WSG Check

WSG-Check

Check a website against automated heuristics based on the W3C Web Sustainability Guidelines. Get a weighted score, recommendations, and reports in terminal, JSON, Markdown, or HTML format through a CLI or a Next.js web app.

Release status

The latest release is v0.7.0.

Source on main targets WSG September-2026, the 24 September 2026 Group Note Draft; v0.6.1 and earlier target July-2026. It includes an MCP server for AI assistants, with the check_url, list_guidelines, and get_guideline tools, listed in the MCP Registry as io.github.ivanoats/wsg-check. The server first shipped in v0.4.0; v0.3.0 was tagged on GitHub but not published to npm. See the changelog and spec versioning policy.

Scores from different spec versions should not be treated as directly comparable. The package version and check selection also matter when comparing reports.

Quick start

Requires Node.js 22 or later. Pin the released CLI for reproducible usage:

npx @sustainablewebsites/wsg-check@0.7.0 https://example.com # x-release-please-version

Or install globally

npm install -g @sustainablewebsites/wsg-check@0.7.0 # x-release-please-version wsg-check https://example.com --format json --output report.json

To run the current source, including unreleased features, use Node.js 22.22.1 or later (required by development tooling):

git clone https://github.com/ivanoats/wsg-check.git

cd wsg-check npm ci # prepare also generates Panda CSS tokens npm run dev # http://localhost:3000

Build and run the CLI from this checkout

npm run build:cli node dist/cli/index.js https://example.com

See CONTRIBUTING.md for environment configuration and development commands.

What the results mean

• Checks cover web development, UX, and hosting. The business category has no automated checks.
• Analysis uses fetched HTML and HTTP metadata; it does not render JavaScript, measure Core Web Vitals, or download every referenced asset.
• Results describe one page, but most checks read the server or content shared by a site template, so pages on one site usually score alike. Scores differ mainly on page-specific content such as images and inline styles or scripts.
• CO₂ estimates use the HTML transfer size and the SWD v4 model, not measured full-page energy consumption. Failed green-hosting lookups fall back to false.
• Report page weight is the HTML transfer size: the bytes received over the network, compressed when the server compressed them. Resource and third-party counts come from references in the HTML. Referenced assets are not downloaded or measured.
• Security headers, form validation, native form features, and image alternative text remain visible as related checks, excluded from WSG scores.

CLI Usage

WSG-Check ships with a command-line tool that lets you check any website directly from your terminal or integrate checks into CI pipelines.

Basic usage

# Check a website with default (terminal) output

npx @sustainablewebsites/wsg-check https://example.com

Output as JSON

npx @sustainablewebsites/wsg-check https://example.com --format json

Save the report to a file

npx @sustainablewebsites/wsg-check https://example.com --format markdown --output report.md

Fail the process (exit 1) if the score is below 70

npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 70

Options

--header values land in shell history and CI logs, and a malformed one is echoed in the error. For a secret, set "headers": {"Cookie": "..."} in a wsg-check.config.json kept out of version control. Header names in the config file are checked when it loads, and an error names the bad header without printing its value. --header replaces the config file's headers entirely. Headers are not sent over plain http after an https hop. To change the user agent, use WSG_USER_AGENT or the config's userAgent. The web API and MCP server do not accept request headers.

CI integration

Use --fail-threshold to fail your pipeline when a site's sustainability score drops:

# .github/workflows/sustainability.yml

• name: Check sustainability run: npx @sustainablewebsites/wsg-check https://example.com --fail-threshold 60 --format json --output wsg-report.json
• name: Upload report uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: wsg-report path: wsg-report.json

Exit codes

Use with AI assistants (MCP)

The package includes wsg-check-mcp, a Model Context Protocol server for Claude Code, Claude Desktop, VS Code, Cursor, and other MCP clients. It runs on your machine over stdio, with no account, port, or hosted service. Your assistant can then check a deployed site or your local dev server, look up guidelines, and fix what it finds.

# Claude Code

claude mcp add wsg-check -- npx -y -p @sustainablewebsites/wsg-check wsg-check-mcp

Claude Desktop (claude_desktop_config.json) and Cursor (.cursor/mcp.json):

{

"mcpServers": { "wsg-check": { "command": "npx", "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"] } } }

npx -y @sustainablewebsites/wsg-check --mcp starts the same server; it's the command the MCP Registry listing, io.github.ivanoats/wsg-check, uses.

VS Code (.vscode/mcp.json) uses a servers key:

{

"servers": { "wsg-check": { "type": "stdio", "command": "npx", "args": ["-y", "-p", "@sustainablewebsites/wsg-check", "wsg-check-mcp"] } } }

Try prompts such as "Check http://localhost:3000 against the WSG and fix the top three issues" or "Which WSG guidelines cover web fonts?"

Network access

• Local URLs are allowed by default, so http://localhost:3000 and other loopback addresses work without setup. The trade-off: text the assistant reads, such as a web page or a file in your project, could try to steer it into requesting a service on your machine. Requests are GET-only and the results go back to the assistant. If you don't check a local dev server, add --no-local after wsg-check-mcp in the arguments, or set WSG_CHECK_NO_LOCAL=1.
• Private networks (10/8, 172.16/12, 192.168/16) are blocked unless you add --allow-private-network or set WSG_CHECK_ALLOW_PRIVATE=1.
• The only other request check_url makes is a green-hosting lookup: it sends the hostname to the Green Web Foundation. Local hostnames are never sent.
• Cloud metadata and other reserved addresses are always blocked. Redirects from a public site into your machine or network are refused, and each connection is pinned to the address that was checked.

Agent skill

The repository also ships an Agent Skill, wsg-sustainability-review. It walks an assistant through checking a site, fixing the issues in your codebase in priority order, and checking again. It uses the MCP tools when they are configured and falls back to the CLI otherwise. Install it into Claude Code, Cursor, Copilot, and other agents with:

npx skills add ivanoats/wsg-check

REST API

The web app exposes Next.js Route Handlers:

| GET /api/health | Health st