Website Audit MCP

An MCP server that audits any public website and reports, in plain English, what is costing its owner customers.

Ask your assistant to audit a site and you get a scored report back:

audit therecoveryoasis.com

Website audit: https://www.therecoveryoasis.com/
Score: 50/100 — 4 things on this page are costing you customers.

Speed — 0%
  ✗ The HTML alone is 920 KB
      Before a single image or script, the page document itself is this big.
  ✗ One image on this page is 3.2 MB
      Oversized images are the most common reason a site feels slow on a phone.

Getting in touch — 0%
  ✗ Nobody can tap to call you
      There's no tap-to-call link on this page. On a phone, every extra step
      between someone and your number costs you calls.

How the writing reads — 58%
  ! The writing leans generic
      A few stock marketing phrases showed up: holistic approach, transformative.

Install

Requires Node 18 or newer.

Claude Code

claude mcp add website-audit -- npx -y github:rolledoatmeals/website-audit-mcp

Claude Desktop, Cursor, or anything else that speaks MCP — add this to the config file:

{
  "mcpServers": {
    "website-audit": {
      "command": "npx",
      "args": ["-y", "github:rolledoatmeals/website-audit-mcp"]
    }
  }
}

Or clone it and run locally

git clone https://github.com/rolledoatmeals/website-audit-mcp
cd website-audit-mcp && npm install
claude mcp add website-audit -- node "$(pwd)/index.js"

Then ask: "audit example.com".

Related MCP server: sitehealth-mcp

What it checks

Six categories, each weighted so one weak area cannot sink the whole score.

It also detects the platform a site is built on, matching asset URLs rather than page copy so a site that merely mentions a platform by name is not misread.

Notes on accuracy

JavaScript-rendered pages are detected and flagged. A single-page app serves an almost empty HTML document, which would otherwise score well for being small. When that is detected the tool says so and skips the checks it cannot answer honestly, rather than reporting a flattering number.

Weight is measured, not guessed. HTML, scripts, stylesheets, and images are each fetched to read their real size.

One page at a time. This audits the URL you give it, not the whole site.

Security

The server fetches URLs you name, so it refuses anything that could reach a private network:

• HTTP and HTTPS only, ports 80 and 443 only

• DNS is resolved and private, loopback, link-local, and reserved ranges are rejected

• Every redirect hop is revalidated, so a public URL cannot redirect into a private one

• Response bodies are capped and all requests time out

Built by

Zachary Shepelsky — AI operations and automation, Tampa FL.

The same engine runs as a web tool at zacharyshep.com/audit.

MIT licensed.