Start here

Which route should I choose?

Start anonymously in one minute. Upgrade only when you need more scans, team or backend access, history, or advanced tools.

Recommended first step

Light MCP — no authentication

No account, API key, bearer token, browser login, or OAuth. Use it for first-time setup, testing, discovery, and low-volume public website scans.

Start with Light MCP

When Light is not enough

Authenticated MCP

Hosted MCP — OAuth is for managed remote clients. Local MCP — scoped API key is for stdio, backend, and controlled local environments.

Set up Authenticated MCP

Light MCP — no authentication

Give your agent a URL. Get a website privacy-risk scan.

No signup, API key, bearer token, browser login, or OAuth. Connect once and let an MCP-capable agent scan public websites for privacy, cookie, tracker, consent, policy, and disclosure risk signals.

Try it now

Streamable HTTP with no API key and no OAuth. Light allows up to 50 genuinely new scans per UTC day across the public Light surface and 5 per rolling 10 minutes; reused eligible results do not consume quota. Contact [email protected] for higher volume.

Remote MCP endpoint

https://mcp.certscore.ai/mcp/light

1Run the Codex setup command

2Paste the first-run prompt

3Review the canonical result

Codex quickstart

Light MCP — no authentication

Run this command, then paste the first-run prompt into Codex. The connection uses Streamable HTTP and should not open a browser, request OAuth, or ask for an API key.

codex mcp add certscore --url https://mcp.certscore.ai/mcp/light

First-run prompt

Scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html. If certscore_scan_site returns a queued, running, or finalizing result, retain the returned scanId and poll certscore_get_scan_status using scanId only. If certscore_scan_site returns a retryable error without a scanId, wait for retryAfterSeconds and retry certscore_scan_site; do not call certscore_get_scan_status until a scanId exists. Once the scan reaches a terminal status, call certscore_get_scan_bundle with detail=findings and maxBytes=8000. Summarize whether the result was new or reused, the score, risk level, findings, evidence links, coverage limitations, and report URL. Explain truncation or omitted sections when present. Treat results as automated public-web observations, not legal conclusions, certifications, or compliance determinations.

The ErgoVeritas canary page is a controlled, stable test site for demonstrating the complete scan, status, and bundle flow. Substitute your own public URL at any time.

CertScore results are automated observations from a public-web scan. No-go, not-observed, and limited-coverage results are not proof of compliance, absence of risk, or legal status. Review the retained evidence and applicable context before relying on a finding.

Canonical workflow

Exactly what the agent should do

certscore_scan_site
→ retry certscore_scan_site if a retryable error has no scanId
→ certscore_get_scan_status with scanId if still running
→ certscore_get_scan_bundle after terminal status

1Call certscore_scan_site with a public URL.
2If a retryable error has no scanId, wait retryAfterSeconds and retry certscore_scan_site.
3If the result is queued, running, or finalizing, retain scanId.
4Poll certscore_get_scan_status using scanId only. Never poll until scanId exists.
5Stop polling when the scan reaches a terminal status, then call certscore_get_scan_bundle.
6Use detail=findings for a compact finding review.
7Use detail=evidence for evidence digests and references.
8If truncated, follow recommendedNextAction or increase maxBytes.
9Summarize findings together with coverage limitations and the report URL.

Terminal statuses are completed, completed_limited, failed, expired, and rate_limited. A completed_limited or no-go result is a usable observation with explicit limitations, not a transport failure.

certscore_get_scan_status should only be called after certscore_scan_site returns a scanId.

What can happen?

Outcome	What the agent should do
completed	Call `certscore_get_scan_bundle` and summarize the result.
reused_scan	Report that an eligible prior result was reused and quota was not consumed.
queued / running / finalizing	Retain `scanId` and poll `certscore_get_scan_status` using `scanId` only.
completed_limited / no-go	Explain the limitation and never treat it as proof of compliance or absence of risk.
retryable error without scanId	Wait `retryAfterSeconds` and retry `certscore_scan_site`; do not poll status.
invalid URL	Correct the public HTTP or HTTPS URL, then retry `certscore_scan_site`.
rate_limited	Wait for the recommended delay or stop; do not guess a polling action.
truncated bundle	Report `actualBytes`, `omittedSections`, and `nextRecommendedMaxBytes`; increase `maxBytes` or follow a report or evidence URL.

Live demonstration

Scan a public website now

This starts the same no-account scan available to Light agents and opens its shareable public report.

Need more scans or advanced tools? Upgrade to Authenticated MCP.

Connect from your MCP client

Claude

Add a custom remote MCP connector and paste the Light endpoint.

ChatGPT

Add the remote MCP server in developer mode and paste the Light endpoint.

Cursor

Add a remote Streamable HTTP MCP server using the Light endpoint.

VS Code

Add an HTTP MCP server and use the Light endpoint as its URL.

Codex

Run: codex mcp add certscore --url https://mcp.certscore.ai/mcp/light

Transport: Streamable HTTP
URL: https://mcp.certscore.ai/mcp/light
Authentication: None

Bundle detail is explicit: summary returns the compact default, findings adds bounded finding detail,evidence adds retained-evidence summaries and references, and full adds the bounded public report. Use maxBytes to set a 5,000–200,000 byte budget; the response reports requested bytes, actual bytes, and any truncation reason.

detail	Recommended maxBytes	Use
summary	5000	Canonical overview
findings	8000	Compact finding review
evidence	8000	Finding plus evidence digests and references
full	12000 or higher	All available bounded sections

A 5,000-byte response may intentionally omit optional sections while still returning a compact finding or evidence reference when available. Inspect actualBytes, truncated, omittedSections, nextRecommendedMaxBytes, and the report or evidence content URLs before retrying.

Prefer a managed directory connection? Find CertScore.ai on Smithery.

Verify the connection

Confirm the three-tool Light surface

List the available CertScore tools and confirm that certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle are available. Then scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html and report whether the result was new or reused.

Success means Codex lists exactly certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle; no OAuth prompt appears; and certscore_scan_site returns a stable scanId plus an explicit new-or-reused decision. A reused eligible result should show that quota was not consumed.

Codex troubleshooting

Common first-run issues

Unexpected OAuth: remove the connection and add it again with the exact URL https://mcp.certscore.ai/mcp/light. Do not configure a bearer token; the Light endpoint has no authentication.
Connection check: a successful Streamable HTTP connection completes initialization and lists the three Light tools without opening an authorization page.
Missing scanId: retry certscore_scan_site only when the error says retryable: true; never poll certscore_get_scan_status without scanId.
Rate limited: follow retryAfterSeconds and recommendedNextAction, or reuse an eligible result. The daily allowance resets at the returned UTC time.
Reused result: report that the eligible prior scan was reused and quota was not consumed.
Truncated bundle: follow nextRecommendedMaxBytes, increase maxBytes, or open one of the returned content URLs.
Invalid URL: correct the url field using the structured invalid_arguments response, then retry certscore_scan_site with a public HTTP or HTTPS URL.
Limited result: completed_limited, no-go, not-observed, and limited coverage are observations only, never proof of compliance. Transport failures instead return failed, expired, or a connection error with retry guidance.

At a glance

Compare the three MCP setup routes

Route	Setup method	Authentication	Account	Quota	Available tools	Intended user	Website / access limits	Upgrade path
Light MCP — no authentication	One Codex command or a remote Streamable HTTP URL	None	Not required	Up to 50 new scans per UTC day across Light and 5 per rolling 10 minutes; eligible reuse is free	certscore_scan_site, certscore_get_scan_status, certscore_get_scan_bundle	First-time users, testing, and discovery	Public HTTP or HTTPS websites; core tools only	Choose authenticated access for volume, history, teams, or advanced tools
Hosted MCP — OAuth	Connect the hosted MCP endpoint from an OAuth-capable client	OAuth authorization code with PKCE	Required	Higher-volume allowance based on access	Core tools plus approved history and diagnostic tools	Production, team, and managed remote clients	Scopes control read and scan creation; scan creation may require support	Request additional scopes or volume from support
Local MCP — scoped API key	Install and run the local stdio server	Scoped API key in the client environment	Required	Higher-volume allowance based on key access	Tools permitted by the key scopes	Backend, local, and controlled automation workflows	Key scopes control read and scan creation; protect and rotate credentials	Request scan:create-equivalent scope, advanced access, or more volume

Five useful agent workflows

Scan my website for cookies and trackers observed before consent.

Compare the privacy-risk signals from these three public websites.

Review this domain before vendor onboarding and summarize evidence-backed concerns.

Identify the most important privacy, consent, policy, and disclosure risks on this site.

Scan this list of public websites and create a concise review table with coverage limitations.

Light-to-Authenticated migration

Upgrade when Light becomes a constraint

Upgrade when you need a dedicated higher-volume allowance, production or team access, backend automation, scan history, advanced diagnostic tools, or support-managed scopes.

What changes

Use the full endpoint, authenticate with hosted OAuth or a local scoped API key, and receive the quota and tools granted to that access.

What stays compatible

Core identifiers and canonical response fields—including scanId, status, score, risk, coverage, and timestamps—remain compatible.

Need more scans or advanced tools? Upgrade to Authenticated MCP.

Set up Authenticated MCP Contact support