CertScore MCP

What CertScore MCP MCP server does

CertScore MCP provides agent access to CertScore.ai’s public website scanning service through MCP Light. The service examines publicly reachable websites for potential privacy, cookie, tracker, consent, policy, regulatory-review, HTTPS/TLS, and eligible Reject Path signals.

A scan produces a CertScore score along with evidence-backed findings for human or agent review. The integration is intended for monitoring and risk review, not for issuing legal certification or determining compliance.

How it works

The hosted endpoint is available at https://mcp.certscore.ai/mcp/light. An MCP-compatible client connects to that endpoint and exposes the available CertScore MCP MCP server tools to an agent. The service does not require authentication for MCP Light, according to the provided project documentation.

An agent can request a review of a public URL, then use the returned information to discuss the score, findings, supporting evidence, available Reject Path observations, coverage limitations, and report URL. The target site must be publicly accessible for the scan to inspect it.

Setup and configuration

For hosted use, configure the MCP client with the CertScore.ai MCP Light endpoint. The repository includes a Cursor installation link and identifies Cursor as a supported setup path. No environment variables or local database, storage bucket, browser installation, or worker process are required to use the hosted MCP Light service.

The repository also contains the larger CertScore monorepo, including a web application, validation worker, PostgreSQL helpers, and S3-compatible storage configuration. Those settings apply to local development and the product runtime, not to a client connecting to the hosted no-auth MCP Light endpoint. The documented local application variables include database, authentication, Google OAuth, object storage, and validation settings, but they are not required for hosted MCP use.

Tools and capabilities

The provided description identifies three MCP capabilities:

• Create a scan for a public domain or URL.
• Retrieve scan findings and their supporting evidence.
• Look up domain information.

The scanning scope includes privacy and related web risk signals. Results may include a score, evidence, policy or consent observations, tracker and cookie signals, HTTPS/TLS observations, regulatory-review indicators, and eligible post-refusal Reject Path observations.

Limitations and notes

CertScore MCP is designed to surface risk signals from public websites. Its output is not legal advice, a certification, or a compliance determination. Evidence and findings should therefore be reviewed by people who understand the site, its policies, and the relevant requirements.

Coverage is limited to what the service can observe from the public target and the checks it performs. An agent should report coverage limitations instead of presenting a scan as exhaustive. The provided material does not document private-site scanning, authenticated crawling, or guarantees about detecting every issue.

The repository describes MCP Light as a free hosted integration with no authentication. It also documents a broader product and self-hosted development environment, but does not provide enough information here to treat those local components as required for the MCP endpoint.