Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Certificate changed, valid to 2027-01-13
Added "ai_readiness_audit", "exposed_files_check", "mcp_server_probe" and 3 more; removed "ai_crawler_policy_check", "cors_policy_check", "favicon_manifest_check" and 3 more; changed the definition of "broken_link_check", "check_open_ports", "check_robots_sitemap" and 9 more
CrawlFind broken links two ways. Default (crawl mode): crawl a site starting from a URL (same-origin pages ⟨4 unchanged words⟩ and check every linked URL for broken statuscodes.codes,Returnsreturning each brokenlinkslink with the page(s)theyitwerewas found on. Sitemap mode (viaSitemap: true): parse the site's sitemap.xml (following one level of sitemap-index nesting) and check the status of every URL listed in it instead. Note: some external sites (e.g. social platforms ⟨11 unchanged words⟩
{"properties":{"checkExternal":{"description":"AlsoCrawl mode only: also check links pointing off-site (default true; crawling never ⟨6 unchanged words⟩ {"description":"Max same-origin pages to crawl in crawl mode (default 20, capped at 50)","type":"number"},"url":{"description":"Starting URL to crawl — or, in sitemap mode, the sitemap.xml URL or any page URL on the site","type":"string"},"viaSitemap":{"description":"Check the URLs listed in the site's sitemap.xml instead of crawling pages (default false)","type":"boolean"}},"required":["url"],"type":"object"}
TCP-connect scan a host for openports.ports, plus network intel on the host's resolved IPs (ASN, network owner, BGP prefix, country — via Team Cymru). Defaults to a list of ~20 common service ⟨23 unchanged words⟩
Checkwhetherasite has a validsite's robots.txt and sitemap.xml,andinreturnonetheircall: raw contents (truncated)., sitemap presence, an AI-crawler policy analysis (explicit rules for GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot and other AI crawlers, vs wildcard/default), and llms.txt presence. For a scored, whole-site AI-readiness report use ai_readiness_audit instead.
⟨13 unchanged words⟩ , SPF, and DMARC records. Flags common misconfigurations. WHOIS + DNS only — for the WHOIS record alone use whois_lookup; for deliverability detail (DKIM, DNSBL, PTR) use email_deliverability_check; for all of it plus SEO in one report use domain_report.
Fetch a URL and measure time-to-first-byte, total fetch time, and responsesize.size from this server. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB. Lightweight raw-timing check — for Google Lighthouse scores, Core Web Vitals, and real-user field data use pagespeed_insights instead.
⟨20 unchanged words⟩ INP/TBT), and real-user field data where available.AuthoritativeTheversionauthoritative,ofGoogle-measured score — for alocalquick raw TTFB/size timing check—fromhitsthisGoogle'sserverownuseinfrastructure.page_performance_check instead. Works without an API key at low volume; ⟨6 unchanged words⟩
Fetch a URL and audit its responseforheaderssecurity-relevantinHTTPone pass: security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).Flagswithmissing/misconfiguredaheadersscore,withPLUS its CORS policy (the probe sends ascore.foreign Origin header and flags wildcard-origin + credentials combinations and arbitrary-origin reflection). Header-level checks on a single response — for server/TLS-level checks use ssl_cert_check or ssl_labs_grade instead.
Fetch a URL and runana full on-page SEO audit: title/meta description length, canonical tag, ⟨24 unchanged words⟩ (noindex/nofollow), structured data (JSON-LD) presence, robots.txt/sitemap.xml presence, androbots.txt/sitemap.xmlsitepresence.chrome (favicon, apple-touch-icon, web app manifest, theme-color). Whole-page audit — for raw extracted data only use structured_data_extract, for the platform/framework use tech_stack_fingerprint.
⟨10 unchanged words⟩ expiry date, days remaining, issuer, and subject. Fast facts only — for a full graded TLS assessment (protocols, ciphers, vulnerabilities) use ssl_labs_grade instead.
⟨20 unchanged words⟩ (Heartbleed, POODLE, etc.) for each endpoint.SlowerUsethanthis for a deep grade; use ssl_cert_check instead for a fast expiry/issuer check. Slower (can take up to ~90s on a ⟨10 unchanged words⟩
Fetch a URL and extract structured data deterministically: JSON-LD blocks (each one also VALIDATED — @context/@type presence plus required fields for common schema.org types like Article, Product, Organization, FAQPage), OpenGraph/meta tags, and optional caller-supplied CSS-selector fields ( ⟨18 unchanged words⟩ are exact matches only, not summarized or inferred. For a whole-page SEO audit (headings, links, images, meta lengths) use seo_audit instead.
⟨20 unchanged words⟩ tag, framework/CMS-specific script or class patterns). Answers 'what is this site built with?' — for on-page SEO/content signals use seo_audit, for raw structured data use structured_data_extract. Best-effort — not exhaustive, no additional paths are probed.
Score how ready a website is for AI agents and LLM-driven discovery, 0-100 with a letter grade: robots.txt presence, explicit AI-crawler policy (GPTBot, ClaudeBot, CCBot, PerplexityBot, and 8 more), llms.txt presence and structure, structured data (JSON-LD) and Open Graph basics, agent/payment discovery files (/.well-known/x402, /openapi.json), sitemap presence, and title/meta basics. The bundle to run before/after making a site agent-friendly — for raw robots/sitemap contents only, use check_robots_sitemap; for classic search SEO only, use seo_audit.
Probe a site for publicly exposed sensitive files attackers scan for: /.env and variants, /.git/config and /.git/HEAD, /.svn/entries, docker-compose files, /.aws/credentials, /.ssh/id_rsa, database dumps (backup.sql, db.sql, dump.sql), backup archives, phpinfo pages, .DS_Store, and similar. Reports ONLY reachability metadata (path, status, content type, size) — file contents are never returned or stored. A random-nonexistent-path baseline filters out SPA/catch-all false positives. For auditing your own sites' exposure.
Probe a remote MCP server end-to-end: performs the initialize handshake, captures server info and protocol version, lists its tools, and grades tool-quality the way directories like Glama do — description coverage and depth, input-schema completeness, and naming consistency — with a 0-100 score, letter grade, and per-tool detail. Use it to vet an MCP server before connecting an agent (or paying per call) to it.
Live-probe a mail server over SMTP: connects to port 25 (or a given port), reads the banner, issues EHLO and lists advertised capabilities (STARTTLS, AUTH mechanisms, SIZE, 8BITMIME, PIPELINING), then upgrades via STARTTLS when offered and reports the TLS protocol and certificate (issuer, expiry). The server-side complement to email_deliverability_check (which reads DNS records only and never connects). No mail is sent and no relay attempt is made.
Enumerate a domain's subdomains from public Certificate Transparency logs (crt.sh, with a Cert Spotter fallback): every hostname that has ever appeared on a certificate for the domain. Passive reconnaissance - no packets are sent to the target. Useful for attack-surface reviews, migration inventories, and finding forgotten test/staging hosts.
Look up a domain's WHOIS registration record: registrar, creation and expiry dates, days remaining, name servers, and domain statuses, direct from the TLD registry. Registration data only — for DNS/mail health as well, use domain_health_check; for a combined report, use domain_report.
Check a site's robots.txt for explicit directives targeting known AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot, and others used for LLM training or AI search/answer products), and check for an llms.txt file. Useful for publishers deciding whether their content policy toward AI crawlers matches their intent, or for auditing a competitor's stance.
Send a probe request with a foreign Origin header to a URL and report its CORS response headers. Flags wildcard-origin + credentials combinations and arbitrary-origin reflection, both common CORS misconfigurations.
Check a site for favicon, apple-touch-icon, web app manifest, and theme-color presence — a quick completeness check for browser/OS chrome and PWA metadata.
Resolve a hostname to its IPv4 addresses and look up each one's ASN, network prefix, country code, and network owner via Team Cymru's DNS-based WHOIS service (no API key). Country-level only — not city/street geolocation.
Fetch a URL, extract every JSON-LD (<script type="application/ld+json">) block, and validate basic structure — @context/@type presence plus required fields for common schema.org types (Article, Product, Organization, WebSite, LocalBusiness, BreadcrumbList, FAQPage). Reports per-block errors rather than failing the whole call on one bad block.
Parse a site's sitemap.xml (following one level of sitemap-index nesting) and check the HTTP status of every listed URL. Concurrency-limited, capped at 200 URLs checked per call. Reports broken/redirecting URLs found in the sitemap.
Certificate changed, valid to 2027-01-01
Certificate recorded, valid to 2026-11-02
Authorization not required
First tool surface recorded: 29 tools (server version 1.0.0)
Showing the latest 6 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed