EchelonGraph CVE & Exposure
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
作者提供的说明(英文原文)
Technical SEO, passive security and page-delivery audits with evidence and suggested fixes.
这三项永远不会合并成一个分数:意见、测量和人气是不同的东西。
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
选择你使用的 AI 应用,然后复制设置。
你需要
你用的是哪个应用?
在上方选择你的应用。我们会记住它,下次按钮会显示“安装到 …”。
适用于网页版、桌面版和手机版 Claude:
https://pageaudit.online/mcp在终端中运行这条命令
claude mcp add --transport http pageaudit https://pageaudit.online/mcp粘贴到项目中的 .cursor/mcp.json,或 ~/.cursor/mcp.json
{
"mcpServers": {
"pageaudit": {
"url": "https://pageaudit.online/mcp"
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"pageaudit": {
"type": "http",
"url": "https://pageaudit.online/mcp"
}
}
}浏览器会先询问是否打开应用,然后应用会显示设置并请你确认。密钥的值会留空,由你自己填写。
ChatGPT 只能连接互联网上的服务器:
https://pageaudit.online/mcp菜单名称可能因套餐和版本不同而略有差异。
你的选择通过 Cookie 保存在这台设备上,无需账户。
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同,请以 README 为准。
工具名称和描述与服务器在 2026年11月8日 报告的完全一致。这些内容由作者撰写,不是我们写的;我们以纯文本形式显示。
list_sitesRead up to 50 sites owned by the signed-in account. Follow next_cursor.
add_siteAdd a site to the account or reuse the existing domain. Up to 1,000 sites per account. This creates no subscription or payment. An account holds up to 1,000 sites (409 site_limit). Adding a site creates no subscription or payment. The existing guest audit workspace stays separate
get_siteRead one site owned by the signed-in account.
search_consoleRead own-site keywords, opportunities at average positions 4–20, up to 20 tracked queries and daily history. Check dates, partial coverage and collection failure before proposing edits. These are not market search volumes. The sample covers 28 days, at most 50 queries and 50 page
track_search_queriesReplace the site's tracked query selection (up to 20). Read search_console first to preserve existing selections. Removed queries keep their stored history. E-mail alerts require an active site package. Accepts up to 20 exact queries. Removed queries become inactive; their stored
connect_search_consoleStart read-only Google consent. The account owner must follow redirect in their browser. Follow redirect in the account's browser. Consent expires after five minutes. The callback is single-use and bound to the account and site. The property must match the site and Google must au
sync_search_consoleCollect a due sample. Repeated calls cannot bypass the daily reservation. The hourly schedule uses the same durable reservation. A failure preserves the last good sample and schedules the next attempt 24 hours later. This route cannot force an extra collection.
disconnect_search_consoleRemove the local Google credential and stop collection. Keep the last good sample. The last good sample stays available. An in-flight callback or collection cannot reconnect the site. Returns: { available, connected, property, last_attempt_at, last_success_at, next_run_at, error,
prompt_allowanceRead remaining prompt units before generating. This does not use credit.
generate_fix_promptPrepare a coding-agent prompt from an owned report. One check uses one unit; full uses three. Three units are free once. Then US$0.10 per unit, or included in an active PageAudit plan. Read prompt_allowance first. Only send credit_token after explicit spending authorization; pres
generate_domain_fix_promptGenerate a fix prompt from saved domain observations. Prepare a coding-agent prompt from an owned report. One check uses one unit; full uses three. Three units are free once. Then US$0.10 per unit, or included in an active PageAudit plan. Read prompt_allowance first. Only send cr
generate_site_fix_promptGenerate a fix prompt for a weekly finding or a Search Console opportunity. Prepare a coding-agent prompt from an owned report. One check uses one unit; full uses three. Three units are free once. Then US$0.10 per unit, or included in an active PageAudit plan. Read prompt_allowan
get_fix_promptRead a saved prompt. It costs nothing, even after plan expiry. Preserve the complete prompt and license. Use it only for license.domain. This does not authorize deployments or infrastructure changes. Uses the authenticated owner and active organization. Returns the immutable text
list_audit_fix_promptsFind saved audits prompts before generation. Listing is free. Keep language and source filters when following the cursor. At most 100 saved rows per page, plus up to three earlier free audit receipts. Follow _links.next. A legacy receipt has id=null and legacy=true; the matching
list_domain_fix_promptsFind saved tabs prompts before generation. Listing is free. Keep language and source filters when following the cursor. At most 100 saved rows per page, plus up to three earlier free audit receipts. Follow _links.next. A legacy receipt has id=null and legacy=true; the matching ge
list_site_fix_promptsFind saved sites prompts before generation. Listing is free. Keep language and source filters when following the cursor. At most 100 saved rows per page, plus up to three earlier free audit receipts. Follow _links.next. A legacy receipt has id=null and legacy=true; the matching g
weekly_site_reportRead the weekly report of a site: what changed since last week, the new pages of up to 3 competitors and every finding. Reading never runs the report. Once a week the report checks the first 500 URLs of the site's sitemap, says what changed since the week before (new and fixed pr
save_weekly_site_reportTurn the weekly report of a site on or off and set up to 3 competitors. Turning on needs a watch package in force. Turning on needs a watch package in force and a free site in it (409 with `limit` and `plans` otherwise). The first report runs right away; later ones run a week aft
weekly_site_report_historyRead one weekly report of a site's history by its id.
ai_search_visibilityCheck whether the site's page appears in AI search for each target search, at which position, and which sites appear in its place, with plain recommendations. Uses the saved searches or the ones the page suggests when queries is omitted. Send {} to use the saved searches, or the
ai_search_historyRead the plan, the saved searches, the last runs and the position trend of each search. Reads never call the search engine. The trend compares each search of the newest run with the previous run that had it: up, down, same, new or lost.
save_ai_search_queriesSave up to ten searches for the weekly report to track (three without a watch package). Saves use the expected version. Without a current watch package, an account tracks up to three searches. Uses the shared 240 writes per site and UTC day.
journeysRead the owned site's installation, actions, paths and ordered conversion funnel for the last seven days. Requires the account's browser session. Only this site's owner can read it. Data updates through the shared realtime transport. No user identity, typed text or screen recordi
configure_journeysEnable or pause an owned site's collection, or set up to eight ordered project_action steps. Activation requires an existing paid site package; this call never buys one. Configure optional Google credentials in the UI. Activation requires the existing site package or an operator-
connection_reviewRequires the account session, current X-Organization-Id and CSRF for writes. Read today's private TLS review without starting a scan. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts per UTC
review_connectionRequires the account session, current X-Organization-Id and CSRF for writes. Start a TLS review of the saved HTTPS origin using current domain monitoring rights. At most three starts per account and UTC day, one per site. A repeated request reuses today's review. Do not claim com
cancel_connection_reviewRequires the account session, current X-Organization-Id and CSRF for writes. Cancel the current TLS review and preserve completed evidence. One review per account, organization, origin and UTC day. Starting requires current domain monitoring rights. The account has three starts p
domain_portfolioRequires the account session, current X-Organization-Id and CSRF for writes. Read cached domain monitoring and deadlines for selected saved pages. Does not start external collection or activate monitoring. Every tab must belong to the current account and organization. Reads by pr
preview_domain_alertsRequires the account session, current X-Organization-Id and CSRF for writes. Review the exact selected domains before changing renewal notices. Does not activate monitors, purchase access or change certificate notice timing. Select up to 25 saved pages. Repeated registrable domai
apply_domain_alertsRequires the account session, current X-Organization-Id and CSRF for writes. Apply the reviewed selection. Requires the preview from preview_domain_alerts. A stale preview changes nothing. Does not activate monitors, purchase access or change certificate notice timing. Select up
domain_statusRead registration, contact visibility, TLS, DNS, CAA, mail policies, certificate issuance and a limited server comparison. Read source dates and collection gaps. Private options require the account session. A discovered name never starts monitoring automatically. Pages share publ
check_domainRefresh due registration, contacts, TLS, DNS, mail policies, certificate issuance and a limited DNS/TLS sample. Reuses fresh public data. Does not enable monitoring or make a purchase. Reuse fresh observations. A failed or partial query preserves the last complete observation and
set_domain_expiryRequires the account session, current X-Organization-Id and CSRF for writes. Set or remove the private manual expiry. It does not change the registry data or confirm renewal payment. Send manual_expires_on, dns, or both. Omitted settings are preserved. DNS requires both selectors
configure_domain_dnsRequires the account session, current X-Organization-Id and CSRF for writes. Set up to three known DKIM selectors and choose whether IP rotation is expected. Expected rotation keeps history without notices; alias changes still notify. Does not discover selectors, enable monitorin
configure_domain_monitorRequires the account session, current X-Organization-Id and CSRF for writes. Enable or stop domain monitoring, or pause notices for maintenance. Uses existing rights; 402 supplies checkout instructions and never buys automatically. Stopping a monitor does not cancel a subscriptio
domain_historyRequires the account session, current X-Organization-Id and CSRF for writes. Read up to 50 private incidents with notice delivery. Send the last event number as before for the next page. A first observed risk is an initial incident, not evidence of an external change. The first D
acknowledge_domain_eventRequires the account session, current X-Organization-Id and CSRF for writes. Acknowledge an expected event. Suppress its notice only if sending has not started. Preserve the event and its evidence. Preserve the event and observation. Acknowledgement does not erase a confirmed ris
audit_siteCheck the first 20 URLs of a site's sitemap: status, redirects, robots.txt, noindex, canonical, titles and descriptions. It also flags a plan with different prices on different pages. Free, without an account. The same site within one hour returns the stored sample. URLs of anoth
check_ai_accessRequest a page as Googlebot, Bingbot and the AI crawlers (OAI-SearchBot, Claude-SearchBot, PerplexityBot, ChatGPT-User, GPTBot, ClaudeBot) and see who gets a 403, a 429 or a firewall challenge that robots.txt does not show. Also returns the date of the newest sitemap lastmod and
api_indexDiscovers the whole PageAudit API (self-describing index).
healthLiveness and the commit deployed right now — it is how the smoke waits for its own deploy.
list_toolsLists the micro-tools (title, meta, canonical, OG, JSON-LD…).
get_toolCopy and checks of one micro-tool by slug (e.g. title-tag-checker).
audit_urlCheck a web page's search metadata, crawl access, structured data and selected discovery files. Return evidence, limits and suggested changes without creating a saved tab. A blocked target returns HTTP 502 with target_blocked. The report does not certify security or accessibility
create_guestCreates a guest token pa_… for the tab workspace. Keep the token: it is the identity of the tabs and of the audits tied to them.
list_tabsLists the owner's saved pages (guest or session), with the active page's last report. Group pages by site to match the Projects table. One call loads the saved pages and the active page's last report. The UI groups pages by site in Projects and opens each site in a work tab. The
create_tabOpens a saved URL. Set queue_audit=false to monitor a discovered origin without a page audit. Past the free tab allowance it answers 402 with `accepts[]`: pay and repeat.
run_tabRe-audits the tab's URL. Consumes the same daily allowance as `POST /api/audit` — past it, 402 with `accepts[]`.
tab_historyThe tab's previous runs and what changed between each one and the one before it (score delta, findings that appeared and that disappeared). Every run has always been kept; this is where you read the series. Each entry carries the score, the counts and a `change` with the point de
watch_tabTurns the daily watch on or off for a tab: it re-audits the page once a day and e-mails when the score drops or a new error/warning appears. Needs the signed-in account (its browser session cookie); a guest token gets 403 `account_required`. When a plan ends, the pages beyond the
lab_testStarts a lab test of an audit's page: Lighthouse run by Google PageSpeed Insights (performance, accessibility, best practices, SEO). Answers 202 at once; the test takes ~25 s to 2+ minutes — then read it with lab_result. Does not change the audit score. Answers **202** at once; t
lab_resultThe lab tests of an audit (mobile and desktop): running, finished with scores, metrics and biggest savings, or failed. With wait (up to 25) it answers as soon as a running test finishes. Long-poll: with `wait` the answer comes as soon as a running test finishes, or after `wait` s
get_auditRe-read an audit with its findings and evidence. Use generate_fix_prompt for correction steps. Re-reading costs nothing and does not count against the allowance — the page's HTML is not kept, but the report is.
get_badgeMetadata and markdown of the SVG badge of a shared report.
embed_snippetThe embeddable widget's snippet, already assembled with the site's name and colour — one script tag, no account, no lead capture. One script tag puts the audit form on your own site, with your name and colour, and no account or key. Send the same query you would send to `/embed`
billingRead free allowances, prices and the account's 7-day trial. Each audit beyond the daily allowance costs $0.02. Hourly limits still apply.
list_plansThe plans for sale, with price and term, and the account's active plan. Each purchase lasts 30 days, with no automatic renewal. Each purchase lasts 30 days, with no automatic renewal. Without an account or wallet credential, `account` is `null`. Daily monitoring requires an accou
buy_planBuy a plan: starter (25 more pages), pro (100 more pages), agency (300 more pages). Each purchase lasts 30 days, with no automatic renewal. Answers 402 with the price; pay with x402 or prepaid credit and repeat. Each purchase lasts 30 days, with no automatic renewal. Without paym
cancel_planCancel the active plan. Nothing else is charged; a purchase under 7 days and a paid period that has not started are refunded and end now, and the rest of the paid period stays active until keeps_until. Requires accept_data_removal: true. Send `{ "accept_data_removal": true }`. Th
contactWrite to the people behind the product: a question, or a sponsorship/partnership/advertising proposal. Free, no captcha and no payment; one message every 10 s per network (one that arrives sooner waits its turn). One route for a question and for a sponsorship, partnership or ad p
我们检查的是任何人都能看到的信息;我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日
注册名称已通过域名 pageaudit.online 验证(注册中心会核实域名所有权)
我们还没有从 GitHub 读取这个仓库
我们还没有从 GitHub 读取这个仓库
在 614 毫秒内响应(HTTP 200)
无需登录
已读取 60 个工具描述,未发现针对 AI 的隐藏指令
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时,星标数才计入。
它在 3 项适用的基础检查中通过了 3 项。我们没有阅读代码。在添加密钥或令牌之前,请先看看这个服务器要求哪些权限,并使用只具备所需权限的密钥。
注册中心没有列出必需的密钥,不过有些服务器会在首次使用时要求你登录。
它在作者的云端运行。通过互联网连接,无需安装,但你发送的内容会经过作者的服务器。
GitHub 仓库最后更新于–,最新版本(1.0.1)于24天前进入注册中心。
支持 MCP 的应用,例如 Claude Desktop、Claude Code、Cursor 和 VS Code。它通过 URL 连接,所以接受远程 MCP 服务器的应用也可以使用,例如开启开发者模式的 ChatGPT。
同一分类中有:EchelonGraph CVE & Exposure, KillerSkills, Phishnoo Sandbox
同一分类中其他作者的服务器,按星标数排序。
如何看卡片:↓ 每周下载量i★ GitHub 星标i三大支柱:评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
Security verdicts for agent skills and MCP servers, from sandbox runs, before you install them.
Explore synthetic security awareness metrics and file example threat reports.
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
PageAudit checks a web page and returns evidence with suggested changes. One call reads the title, description, canonical, robots rules, Open Graph, headings, structured data (JSON-LD), security headers and page delivery. It can compare a deploy preview with production and show only what got worse. This repository packages the PageAudit skill and the connection to its remote MCP server for Claude Code, Codex, Cursor and other agents.
Site: https://pageaudit.online · MCP server: https://pageaudit.online/mcp?checkout=site · Prices: https://pageaudit.online/pricing · API docs: https://pageaudit.online/developers
Try: *"Audit https://example.com and give me the head tags to fix."* or *"Compare the preview of this deploy with production and tell me what got worse."*
wrpbr/pageaudit-action audits each deploy preview against production and writes what got worse in the job summary. It can fail the job on a regression. Without any YAML, the PageAudit GitHub App puts a PageAudit check run on the commit of each preview deployment.
Claude Code, as a plugin with the skill and the MCP server:
/plugin marketplace add wrpbr/pageaudit
/plugin install pageaudit@pageaudit
Any agent that reads Agent Skills (Claude Code, Codex, Cursor, OpenCode and others):
npx skills add wrpbr/pageaudit
Only the MCP server (remote, Streamable HTTP, no key needed to start):
claude mcp add --transport http pageaudit 'https://pageaudit.online/mcp?checkout=site' # Claude Code
codex mcp add pageaudit --url 'https://pageaudit.online/mcp?checkout=site' # Codex
{ "mcpServers": { "pageaudit": { "url": "https://pageaudit.online/mcp?checkout=site" } } }
The JSON above goes in .cursor/mcp.json for Cursor and in the MCP settings of most other clients. For the GitHub Copilot coding agent, add it in the repository settings, under Copilot → MCP servers, with "type": "http" and the tools you allow, for example audit_url and generate_fix_prompt.
Audits have a free daily allowance. The current allowances, the options past them and their prices are at https://pageaudit.online/pricing. The daily watch needs an account. Check the renewal conditions before purchase. The plugin never pays: with checkout=site, the MCP server has no purchase tool and no payment argument.
The skill tells the agent to call the PageAudit API at pageaudit.online. The MCP server also runs at pageaudit.online. The URLs you audit go to pageaudit.online over HTTPS, and PageAudit fetches those pages. The plugin runs no local program and reads no local file.
O PageAudit confere uma página como um buscador e um revisor atento fariam, e devolve a correção: título, descrição, canonical, robots, Open Graph, cabeçalhos, JSON-LD, cabeçalhos de segurança e entrega da página, com a evidência e a mudança sugerida para cada problema. Também compara a prévia de um deploy com a produção e mostra só o que piorou. Instale com os comandos acima. Os preços estão em https://pageaudit.online/pricing.
| File | What it is |
|---|---|
skills/pageaudit/SKILL.md | The skill: which tool answers which question, and the rules for limits and payment |
.mcp.json | The remote MCP server of the plugin |
.claude-plugin/plugin.json | The plugin manifest |
.claude-plugin/marketplace.json | Lets Claude Code add this repository as a plugin marketplace |
server.json | The manifest in the official MCP registry (online.pageaudit/pageaudit) |
glama.json | The maintainer for the Glama MCP directory |
The files in this repository are under the MIT-0 license. The PageAudit service is not part of this license: its use follows the terms of use and the privacy policy. For questions or problems, open an issue here or write to contato@pageaudit.online.