Sitelemetry
Privacy Sign in

Remote MCP / Authorized website audits

Website audit MCP server for AI assistants.

Choose the setup for your MCP client below. Sitelemetry audit calls are OAuth-protected and limited by your plan. Their checks are not meant to change the target website but can appear in its logs or alerts.

Connect a client Explore all tools
7audit tools
9report languages
0write or delete tools
6client setup options
Setup

Connect in minutes.

Sitelemetry gives compatible AI clients seven focused web-audit tools. The client sends a tool name, an explicit target and supported audit settings; Sitelemetry returns the full available audit evidence, prioritized findings and remediation guidance. Audit calls record usage and audit data in Sitelemetry; their checks are not meant to change the target website.

  1. 01
    Choose your client

    Use the general endpoint for Codex, Claude Code, Cursor and other compatible MCP clients, or connect through the Sitelemetry listing in ChatGPT or Claude.ai.

  2. 02
    Approve access

    Sign in to Sitelemetry and approve the audit scope in your browser.

  3. 03
    Ask for evidence

    For Codex and Claude Code, public audits can use public targets; protected scans need workspace verification. Claude.ai requires current ownership proof for the exact HTTPS target, except for the seven public security checks included in Free.

Long hosted audits continue in the background. Your assistant automatically checks the same job until the full result is ready, without starting another scan. The timeout settings below are optional.

Choose the source-private plugin for Cloud plus Local Agent, or keep the remote-only OAuth setup below.

OpenAI

Codex Marketplace

Cloud + Local
codex plugin marketplace add ozandikici/sitelemetry-plugins && codex plugin add sitelemetry@sitelemetry
OpenAI

Codex

OAuth 2.1

Add the server, then start the browser authorization flow once.

codex mcp add sitelemetry --url https://sitelemetry.com/mcp
codex mcp login sitelemetry
Optional timeout for long audits

Optional: allow 900 seconds (15 minutes) per tool call. Merge this into the existing Sitelemetry section in ~/.codex/config.toml, then restart Codex.

[mcp_servers.sitelemetry]
url = "https://sitelemetry.com/mcp"
tool_timeout_sec = 900
Codex MCP documentation

Choose the source-private plugin for Cloud plus Local Agent, or keep the remote-only OAuth setup below.

Anthropic

Claude Marketplace

Cloud + Local
claude plugin marketplace add ozandikici/sitelemetry-plugins && claude plugin install sitelemetry@sitelemetry
Anthropic

Claude Code

OAuth 2.1

Add the HTTP server, open /mcp in Claude Code and choose Authenticate for Sitelemetry.

claude mcp add --transport http sitelemetry https://sitelemetry.com/mcp
Optional timeout for long audits

Use a current Claude Code version. The optional timeout allows 900000 milliseconds (15 minutes) per tool call. If Sitelemetry is already configured, add timeout: 900000 to its existing server entry, then restart Claude Code.

Claude Code MCP documentation
Cursor

Cursor

OAuth 2.1

Add this entry to .cursor/mcp.json in your project, or ~/.cursor/mcp.json for all projects. Merge it with any existing mcpServers entries.

{
  "mcpServers": {
    "sitelemetry": {
      "url": "https://sitelemetry.com/mcp"
    }
  }
}

In Cursor's MCP settings, connect Sitelemetry. Sign in or create your Sitelemetry account in the browser, then approve access. OAuth handles sign-in; no API key is needed.

Optional timeout for long audits

Optional: if your client supports tool timeout settings, allow 15 minutes for long calls. Available settings and limits depend on the client version.

Cursor setup documentation
Anthropic

Claude.ai

OAuth 2.1

Open the Sitelemetry listing in Claude.ai and connect your account. Complete Sitelemetry authorization in your browser.

Connect in Claude.ai
Custom connector setup

If you need a custom connector, add the Claude endpoint below in Claude.ai's connector settings and complete authorization.

https://claude-mcp.sitelemetry.com/mcp
OpenAI

ChatGPT

OAuth 2.1

Open the Sitelemetry listing in ChatGPT, connect your account, and complete Sitelemetry authorization in your browser.

Connect in ChatGPT
Streamable HTTP

Other MCP clients

OAuth 2.1

Add a remote MCP server named Sitelemetry with the URL below. Select Streamable HTTP and OAuth if your client asks.

https://sitelemetry.com/mcp

Use a client that supports remote HTTP MCP and browser-based OAuth. Connect, sign in or create a Sitelemetry account, and approve access; the client then loads the available tools.

Good to know

OAuth clients receive a short-lived, audience-bound access token—not your Sitelemetry password, account API key or stored Google integration credentials.

API-key and CI use (for example the Sitelemetry GitHub Action) requires accepting the MCP authorization declaration once: open MCP in your Sitelemetry account, review the declaration next to the API key and accept it. OAuth connections record the same declaration when you approve access.

Single-package Local Agent

One source-private plugin registers Sitelemetry Cloud, a loopback-only Local Agent, and the audit/fix/re-test workflow.

The Local Agent connects only to localhost, 127.0.0.1 or ::1 and consumes no Sitelemetry Cloud scan quota. It does not send site data to Sitelemetry Cloud; audit requests and results return to your MCP client and may be processed by its model provider under your client/provider settings.

What it does

What the website audit MCP server does.

Sitelemetry is a website audit MCP server. Connect it once, then ask your AI assistant to audit a site in plain language. The assistant calls the matching tool for security, technical SEO, AI visibility, accessibility, performance or integrations, or audit_full to run all six in one call.

What is MCP? A plain-language guide

Findings with evidence and a fix

Each result lists findings with a severity, the evidence behind them, why they matter and a recommended fix, plus a score when the area could be measured.

OAuth sign-in, no API key

The clients in this guide connect with OAuth 2.1 and PKCE: you sign in to Sitelemetry in your browser and approve access. No API key goes into the client configuration.

Long audits stay one job

A long audit returns a job instead of a final result. The client checks that same job until the result is ready, without starting a second scan.

Reports in nine languages

Every tool takes a report language: English, Turkish, Spanish, German, French, Portuguese, Italian, Japanese or Chinese. Name the language in your prompt.

Limits

The Free plan covers security checks only. All six audit areas start at $49/month on the Starter plan.

Sitelemetry is not a penetration test. On an unverified site the default runs public checks only; on a site you have verified it can add active checks such as port and injection probes where your plan includes them.

Protected security modules depend on your plan. These modules and a six-area audit_full need the site to be verified in your Sitelemetry workspace. Claude.ai needs ownership proof for the exact HTTPS target, except for the public security checks included in Free.

SEO, AI visibility, accessibility and integrations audits read static HTML. Pages are not rendered in a browser, so content or tags that only JavaScript adds are not checked.

AI visibility scores how ready the pages are for AI answer engines. It does not query AI assistants and does not track mentions or citations.

Performance data comes from Google PageSpeed Insights, which fetches the public URL itself.

Tools

Seven audit tools: one per area, plus a full audit.

Every tool requires a target. Optional inputs are deliberately narrow and results are returned as concise text plus structured audit data.

audit_security

Security audit

Runs the security checks your plan includes. On an unverified site the default runs public checks only (DNS, email, domain, TLS, headers, HTTPS, technology) or does not start; on a verified site it can add active checks such as port and injection probes.

audit_seo

Technical SEO

Crawls public pages for indexation, metadata, headings, canonicals, structured data, internal-link failures, redirects and AI-crawler policy.

audit_ai_visibility

AI visibility

Assesses entity clarity, answerability, source signals, prompt coverage, llms.txt and crawler policy for AI search and answer engines.

audit_integrations

Analytics and tracking

Detects analytics, tag managers, marketing pixels, site-verification signals, consent systems and potential PII exposure in public data-layer output.

audit_accessibility

Accessibility

Runs a static WCAG 2.2-oriented review of alternative text, labels, headings, landmarks, contrast signals, language declarations, duplicate IDs and iframe titles.

audit_performance

Performance

Uses Google PageSpeed Insights, which fetches the requested public URL independently. Sitelemetry preflights the current redirect chain and accepts Lighthouse/CrUX metrics only when PSI's reported inspected/final URL remains inside the same safe host and port boundary.

audit_full

Full audit

Runs all six pillars in parallel, returns one blended score and summarizes every pillar. Use individual tools afterward when you need the full finding list for one discipline.

Prompts

Ask for an outcome, not a tool name.

A compatible client can choose the right Sitelemetry tool from your request.

One short prompt per area, plus a full audit. Replace example.com with a site you own or are authorized to audit.

01

Run a Sitelemetry security audit of example.com and list the findings by severity, each with its fix.

Security audit guide
02

Audit the technical SEO of example.com and group the fixes into crawlability, metadata, structured data and internal links.

Technical SEO audit guide
03

Check how easily AI answer engines can understand and cite example.com, then turn the top five gaps into tasks.

AI visibility guide
06

Review the analytics, tag and consent setup on example.com and flag gaps or personal data in the data layer.

Integrations audit guide
Safety

Target verification by client.

Sitelemetry is a defensive audit service, not an open scanning proxy.

Connecting MCP does not give an agent access to your hosting account, CMS, source code or Google account. The hosted tools never sign in to the target; their checks are not meant to change it but can appear in its logs or alerts.

Workspace verification

Codex, Claude Code and ChatGPT protected scans need workspace ownership verification. Claude.ai requires current ownership proof for the exact HTTPS target, except for the seven public security checks included in Free. A new verified site gets a monitoring project if a slot is available; it can still be audited when slots are full, within your plan's allowance. Verify ownership through Sitelemetry DNS or HTTP, or Google Search Console with siteOwner permission.

Bounded and accounted operation

Every successful call records Sitelemetry usage and audit/security state and consumes the applicable plan quota. Subscription entitlements, rate limits, concurrency controls and timeouts apply to remote calls; Sitelemetry-originated web requests also use server-side SSRF and redirect controls. PageSpeed's independent fetch and returned-result boundary are disclosed above.

Public audits and protected scans

Codex and Claude Code support public targets for eight public security checks, SEO, AI Visibility, Integrations, Accessibility and Performance. Protected security modules and Full Audit need workspace verification. Claude.ai requires current ownership proof for the exact HTTPS target, except for the seven public security checks included in Free.

No sign-in, no intended changes

The seven tools never sign in to the audited website or its connected accounts. Their checks send read-style requests and benign probes, including active checks on verified sites, that are not meant to change the site but can appear in its logs or alerts.

Data

Know what crosses the connection.

Sitelemetry receives MCP protocol traffic and the tool arguments your client sends: the requested tool, target, report language and any supported audit setting. It processes public technical responses and returns audit evidence to that client. It does not independently access the rest of your AI conversation.

Your chosen AI client provider receives the tool request and returned results as part of your conversation and handles them under its own terms and privacy policy. Sitelemetry may retain account, usage, security and audit records as described in the Privacy Policy; it does not sell personal information.

Privacy PolicyData categories, purposes, providers, retention and rights Terms of ServiceAuthorized-use rules and service limitations
FAQ

Website audit MCP server: common questions.

What is a website audit MCP server?

It is a service your AI assistant connects to through the Model Context Protocol (MCP). Sitelemetry's server gives the assistant seven audit tools, so you can ask in plain language for a security, SEO, AI visibility, accessibility, performance or integrations audit and get the findings back in the conversation.

What is MCP? A plain-language guide
Which AI assistants can use it?

This guide has setup steps for Codex, Claude Code, Cursor, Claude.ai and ChatGPT. Other clients that support remote MCP over Streamable HTTP with browser-based OAuth can connect to https://sitelemetry.com/mcp.

Do I need an API key?

Not for the clients in this guide. They sign in with OAuth 2.1: you log in to Sitelemetry in your browser and approve access, and the client receives a short-lived access token. No API key goes into the client configuration.

What does the Free plan include?

The Free plan covers security checks only: audit_security, and audit_full limited to its security part, run within a monthly security allowance. SEO, AI visibility, accessibility, performance and integrations need a paid plan, starting at $49/month with Starter. Protected security modules and a six-area audit_full also need a verified site.

Does it change my website or sign in to it?

It does not sign in to the audited site, and its checks are not meant to change anything on it. On a verified site they can include active checks such as port and injection probes, which can appear in its logs or alerts.

Is Sitelemetry a penetration test?

No. Sitelemetry is not a penetration test. On an unverified site the default runs public checks only; on a verified site it can add active checks such as port and injection probes where your plan includes them. A six-area audit_full also needs a verified site. Findings are point-in-time evidence to review and fix.

Access

Remote MCP transport is available to every account.

Any active, verified Sitelemetry account can connect through Remote MCP. Claude.ai lists all seven audit tools. Execution depends on the connected account's plan and remaining quota. Free runs audit_security, and audit_full limited to its security part, within its low monthly security allowance; the other audits (SEO, AI visibility, accessibility, performance, integrations and a six-area audit_full) require an eligible plan. Codex and Claude Code public audits do not require workspace target verification when available; protected security modules and a six-area audit_full do. Claude.ai requires current ownership proof for the exact HTTPS target, except for the seven public security checks included in Free. Account, usage and workspace limits apply to every call.

Compare plans Start with Professional

Verified sites, monitoring and usage

Verified domains define which targets are authorized. Monitoring projects store sites for ongoing tracking; project capacity is separate from domain verification. A full project slot does not by itself prevent audits of other verified sites. Audit permissions and remaining usage allowances still apply.

Understanding Sitelemetry access