Certscore MCP server
{
"mcpServers": {
"certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp@latest"
],
"env": {
"NEXT_PUBLIC_APP_URL": "https://...",
"DATABASE_URL": "postgresql://user:password@host:5432/db",
"BETTER_AUTH_SECRET": "<better_auth_secret>",
"GOOGLE_CLIENT_ID": "<google_client_id>",
"GOOGLE_CLIENT_SECRET": "<google_client_secret>",
"S3_ACCESS_KEY_ID": "<s3_access_key_id>"
}
}
}
}{
"mcpServers": {
"certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp@latest"
],
"env": {
"NEXT_PUBLIC_APP_URL": "https://...",
"DATABASE_URL": "postgresql://user:password@host:5432/db",
"BETTER_AUTH_SECRET": "<better_auth_secret>",
"GOOGLE_CLIENT_ID": "<google_client_id>",
"GOOGLE_CLIENT_SECRET": "<google_client_secret>",
"S3_ACCESS_KEY_ID": "<s3_access_key_id>"
}
}
}
}{
"mcpServers": {
"certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp@latest"
],
"env": {
"NEXT_PUBLIC_APP_URL": "https://...",
"DATABASE_URL": "postgresql://user:password@host:5432/db",
"BETTER_AUTH_SECRET": "<better_auth_secret>",
"GOOGLE_CLIENT_ID": "<google_client_id>",
"GOOGLE_CLIENT_SECRET": "<google_client_secret>",
"S3_ACCESS_KEY_ID": "<s3_access_key_id>"
}
}
}
}{
"servers": {
"certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp@latest"
],
"env": {
"NEXT_PUBLIC_APP_URL": "${input:next_public_app_url}",
"DATABASE_URL": "${input:database_url}",
"BETTER_AUTH_SECRET": "${input:better_auth_secret}",
"GOOGLE_CLIENT_ID": "${input:google_client_id}",
"GOOGLE_CLIENT_SECRET": "${input:google_client_secret}",
"S3_ACCESS_KEY_ID": "${input:s3_access_key_id}"
}
}
},
"inputs": [
{
"id": "next_public_app_url",
"type": "promptString",
"description": "Next public app url",
"password": true
},
{
"id": "database_url",
"type": "promptString",
"description": "Database url",
"password": true
},
{
"id": "better_auth_secret",
"type": "promptString",
"description": "Better auth secret",
"password": true
},
{
"id": "google_client_id",
"type": "promptString",
"description": "Google client id",
"password": true
},
{
"id": "google_client_secret",
"type": "promptString",
"description": "Google client secret",
"password": true
},
{
"id": "s3_access_key_id",
"type": "promptString",
"description": "S3 access key id",
"password": true
}
]
}{
"mcpServers": {
"certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp@latest"
],
"env": {
"NEXT_PUBLIC_APP_URL": "https://...",
"DATABASE_URL": "postgresql://user:password@host:5432/db",
"BETTER_AUTH_SECRET": "<better_auth_secret>",
"GOOGLE_CLIENT_ID": "<google_client_id>",
"GOOGLE_CLIENT_SECRET": "<google_client_secret>",
"S3_ACCESS_KEY_ID": "<s3_access_key_id>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @certscore/mcpversion 0.2.4
What it does
CertScore MCP Light is a hosted, no-auth MCP server that exposes tools for scanning public websites for privacy, cookie, tracker, consent, policy, and HTTPS/TLS risk signals. It returns a CertScore score and evidence-backed findings suitable for human or agentic review. It is intended for developers and AI agents who want to assess website risk signals before or after launch.
- Scan a public URL to retrieve privacy and cookie risk signals along with a CertScore score before deploying a site.
- Look up the most recent scan findings for a domain to check for consent, tracker, or policy issues.
- Retrieve evidence items from a previous scan to feed into an automated review or reporting workflow.
Tools this server exposes
| Tool | Does |
|---|---|
| scan | Initiates a scan of a public URL and returns risk signal findings, a CertScore score, and supporting evidence. |
| findings | Returns the findings from a specific scan, including privacy, cookie, tracker, consent, and policy signals. |
| latest_domain | Looks up the most recent scan results for a given domain. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.