WSG-Check

Check a website against automated heuristics based on the W3C Web Sustainability Guidelines. Get a weighted score, recommendations, and reports in terminal, JSON, Markdown, or HTML format through a CLI or a Next.js web app.

Release status

The latest release is v0.6.0.

It targets WSG July-2026 (Group Note Draft). It includes an MCP server for AI assistants, with the check_url, list_guidelines, and get_guideline tools, listed in the MCP Registry as io.github.ivanoats/wsg-check. The server first shipped in v0.4.0; v0.3.0 was tagged on GitHub but not published to npm. See the changelog and spec versioning policy.

Scores from different spec versions should not be treated as directly comparable. The package version and check selection also matter when comparing reports.

Quick start

Requires Node.js 22 or later. Pin the released CLI for reproducible usage:

npx @sustainablewebsites/wsg-check@0.6.0 https://example.com # x-release-please-version

# Or install globally
npm install -g @sustainablewebsites/wsg-check@0.6.0 # x-release-please-version
wsg-check https://example.com --format json --output report.json

To run the current source, including unreleased features, use Node.js 22.22.1 or later (required by development tooling):

git clone https://github.com/ivanoats/wsg-check.git
cd wsg-check
npm ci             # prepare also generates Panda CSS tokens
npm run dev        # http://localhost:3000

# Build and run the CLI from this checkout
npm run build:cli
node dist/cli/index.js https://example.com

See CONTRIBUTING.md for environment configuration and development commands.

What the results mean

• Checks cover web development, UX, and hosting. The business category has no automated checks.
• Analysis uses fetched HTML and HTTP metadata; it does not render JavaScript, measure Core Web Vitals, or download every referenced asset.
• CO₂ estimates use HTML bytes and the SWD v4 model, not measured full-page energy consumption. Failed green-hosting lookups fall back to false.
• Report page weight is the HTML document size; resource and third-party counts come from references in the HTML. Referenced assets are not downloaded or measured.
• Security headers, form validation, native form features, and image alternative text remain visible as related checks, excluded from WSG scores.

CLI Usage

WSG-Check ships with a command-line tool that lets you check any website directly from your terminal or integrate checks into CI pipelines.

Basic usage

# Check a website with default (terminal) output
npx @sustainablewebsites/wsg-check https://example.com

# Output as JSON
npx @sustainablewebsites/wsg-check https://example.com --format json

# Save the report to a file
npx @sustainablewebsites/wsg-check https://example.com --format markdown --output report.md

# Fail the process (exit 1) if the score is below 70
npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 70

Options

CI integration

Use --fail-threshold to fail your pipeline when a site's sustainability score drops:

# .github/workflows/sustainability.yml
- name: Check sustainability
  run: npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 60 --format json --output wsg-report.json
- name: Upload report
  uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  with:
    name: wsg-report
    path: wsg-report.json

Exit codes

Use with AI assistants (MCP)

The package includes wsg-check-mcp, a Model Context Protocol server for Claude Code, Claude Desktop, VS Code, Cursor, and other MCP clients. It runs on your machine over stdio, with no account, port, or hosted service. Your assistant can then check a deployed site or your local dev server, look up guidelines, and fix what it finds.

# Claude Code
claude mcp add wsg-check -- npx -y -p @sustainablewebsites/wsg-check wsg-check-mcp

Claude Desktop (claude_desktop_config.json) and Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "wsg-check": {
      "command": "npx",
      "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"]
    }
  }
}

npx -y @sustainablewebsites/wsg-check --mcp starts the same server; it's the command the MCP Registry listing, io.github.ivanoats/wsg-check, uses.

VS Code (.vscode/mcp.json) uses a servers key:

{
  "servers": {
    "wsg-check": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"]
    }
  }
}

Try prompts such as "Check http://localhost:3000 against the WSG and fix the top three issues" or "Which WSG guidelines cover web fonts?"

Network access

• Local URLs are allowed by default, so http://localhost:3000 and other loopback addresses work without setup. The trade-off: text the assistant reads, such as a web page or a file in your project, could try to steer it into requesting a service on your machine. Requests are GET-only and the results go back to the assistant. If you don't check a local dev server, add --no-local after wsg-check-mcp in the arguments, or set WSG_CHECK_NO_LOCAL=1.
• Private networks (10/8, 172.16/12, 192.168/16) are blocked unless you add --allow-private-network or set WSG_CHECK_ALLOW_PRIVATE=1.
• The only other request check_url makes is a green-hosting lookup: it sends the hostname to the Green Web Foundation. Local hostnames are never sent.
• Cloud metadata and other reserved addresses are always blocked. Redirects from a public site into your machine or network are refused, and each connection is pinned to the address that was checked.

Agent skill

The repository also ships an Agent Skill, wsg-sustainability-review. It walks an assistant through checking a site, fixing the issues in your codebase in priority order, and checking again. It uses the MCP tools when they are configured and falls back to the CLI otherwise. Install it into Claude Code, Cursor, Copilot, and other agents with:

npx skills add ivanoats/wsg-check

REST API

The web app exposes Next.js Route Handlers:

Responses use CORS headers, shared error envelopes, and in-memory rate limiting. Stored results expire after one hour and the store holds at most 500 entries. Results and limits are not shared across server instances. The browser carries newly created reports through sessionStorage; result URLs are not durable share links. See runtime and storage.

Architecture and documentation

The CLI, web API, and MCP server share a TypeScript fetch → check → score → report pipeline. The code is layered and framework-independent at its core, with direct dependencies on concrete utility implementations. The architecture overview documents these boundaries and the external-I/O exceptions.

• Documentation index
• Architecture Decision Log (ADL) and ADR template
• Module and check reference
• WSG spec versioning
• Contributing, releasing, and changelog
• Executive summary and implementation plan — historical planning context; use the architecture overview for implemented behavior

License

Apache-2.0. See NOTICE and the Contributor License Agreement.