The MCP server

The free scan is an MCP server as well as a web page. Anything that speaks the Model Context Protocol can call it directly, which means you can ask an assistant "can agents read example.com?" and get a real answer with the fixes attached, without leaving your editor.

It needs no account and no key. Nothing about the scanned site is stored.

Adding it

In Claude Code:

claude mcp add --transport http sichta https://web.sichta.gigliotti.software/api/mcp

Any other client wants the same URL as a Streamable HTTP server:

https://web.sichta.gigliotti.software/api/mcp

There is a discovery card at /.well-known/mcp.json naming the server, its transport and its tools, for clients that read one.

The tool

One tool, scan_site. It takes url — a hostname or a full URL — and returns every finding with its explanation and its fix, plus the score.

It also declares an outputSchema, so a client that wants data rather than prose gets structuredContent: the score, a summary count, and each finding with its check ID, pillar, result, error type and fix. Both come from the same run, so the text and the data cannot disagree.

Two things to model correctly if you build on it:

  • score is nullable. Null means nothing scorable could be determined; it is not a zero.
  • result has four values, not two. Treating UNDETERMINED or NOT_APPLICABLE as a failure misreports every site where the engine declined to guess, which is the failure this whole engine exists to avoid.

Limits

The same limits the website's scan form enforces: three scans a minute and ten an hour per caller, and the same guards on what may be fetched. A rate limit comes back as a JSON-RPC error with a plain-language message, not as a broken connection.

What this is not

It is not the Scan API. The MCP server runs the free scan against any public site for anybody. The Scan API is authenticated, works only on sites you have verified, and records its runs in your history so drift alerts and the badge take them into account.