targets—buttons, links, forms, and broken anchors—and specific failure modes like dead, disabled-but-reactive, and overlapped elements. This distinguishes it from the layout/font/image sibling tools by domain, though it does not explicitly name any alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to choose test_interactions versus full_qa or quick_security. There are no prerequisites, exclusions, or context signals indicating when this tool is the right fit, so an agent must infer usage entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_layoutTest LayoutC
Вёрстка: наложение текста, обрезанный текст, горизонтальный скролл, контраст, мелкие зоны нажатия. widths: ширины экрана в px (по умолчанию 320, 375, 768, 1024, 1440).
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| widths | No | ||
| max_pages | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, but it only lists what areas the tool inspects. It does not state whether the operation is read-only, how results are returned, whether a browser/page must already be open, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the layout concerns appear first, then the widths parameter details. It is terse to the point of being skeletal, but it wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description is not complete enough for reliable invocation: the required target parameter is undefined, and the relationship to sibling tools is unstated. An agent would have to guess what to pass as target and when to prefer this over full_qa.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It usefully explains widths (screen widths in px, with defaults), but says nothing about the required target parameter or max_pages, leaving the most important inputs ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies the resource (layout) and enumerates specific checks it performs: text overlap, truncated text, horizontal scroll, contrast, small tap targets. This gives an agent a concrete sense of what the tool covers, though it never states an explicit verb like 'tests' and doesn't name sibling tools to forestall confusion with full_qa or test_fonts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over siblings such as full_qa, test_fonts, or test_interactions. The listed layout issues imply a use case, but the description leaves the selection decision entirely to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.3.0- Added
audit_project - Added
compare_reports
6 tool updates
v0.1.0- First observed
full_qa - First observed
quick_security - First observed
test_fonts - First observed
test_images - First observed
test_interactions - First observed
test_layout
TDQS
Scored across 8 tools
full_qa overlaps heavily with the individual test_* tools and quick_security, since it bundles the same checks. audit_project also subsumes most of these checks, making it unclear when to use the broad tools versus the granular ones.
The test_* tools follow a consistent pattern, but full_qa, quick_security, audit_project, and compare_reports break it. The mix of adjective_noun, verb_noun, and test_* styles creates a somewhat inconsistent naming scheme.
8 tools is a reasonable count for a QA/audit server. However, full_qa and audit_project duplicate much of the test_* suite, so the same functionality could be consolidated slightly.
The set covers interactions, layout, fonts, images, security, full audits, and report comparison, forming a solid QA workflow. Minor gaps like dedicated performance or SEO checks exist, but they are not essential to the stated purpose.
Maintenance
Related MCP Connectors
AI QA tester — real browsers scan sites for bugs, SEO, perf, and accessibility issues via chat.
Browser-based QA for AI-built software. Test pages with real browsers via agents.
AI QA that runs your app in a browser on every pull request: projects, test targets, test cases.
Capture screenshots, detect visual regressions between page versions, and analyze with AI.
Related MCP Servers
- AlicenseBqualityNot gradedmaintenanceProvides comprehensive website validation across performance, accessibility, SEO, and security dimensions using multiple testing services including WebPageTest, Google PageSpeed Insights, Axe DevTools, Mozilla Observatory, and SSL Labs. Enables automated website health assessments through browser automation and API integrations.123 npm1-
- FlicenseNot gradedqualityDmaintenanceLaunches multiple Browser-Use agents to automatically test websites for UI bugs, broken links, accessibility issues, and other technical problems on both live and localhost sites.832-
- FlicenseNot gradedqualityDmaintenanceBrowser-based QA testing for AI-built software. Agents open real browsers (via Selenium), navigate pages, fill forms, click buttons, and report findings. Two modes: targeted tests (30-90s) and full-site discovery scans (3-15min).-
- FlicenseNot gradedqualityBmaintenanceBrowser-backed QA MCP server that lets coding agents test web apps, collect browser evidence, and return fix-ready reports before shipping.-