Webskan for developers · remote MCP server
Check the site your agent just shipped
Your coding agent deploys the site, then calls Webskan: a 30-second Lighthouse scan, a full technical audit of the whole site in a real mobile browser, and a re-check that says what was fixed, what is still open and what is new. Every finding has a stable id, so the agent can fix it and prove it. No sign-up, no key for the free plan.
claude mcp add --transport http webskan https://webskan.com/mcp- Claude Code
- Cursor
- Codex CLI
- VS Code / GitHub Copilot
- Windsurf
- any MCP client with Streamable HTTP
Endpoint https://webskan.com/mcp · Streamable HTTP, stateless · Public websites only · Real Chrome, Pixel 7 emulation · Google Lighthouse and axe-core (WCAG 2.1 AA)
Why not just run Lighthouse locally?
Lighthouse measures one page. A freshly shipped site breaks in other places: a noindex left over from staging, a contact form that is not labelled, a cookie banner that covers the content on a phone, a 404 page with no way out, a cart that cannot reach the checkout. Webskan crawls the whole public site and clicks through it like a customer, from the outside, the way Google and your users see it.
Lighthouse, mobile and desktop
Performance, accessibility, best practices and SEO scores plus LCP, CLS, TBT, page weight and request count. Measured in a real Chrome with simulated 4G throttling, mobile and desktop profiles.
Crawl of up to 30 pages
Pages from navigation and the sitemap. For each: title, description, headings, canonical, indexing, language, structured data, response errors, duplicate titles across pages.
Accessibility with axe-core
WCAG 2.1 AA rules on the key pages, with the selector and the HTML of every failing element, so the agent can go straight to the code.
Security headers and TLS
CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, certificate validity and expiry, leaked server details.
Broken links
Up to 500 internal and external links, each broken one reported with the page it sits on.
Forms and cookie banner
Unlabelled fields, missing consent, no spam protection, too many fields, a banner that blocks the content, horizontal overflow on a phone.
Customer journeys
On an emulated phone: the 404 page, the menu, the site search and, in shops, product → cart → checkout (no payment, no data entered).
Stable ids and a real diff
Over 60 finding types, each with a stable id such as seo.title.missing@/about, plus one id per axe-core rule and page. The re-check compares by id: fixed, still open, new.
The four tools
Tool names and fields are fixed; the server also returns a short Markdown summary written for an agent, so the model does not have to parse JSON.
scan_website – quick scan, result in about 30 seconds
Input: url. Returns: mobile Lighthouse scores, metrics (LCP, CLS, TBT, weight, requests), a list of basic issues with codes, and a resultUrl you can open in a browser. Results for the same host are cached for 24 hours (cached: true). If the scan takes longer than 90 seconds the tool returns status: "pending" and a scanId; call it again in 30 seconds.
“Scan https://mysite.com and tell me the mobile Lighthouse scores and the biggest issue.”
audit_website – whole-site audit
Input: url, optional pages (1–30, default 15). Returns immediately: auditId, status: "queued", etaSeconds and pollWith: "get_audit". The audit runs in a real browser and usually takes a few minutes, depending on the number of pages and how fast the site is.
“Audit https://mysite.com with 20 pages and wait for the result.”
get_audit – status or result
Input: auditId. Returns: the status while the audit runs; when done, summary (counts by severity), lighthouse (mobile and desktop), findings sorted high → low (each with id, area, severity, title, detail, pages), pagesCrawled and finalUrl. For a re-check it also returns diff: fixed, open, new, unverified and Lighthouse scores before and after.
“Get audit 3f9a… and list the high-severity findings with the files I need to touch.”
recheck_website – the same audit again, with a diff
Input: auditId of the earlier audit. Returns like audit_website: a new auditId linked to the parent. Same URL, same number of pages, so the comparison is exact. Lighthouse metrics are shown as before → after rather than as fixed or new, because they vary by a few points between runs.
“Audit https://mysite.com and fix the high-severity findings, then recheck.”
The loop an agent runs
Audit
audit_website, then get_audit until status is done.
Fix by id
Work through high and medium findings. Each has the page, the detail and, for accessibility, the selector and HTML.
Re-check and report
Deploy, recheck_website, read diff.fixed and diff.open. What is still open goes into the next commit or the hand-off note.
Install
One endpoint for every client: https://webskan.com/mcp. Streamable HTTP, no session, no key required. Pick your client and paste.
Claude Code
claude mcp add --transport http webskan https://webskan.com/mcpOr install the plugin, which adds the server and a /webskan:site-check skill: /plugin marketplace add kamilobstawskiagent-ux/webskan-claude-plugin then /plugin install webskan@webskan. Source: github.com/kamilobstawskiagent-ux/webskan-claude-plugin.
Cursor
Project file .cursor/mcp.json (or ~/.cursor/mcp.json for all projects):
{
"mcpServers": {
"webskan": {
"url": "https://webskan.com/mcp"
}
}
}VS Code with GitHub Copilot
Project file .vscode/mcp.json:
{
"servers": {
"webskan": {
"type": "http",
"url": "https://webskan.com/mcp"
}
}
}Codex CLI
codex mcp add webskan --url https://webskan.com/mcpOr in ~/.codex/config.toml:
[mcp_servers.webskan]
url = "https://webskan.com/mcp"Windsurf and other clients
Most clients accept a standard mcpServers entry with the URL (Windsurf: ~/.codeium/windsurf/mcp_config.json, key serverUrl instead of url):
{
"mcpServers": {
"webskan": {
"type": "http",
"url": "https://webskan.com/mcp"
}
}
}Try it without a client
The endpoint speaks plain JSON-RPC over HTTP, so you can list the tools with curl:
curl -s https://webskan.com/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,
"method":"tools/list"}'Free plan limits
Generous enough for a solo developer or a small agency checking its own deploys. No key, no account. Counted per IP address and per website host.
| Tool | Limit | Notes |
|---|---|---|
scan_website | 10 scans per hour per IP; 120 per hour for all users together | A result for the same host from the last 24 hours is returned from cache and does not count. Results are kept for 7 days. |
audit_website | 2 audits per IP per 24 hours; 1 audit per host per 24 hours | A second audit of the same host within 24 hours returns the existing auditId. 1–30 pages, default 15. Up to 300 findings returned. Results are kept for 30 days. |
recheck_website | Same as audit_website | Uses the same URL and page count as the parent audit. |
get_audit | No limit | Poll every 30–60 seconds; the audit usually finishes within a few minutes. An audit that does not finish within 15 minutes is marked as an error. |
When a limit is hit the tool returns an error with a readable message (isError: true), not an empty result. Private hosts (localhost, 127.0.0.1, 10.x, 192.168.x, .local) are rejected: the audit runs from our machines, so it can only reach public addresses.
Paid plan for teams – coming soon
For agencies and teams that ship many sites: a key you pass as Authorization: Bearer <key>, higher audit limits (30 audits a day per key instead of 2 per IP), the same tools. The server already accepts the header; without a valid key you simply get the free limits (plan: "free" in every response), never an error.
Want to know when it opens? Write to kontakt@webskan.com with the subject “paid plan”.
Questions
Does this replace running Lighthouse locally?
No, and it is not meant to. Lighthouse in your terminal measures one page on your machine. Webskan looks at the whole deployed site from the outside, in a real browser, and adds what Lighthouse does not do: the crawl, accessibility with selectors on several pages, security headers and TLS, broken links, forms, the cookie banner, the customer journeys, and stable finding ids so a re-check can say exactly what changed. Run both.
Which addresses can it scan?
Only publicly reachable websites over HTTP or HTTPS. No localhost, private networks, tunnels that require a header, or sites behind a login. If the site blocks automated browsers the audit returns an error rather than a partial result.
What data do you keep, and for how long?
The URL you pass, the pages we crawled and the findings. A quick scan result is kept for 7 days, an audit for 30 days, both under an unguessable id. We do not store screenshots from MCP audits. For rate limiting we store a hash of the calling IP address, not the address itself. Details in the privacy policy.
Why do Lighthouse scores differ between two runs?
Lighthouse is a lab measurement; the same page can score a few points higher or lower on consecutive runs because of network and CPU variance. Treat a difference of up to about 5 points as noise. That is why the re-check reports Lighthouse metrics as before → after instead of marking them fixed or new.
How long does an audit take?
Usually a few minutes for 15 pages: the crawl, two Lighthouse runs (mobile and desktop), axe-core on the key pages, link checks and the customer journeys. Slow sites and shops with a long checkout take longer. audit_website returns an etaSeconds estimate; poll get_audit every 30–60 seconds.
Can the agent read the full report?
Yes. get_audit returns every finding (up to 300) with id, area, severity, title, detail and the pages it occurs on, plus both Lighthouse runs. The text part of the response is a compact Markdown summary; the structured part is the full JSON.
Do you need access to my repository or server?
No. The server never sees your code. Your agent decides what to change; Webskan only measures the public site before and after.
Is the process automated?
Yes, end to end: Playwright drives a real Chrome, Lighthouse and axe-core do the measuring, our own checks cover SEO, security, links, forms and journeys. Nobody reads your results unless you write to us about them.
I own a business, not a repo. Is there something for me?
Yes: the in-depth audit for business owners ($69, one-time) adds a PDF report, a customer-eye review written in plain language and ready-made fixes for your developer, and Webskan Monitor ($15 per month) watches the site daily and alerts you when something gets worse.