Sitelemetry

What Sitelemetry MCP server does

The Sitelemetry MCP server exposes hosted audits for an explicit target URL and report language. Results organize findings by severity and include supporting evidence, likely impact, and a suggested remediation. The service is intended for websites and infrastructure that the connected user owns or is authorized to assess.

Security checks cover DNS, email authentication records, TLS, and HTTP security headers for any target. Verified hosts may also receive protected and active checks included by the account plan. These checks are non-intrusive, but active probes can appear in logs or alerts and are not equivalent to a penetration test.

The other audit areas examine technical SEO, AI search visibility, detected analytics and marketing integrations, static HTML accessibility signals, and performance metrics from Google PageSpeed Insights. A full audit combines every area available to the connected account and produces a combined score.

How it works

Sitelemetry runs as a hosted remote service at https://sitelemetry.com/mcp; this repository contains documentation rather than server source code. The transport is Streamable HTTP, and authentication uses OAuth 2.1 with PKCE. Clients open a browser sign-in flow, so no API key is added to the MCP configuration.

Every tool receives a target URL and report language. Long-running scans return a job, and the client checks that same job until completion rather than starting another scan. A client timeout of up to 15 minutes is recommended for long audits.

SEO, AI visibility, accessibility, and integrations checks read static HTML. They do not inspect content that is added only after browser-side JavaScript executes. Results are point-in-time evidence and do not prove that a site has no vulnerabilities.

Setup and configuration

Add the remote endpoint to an MCP client that supports Streamable HTTP and browser-based OAuth. VS Code, Cursor, Codex, and Claude Code have documented configurations. Other compatible clients can use a server named sitelemetry, the same URL, Streamable HTTP, and OAuth when those options are available.

A Sitelemetry account is required, and a new account can be created during sign-in. The connected account controls available audits and usage limits. The Free plan provides security audits with limited checks and a monthly allowance; SEO, AI visibility, integrations, accessibility, performance, and full audits require a paid plan.

Protected security modules and full audits require verification of the site in the Sitelemetry workspace through DNS TXT, an HTTP file, or Google Search Console. Private-network and cloud-metadata targets are blocked.

Tools and capabilities

• audit_security: Checks public security posture and, where permitted, additional verified-host checks.
• audit_seo: Crawls indexation, metadata, headings, canonicals, structured data, links, redirects, and AI-crawler policy.
• audit_ai_visibility: Reviews entity clarity, answerability, source signals, llms.txt, and AI-crawler policy.
• audit_integrations: Detects analytics, tag managers, marketing pixels, verification, and consent setup.
• audit_accessibility: Performs WCAG 2.2-oriented checks on static HTML.
• audit_performance: Reports Core Web Vitals and PageSpeed improvement opportunities.
• audit_full: Runs all audit areas included in the connected plan.

The Sitelemetry MCP server also accepts dotted tool aliases such as audit.security and audit.full.

Limitations and notes

Use the service only with authorized targets. Unverified security audits are limited to public checks, while active checks on verified hosts can generate operational alerts. Through the Claude.ai listing, audits other than public security checks require current ownership verification for the exact HTTPS target.

OAuth clients receive a short-lived, audience-bound token rather than the Sitelemetry password. Access can be revoked from the account's connected MCP applications settings.