Wardzo MCP server

Give your AI assistant eyes on your live website. The Wardzo MCP server lets Claude, ChatGPT, Cursor and other agents scan a site for security, SEO and uptime problems, explain each issue, fix it in your code and confirm the fix.

Set it up in 1 minute Get a free account

Server URLs

Sign in with your Wardzo account (OAuth): https://wardzo.com/mcp/account. Use this as a custom connector in Claude, ChatGPT or Cursor.
No account or API key: https://wardzo.com/mcp. Scans, reports and fix guides work anonymously; add Authorization: Bearer wz_… for your sites.

Transport: Streamable HTTP (stateless). Auth: OAuth 2.1 with PKCE and dynamic client registration, or API keys.

Quick setup

Claude Code

claude mcp add --transport http wardzo https://wardzo.com/mcp/account

Cursor, VS Code, Windsurf and other clients (JSON config)

{
  "mcpServers": {
    "wardzo": {
      "url": "https://wardzo.com/mcp/account"
    }
  }
}

Claude.ai and ChatGPT: add a custom connector with the URL https://wardzo.com/mcp/account and approve access. Full steps for every client are in the MCP setup guide.

Tools

Tool	Account	What it does
`scan_site`	No	Scan any public website for security, SEO health and uptime issues and return the score and findings.
`get_report`	No	Get a finished scan report by its id or wardzo.com/r/ link.
`explain_issue`	No	Why an issue matters and step-by-step fix instructions with framework and hosting snippets.
`list_sites`	Yes	Your monitored sites with score, open issues and uptime.
`add_site`	Yes	Start monitoring a website: scheduled scans, uptime checks and alerts.
`get_site_status`	Yes	Latest score and change, issues by severity, uptime and what changed.
`list_issues`	Yes	Open issues from the latest scan, most severe first, with ids for explain_issue.
`recheck_site`	Yes	Re-scan after you deploy a fix and see what got resolved.
`list_endpoints`	Yes	Endpoint checks on a site (API health, login, checkout URLs) with their status.
`add_endpoint`	Yes	Watch a URL on your site with GET/HEAD: expected status, required text, max response time.
`remove_endpoint`	Yes	Stop an endpoint check.

What it checks

Security: leaked API keys in JavaScript, exposed .env and .git files, security headers (CSP, HSTS, clickjacking), TLS certificate, mixed content, SEO spam and cloaking. Verified domains on paid plans also get deep checks for backups, logs, credential files, Supabase RLS and Firebase rules.
SEO health: noindex mistakes, robots.txt, sitemaps, titles and descriptions, canonical tags and broken pages.
Uptime: homepage checks, plus endpoint checks for API, login and checkout URLs.

Prompts to try

“Scan mysite.com with Wardzo and fix the security headers in this Next.js project.”
“List my critical and high Wardzo issues, explain the worst one, fix it, deploy, then recheck_site.”
“Add an endpoint check for /api/health on mysite.com that must contain "ok".”
“Is anything new on my sites since last week? Summarize the Wardzo status of all my sites.”

Limits

Plan	MCP calls	Sites
No account	30 per hour	Scans only
Free	20 per day	1
Basic	500 per month	3
Premium	5,000 per month	15
Scale	20,000 per month	50

Paid plans are in early registration: 3 months free when we launch. See pricing

Security and privacy

Scans are passive and read-only; WardzoBot never submits forms or attacks a site. How WardzoBot behaves
OAuth access tokens last one hour, refresh tokens rotate, and you can disconnect any app in your dashboard. Only hashes of tokens and keys are stored.
Secrets found in evidence are masked. Any exposed key must still be rotated.

Frequently asked questions

What is the Wardzo MCP server?

It is a remote Model Context Protocol (MCP) server at https://wardzo.com/mcp. AI assistants and coding agents connect to it to scan live websites for security, SEO and uptime problems, read step-by-step fixes, monitor sites and re-check after a fix is deployed.

Is it free?

Yes. Scanning any public site works without an account (30 calls per hour). A free account adds monitoring of one site and 20 MCP calls per day. Paid plans add more sites and calls and are in early registration with 3 months free when we launch.

Which AI apps work with it?

Any client that supports remote MCP servers over Streamable HTTP: Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT developer mode connectors, Cursor, VS Code with GitHub Copilot, Windsurf, OpenAI Codex and others.

How does sign-in work?

Use https://wardzo.com/mcp/account as the connector URL. Your app opens a Wardzo page where you approve access with OAuth 2.1 and PKCE; no password or key is shared with the app. You can also use an API key from your dashboard as a Bearer token.

Is scanning safe for my website?

Yes. Scans are passive and read-only, like a careful visitor: no form submissions, no password guessing, no exploit payloads and no requests to private networks. Secrets found in evidence are masked.

What can my agent fix with it?

Typical fixes are security headers (CSP, HSTS, clickjacking), exposed .env or .git files, leaked API keys in JavaScript bundles, HTTPS redirects, robots.txt and sitemap problems, noindex mistakes, missing titles and descriptions, and broken pages.