Tapsite

tapsite

The MCP server for web intelligence extraction. 55 tools that give AI agents the ability to *understand* websites — not just drive a browser, but extract structured intelligence about design systems, accessibility, performance, content, and more.

Other MCP browser tools let agents click buttons. tapsite lets agents extract a complete color palette, audit WCAG contrast ratios, diff two sites' design tokens, detect tech stacks, or pull structured data with custom CSS/XPath/regex selectors — all as structured JSON that agents can reason about.

55 Tools · 11 Categories · 4 Workflows · Multi-Format Export

Works with Claude, Cursor, Windsurf, and any MCP-compatible AI agent. LangChain/LangGraph integration coming soon.

[View the full docs site →](https://mgriffen.github.io/tapsite/)

Installation

# Quick start (no install required)

npx -y tapsite

Or install globally

npm install -g tapsite npx playwright install chromium npx playwright install-deps chromium

Add to your AI agent's MCP config:

{

"mcpServers": { "tapsite": { "command": "npx", "args": ["-y", "tapsite"] } } }

First run: Playwright will install Chromium automatically if not already present (~150MB one-time download).

Also available on the MCP Registry and Glama.

What makes tapsite different

Extract design systems — colors, fonts, spacing scales, breakpoints, components, shadows, icons, CSS variables, and contrast ratios from any website. Output as structured JSON or W3C design tokens.

Audit quality — accessibility scoring with WCAG contrast analysis, performance timing (Core Web Vitals), tech stack detection, dark mode support, and animation inventory.

Compare and track — diff two sites side by side, or track a single site over time with snapshot-based temporal diffs. Regressions and improvements are flagged automatically. Disk caching means crawls resume where they left off, and results are reused across sessions.

Work behind login walls — persistent browser sessions with full MFA support. A 3-tier anti-bot escalation system handles protected sites automatically — from stealth scripts to proxy rotation. Log in once manually, then extract across tool calls without re-authenticating. Credentials never enter the chat.

Tools (55)

Session (8)

Content Extraction (6)

Custom Extraction (2)

Design Tokens (5)

Visual Assets (4)

Layout Intelligence (3)

Quality & Compliance (7)

Technology Detection (10)

Network & API (2)

Multi-page (2)

Export (2)

Engine

Resilient extraction engine. Parallel browser pooling for concurrent page extraction. Persistent disk caching — crawls resume where they left off and results are reused across sessions. 3-tier anti-bot escalation with automatic proxy rotation for protected sites.

Workflows (4)

LangChain / LangGraph integration (coming soon)

Native LangChain and LangGraph integration is on the roadmap. When released, it will provide a dedicated Python wrapper with tool subsets and managed session lifecycle.

Security

Prompt injection defense (hidden element filtering + output sanitization), HTTPS enforced, private IPs blocked, auth headers redacted. Credentials never enter the chat — log in manually with full MFA support.

Prompt injection defense

Extractors skip hidden elements (display:none, visibility:hidden, opacity:0, zero-size, clip-hidden) to prevent invisible text injection. All output is scanned for prompt injection patterns — instruction overrides, role hijacking, exfiltration attempts, and tool manipulation are flagged inline as [INJECTION_DETECTED].

Credential safety

Never pass credentials through the chat. Use tapsite_login_manual to open a headed browser, log in manually (including MFA), then tapsite_login_check to confirm. Credentials never touch the AI provider's servers or local transcripts.

Docker

tapsite ships a Dockerfile and docker-compose.yml for headless-only use — CI pipelines, server deployments, or anywhere you don't want a local Node.js install.

docker build -t tapsite .

docker compose up

tapsite_login_manual is not available in Docker (it requires a display). To use authenticated sessions in Docker, log in locally first, then mount the profiles/ directory into the container:

volumes:

• ./output:/app/output
• ./profiles:/app/profiles

Security note: profiles/ contains live session cookies. Don't commit it to version control (it's already in .gitignore).

Development setup

git clone https://github.com/mgriffen/tapsite

cd tapsite npm install npx playwright install chromium npx playwright install-deps chromium

MCP config pointing to local source:

{

"mcpServers": { "tapsite": { "command": "node", "args": ["/absolute/path/to/tapsite/src/server.js"] } } }

Project structure

src/

server.js — MCP server entry point browser.js — shared Chromium context (ensureBrowser, closeBrowser) helpers.js — shared helpers (safeNavigate, summarizeResult, indexPage) sanitizer.js — prompt injection detection diff.js — per-extractor diff logic and extractor name/args mapping snapshots.js — temporal snapshot I/O (saveSnapshot, loadLatestSnapshot) browser-pool.js — parallel browser context pooling cache.js — persistent disk caching with TTL markdown.js — HTML-to-Markdown converter (raw/fit/citations) chunker.js — LLM-friendly text chunking (fixed/semantic/sentence) content-filter.js — BM25 relevance filtering anti-bot.js — block detection and tier escalation proxy.js — proxy rotation with failure tracking stealth-setup.js — Puppeteer-extra stealth plugin registration extraction-strategies.js — CSS/XPath/regex flexible extrac