Skip to main content
Glama
rolledoatmeals

website-audit

Website Audit MCP

An MCP server that audits any public website and reports, in plain English, what is costing its owner customers.

Ask your assistant to audit a site and you get a scored report back:

audit therecoveryoasis.com
Website audit: https://www.therecoveryoasis.com/
Score: 50/100 — 4 things on this page are costing you customers.

Speed — 0%
  ✗ The HTML alone is 920 KB
      Before a single image or script, the page document itself is this big.
  ✗ One image on this page is 3.2 MB
      Oversized images are the most common reason a site feels slow on a phone.

Getting in touch — 0%
  ✗ Nobody can tap to call you
      There's no tap-to-call link on this page. On a phone, every extra step
      between someone and your number costs you calls.

How the writing reads — 58%
  ! The writing leans generic
      A few stock marketing phrases showed up: holistic approach, transformative.

Install

Requires Node 18 or newer.

Claude Code

claude mcp add website-audit -- npx -y github:rolledoatmeals/website-audit-mcp

Claude Desktop, Cursor, or anything else that speaks MCP — add this to the config file:

{
  "mcpServers": {
    "website-audit": {
      "command": "npx",
      "args": ["-y", "github:rolledoatmeals/website-audit-mcp"]
    }
  }
}

Or clone it and run locally

git clone https://github.com/rolledoatmeals/website-audit-mcp
cd website-audit-mcp && npm install
claude mcp add website-audit -- node "$(pwd)/index.js"

Then ask: "audit example.com".

Related MCP server: sitehealth-mcp

It works out what kind of site it is

A missing phone number is a serious finding for a body shop and a non-issue for a portfolio. So the tool works out whether it is looking at a local business, an online store, a portfolio, or a software product, and scores accordingly. It tells you what it decided and why:

Type: Local business — detected from AutoRepair schema markup

If it guesses wrong, pass the type yourself:

audit example.com as a portfolio

Online stores get product-schema and returns-policy checks. Software products get checked for a clear sign-up path and visible pricing. Portfolios get checked for shown work and profile links, and are not penalised for having no street address.

What it checks

Six categories, each weighted so one weak area cannot sink the whole score.

Category

Looks at

Speed

HTML size, total download weight including scripts and stylesheets, oversized images, compression, server response time

Phone experience

Viewport, whether the page is blank until JavaScript runs, missing alt text

Getting found

Title and description quality, H1, structured data, Open Graph tags, sitemap

Getting in touch

Tap-to-call, contact form, email address, a readable street address, HTTPS

How the writing reads

Stock AI-marketing vocabulary, em-dash density, "not just X but Y" patterns, exclamation spam, leftover placeholder text

How current it looks

<center> and <font> tags, table layouts, Flash remnants, ancient jQuery, Bootstrap 3, modern image formats, lazy loading

It also detects the platform a site is built on, matching asset URLs rather than page copy so a site that merely mentions a platform by name is not misread.

Notes on accuracy

JavaScript-rendered pages are detected and flagged. A single-page app serves an almost empty HTML document, which would otherwise score well for being small. When that is detected the tool says so and skips the checks it cannot answer honestly, rather than reporting a flattering number.

Weight is measured, not guessed. HTML, scripts, stylesheets, and images are each fetched to read their real size.

One page at a time. This audits the URL you give it, not the whole site.

Security

The server fetches URLs you name, so it refuses anything that could reach a private network:

  • HTTP and HTTPS only, ports 80 and 443 only

  • DNS is resolved and private, loopback, link-local, and reserved ranges are rejected

  • Every redirect hop is revalidated, so a public URL cannot redirect into a private one

  • Response bodies are capped and all requests time out

Built by

Zachary Shepelsky — AI operations and automation, Tampa FL.

The same engine runs as a web tool at zacharyshep.com/audit.

MIT licensed.

Available Tools

1 tool
audit_websiteAudit a websiteA

Audit any public website and report what is costing its owner customers. Checks page speed and weight, whether it works on a phone, whether search engines can read it, whether a visitor can actually get in touch, whether the copy reads like AI wrote it, and whether the build looks dated. Returns a 0-100 score with findings grouped by category.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe website address to audit, for example "example.com" or "https://example.com".

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does disclose the output format (0-100 score, findings grouped by category) and the nature of the analysis. However, it never explicitly states that the tool makes network requests to the target site, whether it is read-only, or how it handles failures like downtime, password-protected pages, or non-existent domains. These are meaningful gaps for an audit tool that fetches remote content.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than a headline but every clause earns its place: the purpose is stated first, followed by a compact list of the checks, then the scoring output. The enumerations are comma-separated and easy to parse quickly. It is dense but not padded, and the key output information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the description correctly takes on the job of explaining return values, and it does — a 0-100 score with findings grouped by category. For a single-parameter, non-nested tool, the description covers the checks, output, and scope. It only misses edge-case behavior (unreachable sites, slow audits), which is minor given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single url parameter is already well documented in the schema with examples and format ('example.com' or 'https://example.com'). The description reinforces that the target must be a public website, which is a minor addition. Per the baseline for full schema coverage, 3 is appropriate — the schema does the heavy lifting for the sole parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (audit) plus a well-defined resource (any public website) and a clear outcome (report what is costing its owner customers). It goes further by enumerating the concrete checks performed — page speed, mobile-friendliness, SEO readability, contactability, AI-sounding copy, and dated-looking build — and the 0-100 scoring output. This is specific enough for an agent to know exactly what the tool does and what it returns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There are no sibling tools to differentiate from, so the absence of explicit exclusions is acceptable. The description clearly scopes when to use it — any public website — and the enumerated checks imply the use case: understanding conversion/revenue problems from an owner's perspective. It lacks an explicit 'use this when…' statement, but for an isolated tool the context is clear and complete enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.0.0
    • First observedaudit_website

TDQS

A4/5.0

Scored across 1 tool

Disambiguation5/5

With only one tool, there is no possibility of confusion or overlap. The tool's purpose is clearly defined and distinct.

Naming Consistency5/5

The single tool name 'audit_website' follows a clear verb_noun convention and is immediately understandable.

Tool Count3/5

A single tool feels thin for a server claiming to audit multiple aspects of a website. However, the tool bundles all checks into one comprehensive call, so it may be acceptable for a focused utility.

Completeness4/5

The tool covers a wide range of audit dimensions (speed, mobile, SEO, contact, AI copy, design) and returns a score with categorized findings. Minor gaps exist, such as no way to drill into individual metrics or get historical data, but the core audit lifecycle is complete.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Audit any website for privacy, security, accessibility, and performance issues — with scores, grades, and actionable fix instructions. No account required.
    3
    10 npm
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Performs comprehensive website health audits including SSL, DNS, email authentication, performance, uptime, and broken link checks, all without requiring API keys. Returns a scored report with weighted metrics and actionable recommendations.
    7
    71 npm
    MIT