webaudit-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@webaudit-mcpAudit https://web.dev for tracking tags and performance"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
webaudit-mcp
MCP server that audits any public web page for tracking tags, duplicate pixels, page weight, header hygiene, and lab performance, from inside Claude Code or Claude Desktop.
![]()
Screenshot | What it shows |
Real | |
The same smoke script pointed at |
Both screenshots are captured from real sessions on 2026-07-19 against the current build. The second one is a selling point, not an error state: point any tool at a private, broken, or non-HTML URL and you get a structured, actionable error, never a crash or a hang.
Error: Refusing to fetch "localhost": local targets are blocked (SSRF protection).Quickstart
Requires Node 20 or newer. From a clean clone:
git clone https://github.com/lpecom/webaudit-mcp.git webaudit-mcp
cd webaudit-mcp
npm install
npm run build # compiles TypeScript into dist/
npm test # 60 tests across 6 files, all offline, ~300 msStarting the server directly prints one line to stderr and then waits for an MCP client on stdio (stop it with Ctrl+C):
node dist/index.js
# webaudit-mcp running on stdio (7 tools registered)Claude Code:
claude mcp add webaudit -- node /absolute/path/to/webaudit-mcp/dist/index.jsClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"webaudit": {
"command": "node",
"args": ["/absolute/path/to/webaudit-mcp/dist/index.js"]
}
}
}Then ask: "Audit https://example.com" or "What tracking is installed on web.dev?"
Optional, only needed for measure_performance (lab Core Web Vitals):
npx playwright install chromiumTo see every tool fire against a live site without any MCP client:
npm run smoke -- https://web.devNo API keys, no environment variables, no configuration files.
Related MCP server: mcp-uimax
Why I built this
I have spent years on both sides of this problem: running Google Ads, Meta, and Taboola campaigns, and building the tracking under them myself (GA4, GTM, server-side events). Broken tracking silently burns ad budgets: a duplicate GA4 config doubles every metric, a leftover GTM container re-fires conversions, and nobody notices until the numbers stop making sense. The tools to check for it are scattered across browser extensions, PageSpeed, and manual view-source archaeology.
This server puts the whole check behind one conversational interface, built the way I think an MCP server should be: strict input validation, SSRF-guarded fetching, structured errors instead of crashes, and honest labels on every number (lab vs field, measured vs estimated). The report is written for a developer and a media buyer: which analytics and pixel IDs are installed and where, whether anything double-fires, what the page weighs, and how the response headers look.
Tool reference
All 7 tools take a single url argument (absolute http/https URL) and return Markdown.
Tool | What it does |
| One-shot report: tracking tags, duplicate risks, header hygiene, resource counts. Fast, no browser. |
| Static HTML scan for GA4, GTM, legacy UA, Google Ads, Meta Pixel, TikTok, LinkedIn Insight, Hotjar, Microsoft Clarity, server-side tagging, and consent platforms. Reports IDs and where each was found. |
| Flags double-initialized IDs, multiple GTM containers, GTM plus hardcoded GA4 double-fire patterns, duplicate pixel IDs, dead UA tags. |
| Headless-Chromium lab metrics: TTFB, FCP, LCP, CLS, load times, request count, transfer sizes. Clearly labeled lab data. |
| Counts and byte sizes of scripts, styles, images, fonts, and iframes referenced in the HTML; largest third-party scripts. |
| Caching, compression, HSTS, CSP, clickjacking, referrer policy. Informational grades with explanations, no synthetic scores. |
| Plain-language briefing on the tracking setup, written for a media buyer: what is installed, what it means for campaigns, consent posture, issues to raise. |
All example outputs below are real, captured 2026-07-19 against https://web.dev and trimmed for length.
audit_page
The one call to start with: combines the tracking scan, duplicate check, and header check in a single report.
# Audit of https://web.dev/
- HTTP status: 200
- HTML size: 130.7 KB
- Resources referenced in HTML: 14 (0 scripts, 4 stylesheets, 9 images, 0 fonts, 1 iframes; 5 third-party)
[tracking, duplicate, and header sections follow, same content as the
individual tools below, then pointers to the byte-level and lab tools]detect_tracking_tags
Static scan with evidence: every finding names the vendor, the extracted ID, and the exact place in the HTML that triggered it.
# Tracking tags on https://web.dev/
| Vendor | ID | Found in | Evidence |
|---|---|---|---|
| Google Tag Manager | GTM-MZWCJPP | inline script | `[], "gtm": [{"id": "GTM-MZWCJPP", "purpose": 0}], ...` |
## Distinct IDs
- Google Tag Manager: GTM-MZWCJPP
## Consent signals
- None detected. If this site serves EU users with these tags firing pre-consent,
that is a GDPR/ePrivacy problem.
_Static scan: 6 inline scripts and 0 external script tags inspected. Tags added
at runtime by GTM or a CMP are not visible to this scan._find_duplicate_tags
Checks for the patterns that double-count: the same GA4 ID initialized twice, multiple GTM containers, a hardcoded GA4 tag next to a GTM container, multiple Meta pixel IDs, the gtag.js loader included more than once, and leftover Universal Analytics tags. web.dev is clean:
# Duplicate-tag check for https://web.dev/
No duplicate IDs or double-fire patterns found across 3 detected tag reference(s).When something is found, each issue comes with a severity: HIGH (double-counting almost certain), MEDIUM (likely misconfiguration), INFO (verify manually).
measure_performance
Loads the page once in headless Chromium and reports what that load observed. Numbers vary run to run; the report says so.
# Lab performance metrics for https://web.dev/
**LAB DATA**: one headless-Chromium load from this machine. Not field data (no CrUX/RUM), no INP.
| Metric | Value |
|---|---|
| TTFB (time to first byte) | 495 ms |
| FCP (first contentful paint) | 764 ms |
| LCP (largest contentful paint) | 1.02 s |
| CLS (cumulative layout shift) | 0.088 |
| Load event | 2.34 s |
| Requests | 60 |
| Transferred (compressed) | 152.9 KB |
[transfer-by-initiator table and reference thresholds follow]analyze_page_weight
Static resource inventory with real byte measurements (capped, guarded requests; up to 30 resources, HEAD first, GET fallback):
# Page weight for https://web.dev/
- HTML document: 130.7 KB
- Resources referenced: 14 (0 scripts, 4 stylesheets, 9 images, 0 fonts, 1 iframes)
- Measured 14 of 14 resources: 1.42 MB totalNote the honest gap between this and measure_performance above: the static scan sees 14 referenced resources, the browser load makes 60 requests. JavaScript loads the rest, and each report tells you which view you are looking at.
check_headers
# Header check for https://web.dev/ (HTTP 200)
| Check | Grade | Value | Note |
|---|---|---|---|
| Cache-Control | [OK] | `no-cache, must-revalidate` | Caching policy declared. |
| Compression (Content-Encoding) | [OK] | `gzip` | Response compressed with gzip. |
| HSTS (Strict-Transport-Security) | [OK] | `max-age=63072000; includeSubdomains; preload` | HSTS present with a solid max-age. |
| Referrer-Policy | [MISSING] | n/a | Default referrer behavior leaks full URLs to third parties on some browsers. |
_Grades are informational statements about header presence, not a security score._tracking_summary
The same detection engine, rendered as a briefing for a non-developer. See the hero screenshot above for the full real output; the sections are: What is installed, What this means for media buying, Consent, Issues to raise.
How it works
src/
index.ts entry point: McpServer + stdio transport, registers the tools
tools.ts tool registration, zod input schemas, Markdown renderers,
error mapping (every failure becomes an isError result)
lib/
url-guard.ts SSRF checks: scheme, hostname denylist, private IP ranges, DNS
safe-fetch.ts hardened fetch: timeout, byte cap, manual redirects, content type
tracking.ts static tag detection (regex + node-html-parser) and duplicate analysis
page-weight.ts resource extraction and capped byte measurement
headers.ts response-header checks
performance.ts Playwright Chromium lab metrics
format.ts byte/ms formatting and grade markersSSRF protection is layered. url-guard runs two checks: a synchronous one (http/https only; localhost, .local, .internal, .home.arpa and similar hostnames refused; private, loopback, link-local, and CGNAT IP literals refused, for v4 and v6 including IPv4-mapped forms) and an asynchronous one that resolves the hostname with DNS and refuses if any returned address is private, so a public-looking hostname pointing at 192.168.x.x is also blocked. safe-fetch then follows redirects manually (max 5) and re-runs both checks on every hop, enforces a 15 s wall-clock timeout and a 5 MiB body cap, and rejects non-HTML content types for the HTML tools. Every outbound request in the codebase, including page-weight resource measurements, goes through this one client.
Static analysis vs browser analysis. Six of the seven tools parse the served HTML only: fast, no browser dependency, and honest about the boundary (every report footnotes that runtime-injected tags and JS-loaded resources are invisible to it). measure_performance is the one browser tool: it launches headless Chromium via Playwright, registers buffered PerformanceObservers before navigation, loads the page once, waits 3 s for LCP/CLS to settle, and reads the metrics out.
Graceful degradation without Chromium. Playwright is a devDependency and is imported dynamically only inside measure_performance. If the package or the browser binary is missing, the tool returns a structured error containing the exact fix (npx playwright install chromium) instead of crashing, and the other six tools are unaffected.
Tests
npm test runs 60 vitest tests in 6 files, entirely offline (network and DNS are mocked; nothing leaves the process):
url-guard.test.ts: scheme rejection, hostname denylist, private v4/v6 ranges including IPv4-mapped and CGNATsafe-fetch.test.ts: timeouts, byte-cap truncation, manual redirect following and re-validationtracking.test.ts: tag and consent detection plus duplicate analysis against synthetic fixtures (clean.html,duplicates.html,full-stack.html)page-weight.test.ts: resource extraction, third-party heuristic (includingco.uk-style domains), HEAD/GET measurement fallbackheaders.test.ts: grades for present, missing, and weak headerstools.test.ts: a real MCP client calling the real server over the SDK's in-memory transport, covering both success and error paths
npm run smoke -- <url> is the live counterpart: it drives the built stdio server with a real MCP client against a real site, on purpose.
Design decisions
Never throw from a handler. Every tool wraps its body in try/catch and converts
UrlGuardError,FetchError, andPerformanceUnavailableErrorinto MCPisErrorresults whose message says what to do next.Reports are Markdown a model can relay verbatim. The renderers produce tables and sections a client model can paste into an answer without rework, and each report ends with an honest footnote about what the scan could not see.
Bounded everything. 15 s request timeout, 5 MiB response cap, max 5 redirects, 30-resource measurement cap with concurrency 6, 10 s per-resource timeout, content-type enforcement for HTML tools. The numbers live as constants in
safe-fetch.tsandpage-weight.ts.Honest labels on every number. Lab data is stamped LAB DATA, static scans say they are static, the third-party classifier is documented as a heuristic in the report itself.
Playwright stays a devDependency so the core install is three runtime dependencies (
@modelcontextprotocol/sdk,node-html-parser,zod) and the browser tool degrades gracefully.
Built with the MCP TypeScript SDK (McpServer + registerTool, zod input schemas, stdio transport). Developed with Claude Code.
Limitations
Static scan.
detect_tracking_tags,find_duplicate_tags, andtracking_summaryread the served HTML only. Tags injected at runtime by GTM, a CMP after consent, or client-side routing are invisible to them. The reports say so explicitly.Lab data, not field data.
measure_performanceis one headless load from your machine: no INP (needs real interaction), no CrUX percentiles, and numbers vary run to run. Treat it as a smoke check, not a Core Web Vitals verdict.Single page scope. Every tool audits exactly the URL you give it. No crawling.
Third-party classification is a heuristic. Registrable-domain comparison without a full Public Suffix List;
foo.co.ukstyle domains are handled, exotic suffixes may misclassify.Transfer sizes can read 0 B. Cross-origin resources without
Timing-Allow-Originhide their size from the browser; page-weight measurements reflect what this client was served, which may differ from what your browser gets.Bot protection. Sites behind aggressive bot walls (Cloudflare challenges and similar) may serve this tool different HTML than they serve a real browser.
License
MIT license, see LICENSE.
Available Tools
7 toolsanalyze_page_weightAnalyze page weightA
Static page-weight analysis: counts and byte sizes of scripts, stylesheets, images, fonts and iframes referenced in the HTML, plus the largest third-party scripts. Measures up to 30 resources with capped, guarded requests.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well by disclosing the static nature, the 30-resource limit, and capped/guarded requests. It doesn't mention exact output format or edge cases, but overall provides meaningful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise, information-dense sentences with no fluff. It front-loads the core purpose and adds key constraints efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter tool with no output schema, the description adequately explains what is measured, resource categories, and limits. Return values are implied by 'counts and byte sizes', though nesting or exact response structure isn't specified. This is sufficient given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage for the single 'url' parameter with a clear description. The tool description adds no additional parameter-specific semantics, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs static page-weight analysis, enumerating specific resource categories (scripts, stylesheets, images, fonts, iframes) and largest third-party scripts. This distinguishes it from sibling tools like measure_performance or audit_page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for static resource-size analysis but does not explicitly state when to prefer it over alternatives or when not to use it. The cap of 30 resources hints at lightweight use, but no exclusions or comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_pageAudit a web pageA
One-shot audit of a URL: tracking tags, duplicate-tag risks, response-header hygiene, and resource counts, as a single readable report. Fast (no browser). For byte-level page weight use analyze_page_weight; for lab Core Web Vitals use measure_performance.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds important behavioral context: 'Fast (no browser)' conveys the non-browser, lightweight nature, and 'single readable report' indicates output format. It does not detail limitations or error cases, but the provided traits are valuable for tool selection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core function, and every sentence earns its place. It is concise, well-structured, and avoids unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description is complete: it lists the audit areas, states the output format, and clarifies how it differs from key sibling tools. The guidance is sufficient for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single required url parameter, so the schema already explains it. The description adds no extra parameter semantics beyond referencing 'URL', which is redundant with the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly defines the tool as a one-shot URL audit covering tracking tags, duplicate-tag risks, header hygiene, and resource counts. It distinguishes itself from sibling tools by naming specific alternatives for byte-level weight and lab Core Web Vitals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use this tool (one-shot comprehensive audit) and points to alternatives: 'For byte-level page weight use analyze_page_weight; for lab Core Web Vitals use measure_performance.' This is clear and practical.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_headersCheck response headersA
Inspect the page's HTTP response headers: caching policy, compression, HSTS, CSP, clickjacking protection, referrer policy, CDN presence. Informational grades with explanations, no synthetic scores.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral context by stating 'Informational grades with explanations, no synthetic scores,' disclosing the nature of the output and that it does not produce synthetic scores. Yet, with no annotations provided, it does not fully offset the burden: it fails to mention network-side effects (e.g., it makes a request), error handling, or any authorization requirements, which are relevant for a tool that fetches URLs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, the first listing the scope of inspection and the second clarifying the output style. Every word earns its place, and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no output schema), the description is largely complete: it states the purpose, the categories of headers analyzed, and the output format (grades with explanations). It lacks explicit notes on network behavior or edge cases, but these are not critical for a simple header-checking tool, and the output description compensates partially for the missing schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the only parameter (url) with a clear format and example. The description does not add new semantic details about the parameter beyond what the schema provides, so the baseline of 3 is appropriate given the 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Inspect') and resource ('the page's HTTP response headers'), and it enumerates the specific headers it analyzes (caching, HSTS, CSP, etc.). This distinguishes it from sibling tools like 'measure_performance' or 'detect_tracking_tags', which focus on different aspects of a page.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by listing the types of headers it checks (security, caching, CDN), which suggests it is used to audit these specific aspects. However, it does not explicitly state when to use this tool over alternatives or provide any exclusionary guidance, leaving the agent to infer the appropriate scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_tracking_tagsDetect tracking tagsA
Static scan of a page's HTML for analytics/advertising tags: GA4, Google Tag Manager, Universal Analytics, Google Ads, Meta Pixel, TikTok, LinkedIn Insight, Hotjar, Microsoft Clarity, server-side/first-party tagging, and consent platforms. Reports IDs and where each was found.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It discloses the 'static scan' nature (not rendering JS) and the output format ('reports IDs and where each was found'). It does not mention potential fetch behavior, rate limits, or failure modes, but the key behavioral trait is sufficiently conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and scope. The enumerated list of tag types is detailed but directly relevant, and the second sentence crisp describes output. No filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool without an output schema, the description sufficiently covers what it does, the method (static), and the output. It lacks detail on edge cases like redirects or dynamic content, but the 'static' qualifier preemptively clarifies limitations. Given the tool's simplicity, the description is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter (url) is fully described in the schema with a clear example, so schema coverage is 100%. The description adds no further parameter-specific detail, which is acceptable as the schema already provides adequate semantics. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('static scan') on a specific resource ('page's HTML') for a well-defined purpose (detecting analytics/advertising tags). The explicit list of supported tags and output details (IDs and locations) distinguishes it from sibling tools like find_duplicate_tags or tracking_summary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—when you need to detect tracking tags in a page's static HTML. However, it provides no explicit guidance on when not to use it or how it compares to alternatives such as find_duplicate_tags or tracking_summary, leaving the choice to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_duplicate_tagsFind duplicate tagsA
Flag duplicate GA4/GTM/pixel installations and double-fire patterns: same ID initialized twice, multiple containers, hardcoded GA4 next to GTM, multiple pixel IDs, legacy UA leftovers.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. It uses the verb 'flag', which suggests a read-only audit, and lists specific patterns it detects. However, it does not explicitly state that the tool is non-destructive, what permissions/authentication might be needed, whether it fetches the URL, or what the output format looks like. The lack of explicit disclosure for a read-only tool is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence that front-loads the action and then lists concrete examples of duplicate patterns. Every part adds value, with no filler or repetition, making it concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one parameter, no output schema), and the description explains the types of issues it surfaces comprehensively. However, it does not specify what the tool returns (e.g., a list, count, or report), which would be helpful given there is no output schema. Overall, it is mostly complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides a complete description for the single 'url' parameter (100% coverage), so the schema already carries the parameter documentation. The tool description does not add any extra meaning about how the URL is used or any additional parameter constraints, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Flag') and resource ('duplicate GA4/GTM/pixel installations and double-fire patterns'). It enumerates concrete examples of what it detects, effectively distinguishing it from sibling tools like detect_tracking_tags, which likely identify any tags, and tracking_summary, which likely aggregates tag data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for finding duplicate tag setups, but it does not explicitly state when to use it versus alternatives (e.g., 'use this when checking for double-firing, otherwise use detect_tracking_tags'). No 'when-not' or alternative references are given, so usage is only inferred from the content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
measure_performanceMeasure lab performanceA
Load the page in headless Chromium (Playwright) and capture lab metrics: TTFB, FCP, LCP, CLS, load times, request count and transfer sizes. Clearly labeled lab data, not field data. Requires the Playwright Chromium browser; returns the install command if missing.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It explains that Playwright is required, that the tool returns an install command if missing, and that the data is lab data. This gives useful context beyond the basic action, though it does not cover every possible behavior like output format or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the action, and every sentence adds value without redundancy. It is concise yet comprehensive for its scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter and no output schema, the description is fairly complete: it names the metrics captured, the dependency, and the failure mode. However, it does not describe the exact return format on success, which would be helpful since there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description covers 100% of the single parameter (url) with type and example. The description adds no extra parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Load the page... and capture') with a clear resource and explicit list of metrics (TTFB, FCP, LCP, CLS, load times, request count, transfer sizes). This distinguishes it from sibling tools like analyze_page_weight or check_headers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies this returns lab data, not field data, and states the prerequisite of the Playwright Chromium browser. However, it does not name alternative sibling tools or explicitly state when to use this tool over them, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tracking_summaryTracking setup summaryA
Plain-language summary of a site's tracking setup written for a media buyer or marketer: what is installed, what it means for campaigns, consent posture, and issues to raise with the dev team.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Absolute http(s) URL of the page to audit, e.g. https://example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the transparency burden. It clearly discloses the output's content and perspective (plain-language, marketing-focused) and mentions surfacing issues for the dev team. It does not state whether the tool performs a live fetch or side effects, but 'summary' strongly implies a read-only operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence with a colon-separated list packs high information density without fluff. It is front-loaded with the key purpose and intended audience.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool, the description fully explains the deliverable and topics covered. It lacks return-format details and usage timing, but those are partially covered by the simple parameter and sibling context, making it adequate though not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With a single parameter and 100% schema coverage, the schema already defines 'url' as an absolute http(s) URL to audit. The tool description itself adds no further parameter-level detail, which is acceptable given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with 'Plain-language summary' naming the deliverable and audience (media buyer/marketer), and enumerates content areas: installed tracking, campaign implications, consent posture, and dev-team issues. This clearly distinguishes it from sibling tag-detection or performance-audit tools by its synthesizing role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use is stated, nor are alternative tools named. The audience and purpose are clear enough to imply use when a non-technical, synthesized summary is needed, but there is no exclusion guidance against using related tools like detect_tracking_tags.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v0.1.0- First observed
analyze_page_weight - First observed
audit_page - First observed
check_headers - First observed
detect_tracking_tags - First observed
find_duplicate_tags - First observed
measure_performance - First observed
tracking_summary
TDQS
Tools are mostly distinct with clear roles: audit_page is a composite overview while the others go deeper on specific aspects. The descriptions explicitly cross-reference each other, reducing ambiguity, though audit_page does overlap with several specialized tools.
Most names follow verb_noun convention (audit_page, detect_tracking_tags, find_duplicate_tags, measure_performance, analyze_page_weight, check_headers). tracking_summary breaks the pattern by being a noun phrase, causing a minor inconsistency.
Seven tools is well-scoped for a web audit server, covering tracking, performance, headers, and weight without redundancy or bloat. Each tool has a distinct purpose and contributes to the overall workflow.
The set covers the core audit lifecycle: detection, duplicate analysis, performance, page weight, headers, and a summary. Minor gaps exist (e.g., no field performance data or cookie inspection), but the provided tools handle the primary use cases effectively.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Run SEO + AI-visibility (GEO) audits from Claude, Cursor & other AI clients.
Validate HTML/CSS, audit SEO and JSON-LD, check links, and capture responsive screenshots.
Live SEO workflow tools for Claude Code, Codex, and AI agents.
Scan a web page for accessibility, security, privacy, quality and SEO issues, with fixes.
Related MCP Servers
- AlicenseAqualityDmaintenanceCore Web Vitals analysis powered by Lighthouse. Four tools: analyze a URL, compare two URLs, check against thresholds, or crawl an entire site. Works with Claude Code, Cursor, Windsurf, and any MCP-compatible AI tool.420MIT
- AlicenseBqualityCmaintenanceFrontend expert for Claude Code. Captures screenshots, runs Lighthouse + axe-core accessibility audits + code analysis, generates an expert review, and auto-fixes everything — 12 tools, completely free for Pro plan users.37639MIT
- FlicenseAqualityDmaintenanceEnables Claude Code to capture and analyze web page screenshots, responsive layouts, and page metadata using Puppeteer. It allows developers to perform visual UI inspections and compare designs across various viewports directly within the terminal.3-
- AlicenseAqualityCmaintenanceEnables auditing web pages for WCAG violations, applying deterministic fixes and PRs, all through MCP clients like Claude Desktop.7MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/lpecom/webaudit-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server