Webby MCP Server
Provides website performance testing through Google PageSpeed Insights API, analyzing Core Web Vitals and Google ranking signals for both mobile and desktop.
Integrates Lighthouse testing capabilities for comprehensive website analysis including performance metrics, SEO evaluation, and accessibility scoring through multiple testing platforms.
Enables security analysis through Mozilla Observatory API, testing HTTP security headers, CSP policies, HSTS configuration, and overall security posture of websites.
Performs detailed website performance analysis using Google PageSpeed Insights, providing Core Web Vitals measurements, performance scores, and optimization recommendations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Webby MCP Server run a comprehensive performance test on our homepage"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Webby - Comprehensive Website Validator MCP Server
A Model Context Protocol (MCP) server that provides comprehensive website testing across performance, accessibility, SEO, and security dimensions.
Features
🚀 Performance Testing
WebPageTest ✅ - Real browser testing via Playwright automation (300 tests/month free, no API key)
Google PageSpeed Insights ✅ - Core Web Vitals and Google ranking signals (25K API calls/day free)
GTmetrix ✅ - Lighthouse + custom metrics with historical tracking (requires API key)
♿ Accessibility Testing
Axe DevTools ✅ - Fast WCAG scans via Playwright + axe-core (free, open-source)
WAVE ✅ - WCAG compliance and contrast analysis (requires API key)
🔍 SEO Testing
PageSpeed Insights SEO ✅ - Uses Lighthouse SEO (free, comprehensive)
🔒 Security Testing
Mozilla Observatory ✅ - HTTP security headers analysis (CSP, HSTS) - Free API, 1 scan/min
SSL Labs ✅ - Comprehensive SSL/TLS certificate testing - Free API (requires email)
Installation
cd ~/mcp-servers/servers/src/webby
npm install
npm run buildMCP Tools (11 Total)
Performance Tools (3)
validate_performance_pagespeed
{
url: string,
strategy?: 'mobile' | 'desktop', // default: mobile
apiKey?: string // optional, for higher quota
}
// Returns: Performance score, Core Web Vitals, metricsvalidate_performance_webpagetest ✨ NEW
{
url: string,
location?: string, // e.g., 'Dulles:Chrome'
runs?: number, // default: 1
waitForResults?: boolean, // default: false (returns test ID immediately)
timeout?: number // default: 300000 (5 min)
}
// Returns: Test ID + results URL immediately OR full results if waitForResults=true
// Metrics: Load Time, FCP, LCP, Speed Index, TTI, TBT, CLS, Performance Gradevalidate_performance_gtmetrix
{
url: string,
apiKey: string, // required
location?: string, // e.g., 'vancouver-canada'
browser?: string // e.g., 'chrome'
}
// Returns: Lighthouse score, PageSpeed score, load time, page sizeAccessibility Tools (2)
validate_accessibility_axe
{
url: string,
wcagLevel?: string // wcag2a, wcag2aa, wcag2aaa, wcag21aa, wcag22aa
}
// Returns: Violations by severity (critical, serious, moderate, minor), passes, incompletevalidate_accessibility_wave
{
url: string,
apiKey: string, // required
reporttype?: 1 | 2 | 3 | 4 // detail level (default: 2)
}
// Returns: Errors, contrast errors, alerts, WAVE report URL, credits remainingSecurity Tools (2)
validate_security_mozilla_observatory
{
url: string,
forceRescan?: boolean // default: false
}
// Returns: Grade (A+ to F), score, tests passed/failed, details URLvalidate_security_ssl_labs
{
url: string,
email: string, // required by API
maxAge?: number, // cached report age in hours
startNew?: boolean, // force new assessment
waitForComplete?: boolean, // wait for completion (can take 2-5 min)
maxWaitMinutes?: number // default: 5
}
// Returns: Grade (A+ to F), endpoint details, protocol info, statusCategory Runners (4)
validate_all_performance
{
url: string,
pagespeedApiKey?: string,
gtmetrixApiKey?: string,
webpagetestEnabled?: boolean, // enable browser automation
webpagetestWaitForResults?: boolean // wait for WPT completion
}
// Returns: Results from PageSpeed + optionally WebPageTest + optionally GTmetrixvalidate_all_accessibility
{
url: string,
waveApiKey?: string, // optional
wcagLevel?: string // for Axe
}
// Returns: Results from Axe + optionally WAVEvalidate_all_seo
{
url: string
}
// Returns: SEO analysis from PageSpeed Insights (Lighthouse SEO)validate_all_security
{
url: string,
email: string, // for SSL Labs
waitForSSL?: boolean // wait for SSL Labs completion
}
// Returns: Results from Mozilla Observatory + SSL LabsMaster Runner (1)
validate_comprehensive
{
url: string,
email: string, // required for SSL Labs
categories?: string[], // ['performance', 'accessibility', 'seo', 'security']
pagespeedApiKey?: string,
gtmetrixApiKey?: string,
waveApiKey?: string,
wcagLevel?: string,
waitForSSL?: boolean
}
// Returns: Complete analysis across all selected categories with overall health scoreResponse Format
{
"tool": "webpagetest",
"success": true,
"url": "https://example.com",
"test_id": "250107_AiDcA4_ABC",
"results_url": "https://www.webpagetest.org/result/250107_AiDcA4_ABC/",
"status": "complete",
"summary": {
"loadTime": 2500,
"firstContentfulPaint": 1200,
"speedIndex": 2300,
"largestContentfulPaint": 2100,
"timeToInteractive": 3500,
"totalBlockingTime": 250,
"cumulativeLayoutShift": 0.05
},
"performance_grade": "A",
"security_grade": "A+"
}Implementation Status
✅ Fully Implemented (9 tools)
validate_performance_pagespeed- Google PageSpeed Insights APIvalidate_performance_webpagetest- Playwright browser automation ✨validate_performance_gtmetrix- GTmetrix APIvalidate_accessibility_axe- Playwright + axe-corevalidate_accessibility_wave- WAVE APIvalidate_security_mozilla_observatory- Mozilla Observatory APIvalidate_security_ssl_labs- SSL Labs API with pollingvalidate_all_*- All 4 category orchestratorsvalidate_comprehensive- Master orchestrator
✅ All Tools Functional
No placeholders - all 11 tools are fully implemented and working!
API Quotas & Limits
Tool | Free Limit | API Key Required | Implementation |
Mozilla Observatory | 1 scan/min per domain | No | ✅ Direct API |
SSL Labs | Unlimited (rate limited) | Email only | ✅ Direct API |
PageSpeed Insights | 25,000/day | Optional (free) | ✅ Direct API |
WebPageTest | 300/month | No | ✅ Browser automation |
GTmetrix | Limited credits | Yes (free tier) | ✅ Direct API |
Axe | Unlimited | No | ✅ Browser automation |
WAVE | Varies by plan | Yes (paid) | ✅ Direct API |
Browser Automation
WebPageTest and Axe use Playwright for headless browser automation:
Singleton browser instance - Reused across tests for efficiency
Configurable timeouts - Default 5 minutes for WebPageTest, 1 minute for Axe
Graceful cleanup - Browser closed on MCP server shutdown
No API keys needed - Free access via web UI automation
Project Structure
webby/
├── src/
│ ├── performance/
│ │ ├── pagespeed.ts ✅ Google API
│ │ ├── webpagetest.ts ✅ Playwright automation
│ │ └── gtmetrix.ts ✅ GTmetrix API
│ ├── accessibility/
│ │ ├── axe.ts ✅ Playwright + axe-core
│ │ └── wave.ts ✅ WAVE API
│ ├── security/
│ │ ├── mozilla-observatory.ts ✅ Mozilla API
│ │ └── ssl-labs.ts ✅ SSL Labs API + polling
│ ├── shared/
│ │ └── browser-utils.ts ✅ Playwright utilities
│ └── orchestrator/
│ └── run-all.ts ✅ All orchestrators
├── dist/ # Compiled JavaScript
├── index.ts # Main MCP server entry
├── package.json
└── README.mdUsage Examples
Quick WebPageTest (instant response)
validate_performance_webpagetest("https://example.com")
// Returns test ID immediately, check results later at provided URLComplete WebPageTest (wait for results)
validate_performance_webpagetest("https://example.com", {
waitForResults: true,
timeout: 300000 // 5 minutes
})
// Waits for test completion, returns full metricsRun all performance tests
validate_all_performance("https://example.com", {
webpagetestEnabled: true, // Enable browser automation
webpagetestWaitForResults: false // Get test ID instantly
})
// Returns: PageSpeed + WebPageTest resultsComprehensive validation
validate_comprehensive("https://example.com", {
email: "your@email.com", // For SSL Labs
categories: ["performance", "security"],
webpagetestEnabled: true
})
// Returns: Full analysis with overall health scoreLicense
MIT
Available Tools
12 toolsvalidate_accessibility_axeB
Analyze website accessibility using Axe. Free, open-source, finds ~57% of WCAG issues with zero false positives.
Inputs: url (required), wcagLevel.
validate_accessibility_waveC
Analyze website accessibility using WAVE. Tests WCAG compliance, errors, and contrast issues. Requires API key.
Inputs: url (required), apiKey (required), reporttype.
validate_all_accessibilityC
Run all accessibility tests (Axe + optionally WAVE if API key provided).
Inputs: url (required), waveApiKey, wcagLevel.
validate_all_performanceB
Run all available performance tests (PageSpeed Insights + optionally WebPageTest + optionally GTmetrix).
Inputs: url (required), pagespeedApiKey, gtmetrixApiKey, webpagetestEnabled, +1 more.
validate_all_securityB
Run all security tests (Mozilla Observatory + SSL Labs).
Inputs: url (required), email (required), waitForSSL.
validate_all_seoC
Run SEO analysis using PageSpeed Insights (includes Lighthouse SEO).
Inputs: url (required).
validate_comprehensiveC
Run comprehensive validation across all categories (performance, accessibility, SEO, security).
Inputs: url (required), email (required), categories, pagespeedApiKey, +4 more.
validate_performance_gtmetrixC
Analyze website performance using GTmetrix. Requires API key (free tier available).
Inputs: url (required), apiKey (required), location, browser.
validate_performance_pagespeedA
Analyze website performance using Google PageSpeed Insights. Returns Core Web Vitals and performance scores. Free API with 25K requests/day.
Inputs: url (required), strategy, apiKey.
validate_performance_webpagetestA
Analyze website performance using WebPageTest via browser automation. Free 300 tests/month. Returns test ID immediately or waits for full results.
Inputs: url (required), location, runs, waitForResults, +1 more.
validate_security_mozilla_observatoryB
Analyze HTTP security headers using Mozilla Observatory. Tests CSP, HSTS, etc. Free API, 1 scan per minute per domain.
Inputs: url (required), forceRescan.
validate_security_ssl_labsA
Analyze SSL/TLS configuration using SSL Labs. Comprehensive certificate and protocol analysis. Long-running (may take minutes).
Inputs: url (required), email (required), maxAge, startNew, +2 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 12 tools
The tools have clear distinctions between categories (accessibility, performance, security, SEO) and specific tool implementations (e.g., Axe vs. WAVE), but there is significant overlap in the 'validate_all_' and 'validate_comprehensive' tools, which aggregate other tools and could cause confusion about when to use individual vs. bundled validations. The descriptions help clarify, but the redundancy creates ambiguity in tool selection.
All tool names follow a consistent 'validate_' prefix with descriptive suffixes (e.g., 'accessibility_axe', 'performance_pagespeed'), using snake_case uniformly. This predictable pattern makes it easy for agents to understand the purpose and category of each tool at a glance, with no deviations in naming style.
With 12 tools, the count is reasonable for a web validation server covering multiple domains (accessibility, performance, security, SEO), though it feels slightly heavy due to the inclusion of both individual and aggregated tools. The scope is well-defined, and each tool serves a specific purpose, but the aggregation tools add some bulk that might be streamlined.
The tool set provides comprehensive coverage for web validation, including multiple tools per category (e.g., three performance tools, two accessibility tools) and aggregated options for broader testing. There are no obvious gaps; agents can perform detailed or holistic validations across all key web quality aspects without dead ends.
Related MCP Connectors
Website health, SEO, security-header, SSL and broken-link audits for AI agents.
Website checker for AI coding agents. Measures your site in a real browser, with evidence.
Audit public webpages and supplied markup for HTML, CSS, SEO, JSON-LD, and link issues.
Continuous website testing by Validoria — monitor security, SEO, performance, and accessibility.