Website Auditor MCP

An MCP server for website-auditor.io — AI-visibility (GEO) and site-audit tools you can call from any MCP client (Claude Desktop, Claude Code, Cursor, and other agents).

Ask an agent "does ChatGPT recommend my business?", "what's my AI-visibility score?", "audit example.com", or "how do I stack up against my competitors?" and it answers with real data — an overall AI-visibility score (0–100), a per-engine breakdown across ChatGPT, Perplexity, Claude and Gemini, a full site audit (SEO, security, performance), competitor comparisons, and ongoing monitoring.

The server is a thin, authenticated wrapper over the Website Auditor API — the audit engine, AI-visibility scoring and monitoring live in that service; this server just makes them available to agents.

Tools

Install & configure

The server runs directly via npx — no clone or build required.

Try it before you buy it. Install with no API key at all and ask your agent for a sample audit — get_sample_audit returns a full report for example.com in the exact format a real run produces, so you can check the shape fits your needs first.

Pricing. Auditing real domains needs a Website Auditor subscription at $10/month — eligible new customers get a 7-day free trial (payment method required to start; no charge until the trial ends; customers who used a trial in the last 12 months are billed immediately). Sign up and create an API key at api.website-auditor.io/admin_portal, then set it as WA_API_KEY below. There is no free API tier — a key only functions with an active subscription.

Claude Desktop (claude_desktop_config.json), Cursor (~/.cursor/mcp.json), and most other clients use the same mcpServers shape:

{
  "mcpServers": {
    "website-auditor": {
      "command": "npx",
      "args": ["-y", "website-auditor-mcp"],
      "env": {
        "WA_API_KEY": "wa_your_key_here"
      }
    }
  }
}

Claude Code — add it from the CLI:

claude mcp add website-auditor -e WA_API_KEY=wa_your_key_here -- npx -y website-auditor-mcp

Restart the client and the tools appear.

Getting an API key

WA_API_KEY is a per-user key (it starts with wa_) minted from a Website Auditor account at api.website-auditor.io/admin_portal — the admin portal, where you subscribe and manage keys.

Minting a key requires an active subscription ($10/month; eligible new customers get a 7-day free trial — payment method required, no charge until the trial ends): there is no free API tier, so every tool except get_sample_audit and check_upgrade_status needs one. get_sample_audit needs no key at all.

Treat the key like a password — set it only in your MCP client's env and never commit it.

Configuration (environment variables)

Only WA_API_KEY is normally needed; the rest have sensible defaults. See .env.example for the full list.

Auth & tiers

Your key is validated on every call. The Pro/free tier is resolved live from the API and cached briefly, so upgrades and downgrades take effect within about a minute:

• No key → get_sample_audit still works (that's the point of it); every other tool returns AUTH_REQUIRED with the price and a sign-up link.
• Revoked or unrecognized key → INVALID_KEY, carrying the API's own remediation ("generate a new key"). Distinct from PRO_REQUIRED: the fix is a new key, not a purchase.
• No active subscription (valid key, lapsed/canceled/never subscribed) → PRO_REQUIRED with the price and an upgrade link — there is no free API tier; check_upgrade_status still answers so the caller can learn why.
• Subscribed (status active or a trial in progress) → all tools.

Errors are normalized to stable codes agents can branch on — e.g. AUTH_REQUIRED, INVALID_KEY, PRO_REQUIRED, OVER_QUOTA, UNREACHABLE_DOMAIN, INVALID_INPUT, TIMEOUT. A domain that can't be reached returns UNREACHABLE_DOMAIN — never a fabricated score.

Develop

npm install
npm run build      # compile TypeScript → dist/
npm start          # serve over stdio
npm run dev        # run from source without building
npm test           # vitest
npm run typecheck

The suite is hermetic — the API client, subscription provider and meter are injected, and HTTP is mocked at the fetch boundary, so no network is touched.

Privacy Policy

Anonymous install id. When telemetry is enabled, the server generates a random UUID on first run and stores it at ~/.config/website-auditor-mcp/install-id (or $XDG_CONFIG_HOME), sending it with each event. It exists solely to tell one install restarting many times apart from many separate installs — without it, install counts are just restart counts. It is randomly generated, never derived from your machine, username or network, and is not a fingerprint. Setting WA_METRICS_DISABLED stops telemetry entirely: no id is generated and nothing is written to disk.

This connector talks to a single external service: the Website Auditor API at website-auditor.io. When you invoke a tool it sends only two things to that API:

• the target domain you asked to audit or monitor, and
• your API key (WA_API_KEY), used to authenticate the request and resolve your plan tier.

That's the full extent of what leaves your machine. The connector does not collect, store, or transmit your files, prompts, conversation content, or any other personal data, and it does not send data to any third party beyond the Website Auditor API. Your API key is held only in your MCP client's configuration (in Claude Desktop it is stored in the OS keychain and injected as an environment variable); it is never written to the bundle or logged.

Anonymous, aggregate usage telemetry (which tool ran, success/failure, latency — no domains, no keys, no personal data) may be emitted to improve the service, and can be disabled entirely by setting WA_METRICS_DISABLED=1. Installed as a desktop extension, the same opt-out is a "Disable anonymous usage telemetry" checkbox in the extension's settings.

Full privacy policy: https://website-auditor.io/privacy

License

Elastic License 2.0 — © 2026 Kevin Armstrong / SpikeyCoder.

Learn more at website-auditor.io.