# agent-audit [Health: Active]

**Category:** 🤖 Coding Agents  
**Repository:** https://github.com/fullstackdegen/agent-audit  
**GitHub Stars:** 4  
**npm Downloads (last month):** 222  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/agent-audit

## Description
Turn Lighthouse audits into coding-agent fix packs for Claude Code, Cursor, and Copilot.

## Tools
Capabilities this server exposes over MCP:

- **analyze_website_performance** — Runs Lighthouse and site intelligence against a target URL:

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "agent-audit": {
    "command": "npx",
    "args": ["-y","@fullstackdegen/agent-audit"],
    "env": {
      "LIGHTHOUSE_MCP_ALLOW_LOCALHOST": ""
    }
  }
}
```

**Requires environment variables:** `LIGHTHOUSE_MCP_ALLOW_LOCALHOST` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What agent-audit does

The agent-audit MCP server converts website audits into an issue backlog that a coding agent can inspect and act on. It combines Google Lighthouse results with bounded inspection of the audited page. The resulting report includes prioritized issues, evidence, suggested actions, acceptance criteria, and fix packs.

Audits cover mobile and desktop Lighthouse scores for Performance, Accessibility, Best Practices, and SEO. They also report distributions for FCP, Speed Index, LCP, TBT, and CLS. Page inspection adds checks for broken links, accessible link names, metadata, canonical tags, robots signals, JSON-LD, Open Graph data, indexability, images, assets, and LLM visibility. When enough page content is available, the report can also include a conservative `llms.txt` draft.

The agent-audit MCP server is intended for workflows where an agent will search a repository, make focused changes, rerun an audit, and compare the result with defined acceptance criteria.

## How it works

The `analyze_website_performance` tool accepts a URL and an optional audit mode. `fast` performs one mobile run and one desktop run. `reliable`, the default, performs three runs for each profile and reports medians with variability ranges.

Results are exposed as MCP `structuredContent` with schema validation, alongside Markdown generated from the same canonical report. Fix packs contain issue identifiers, priority, severity, affected profiles, repository search hints, implementation steps, acceptance criteria, and rerun guidance. Search hints are clues rather than guaranteed file paths, so the agent must inspect the repository before editing.

For implementation work, use `structuredContent` as the authoritative data and Markdown as the execution summary. A typical loop is to process fix packs by priority, map evidence to source files or components, apply one focused change, run repository tests, rerun the audit, and check the acceptance criteria.

## Setup and configuration

The package requires Node.js 20 or newer and Google Chrome or Chromium. Start the server with:

```bash
npx -y @fullstackdegen/agent-audit
```

It can be registered as a local stdio server in Claude Desktop, Claude Code, Codex, VS Code with GitHub Copilot, and Cursor. Cursor and other clients can pass `--local` when auditing a local application.

By default, only publicly routable HTTP and HTTPS URLs are accepted. Run the server with `--local`, or set `LIGHTHOUSE_MCP_ALLOW_LOCALHOST=true`, to permit `localhost`, `*.localhost`, `127.0.0.0/8`, and `::1`. Private network ranges, metadata addresses, and other non-public destinations remain blocked.

## Tools and capabilities

The agent-audit MCP server exposes `analyze_website_performance`. Its supported capabilities include:

- Running mobile and desktop Lighthouse audits.
- Repeating audits and reporting medians and variability.
- Inspecting same-origin page content with bounded fetch limits.
- Detecting performance, accessibility, SEO, indexability, asset, and AI-discovery issues.
- Returning structured fix packs with repository hints and verification steps.
- Producing schema-validated MCP output and equivalent Markdown.

## Limitations and notes

The server launches Chrome against user-provided URLs, so URL validation is part of its security model. It rejects unsupported protocols, embedded credentials, loopback targets unless local access is enabled, and addresses that resolve to private, link-local, multicast, reserved, or cloud-metadata networks.

Inspection is bounded by time, byte-size, and resource limits. Audit results can vary between runs; reliable mode exposes that variability but does not eliminate it. Fix-pack repository hints are not confirmed paths, and an audit report alone is not evidence that a code change is complete. The agent should rerun the audit and compare results with the stated criteria.

_Full upstream README: https://allmcps.com/mcp/agent-audit/readme_