# MCP Audit

> Free audit of a web page for AI agents: a three-pass headless-Chrome scan of WebMCP tool registrations (document.modelContext) against the W3C draft's threat model, plus an agent-readiness checklist (robots.txt and AI crawlers, llms.txt, sitemap, security.txt, page metadata). Every finding carries a citation, a fix and the vendor document behind it. Submit a URL at https://mcpaudit.online/ or POST {"url"} to https://mcpaudit.online/api/audit.

## Start here
- [Audit a site](https://mcpaudit.online/): paste a URL, get a report
- [Every check, explained](https://mcpaudit.online/checks): what each check detects, how to fix it, sources
- [Instructions for coding agents](https://mcpaudit.online/agent-instructions.md): copy into a repository so an agent generates robots.txt, llms.txt, sitemap, metadata and a safe WebMCP registration

## Reference
- [What is WebMCP](https://mcpaudit.online/webmcp): the API, the spec's own threat model, the audit methodology
- [WebMCP Builder](https://mcpaudit.online/builder): assemble a tool config, lint it against the real rulepack, export registerTool() code or the same tools as a stdio MCP server (Node.js or Python)
- [registerTool() code generator](https://mcpaudit.online/builder/javascript): Generate runnable document.modelContext.registerTool() JavaScript for every WebMCP tool, with input schemas, annotations, exposedTo and one AbortController to unregister them all.
- [WebMCP HTML snippet](https://mcpaudit.online/builder/html): Copy a ready <script type="module"> block that registers your WebMCP tools, with the origin-trial meta tag in front when you have a token.
- [WebMCP tool manifest (JSON)](https://mcpaudit.online/builder/manifest): Export your WebMCP tools as a JSON manifest: names, descriptions, input schemas, annotations and exposed origins, ready to import back or keep in version control.
- [MCP server generator: Node.js](https://mcpaudit.online/builder/mcp-server): Turn your tool definitions into an MCP server for Node.js on the official TypeScript SDK: local over stdio, or remote over Streamable HTTP with a Server Card, AI Catalog and llms.txt section.
- [MCP server generator: Python](https://mcpaudit.online/builder/mcp-server/python): Turn your tool definitions into an MCP server in Python on the official mcp SDK: local over stdio, or remote over Streamable HTTP with a Server Card, AI Catalog and llms.txt section.
- [Agent view: what the model reads](https://mcpaudit.online/builder/agent-view): See the exact tool list an AI agent receives from your page and how many characters and tokens it costs every session before the first call.
- [Demo page](https://mcpaudit.online/demo): a page that registers two tools, to see a live report
- [Agent-ready careers page](https://mcpaudit.online/demo/careers): a demo careers page for a fictional company with four WebMCP tools (list_open_roles, get_role, match_profile, apply_to_role with a human confirmation)

## API
- [POST https://mcpaudit.online/api/audit](https://mcpaudit.online/checks): body {"url": "https://example.com"}, returns {id, status_url}; GET https://mcpaudit.online/api/audit/<id> for status and report_url; GET https://mcpaudit.online/api/audit/<id>/result for the full JSON result (result.site.checks, result.findings)