Fireshift Leak Score

npx add-mcp 'https://mcp.fireshift.ai/mcp'

Fireshift MCP server

call reads Claude Cursor, VS Code… Fireshift MCP scan_site GTM-•••• your public tags Leak Score 0-100, findings Claude Cursor, VS Code… Fireshift MCP scan_site GTM-•••• your public tags Leak Score 0-100, findings

Your assistant calls scan_site. We read the site's public tags and send back the same score as the website.

In one line

Run the Fireshift scan from Claude, Cursor or any other MCP client. You get the same Leak Score and findings as the website, free, with no account and no API key.

The server URL

https://mcp.fireshift.ai/mcp

Streamable HTTP. Add it, then ask: "scan yoursite.com and tell me what to fix first".

Two tools

scan_site takes {"domain": "yoursite.com"} and returns the Leak Score (0 to 100), grade, each finding with its points and proof, and a report link. Same rules as the scan page, so the score matches.

get_stats takes nothing and returns totals: scans, sites, last 7 days, top findings, grade mix. No domain names.

What a scan looks like

A real scan_site call, 5 Nov 2026, B2B SaaS site, domain and container masked, evidence lines cut. A scan takes 2 to 20 seconds.

b2b-saas.example: Leak Score 44/100, grade D (scanned 2026-11-05).
Google Ads conversions: 27 (0 send a value). GA4 properties: 0. Containers: GTM-••••.
- [login, -20] 1 conversion fires on login. Returning users get counted as new conversions.
- [click, -10] 12 Google Ads conversions fire on a button or link click. The click counts even when the form after it is never sent.
- [duplicates, -10] 2 conversions are set up more than once, so one action can count twice.
- [too_many, -8] 27 Google Ads conversions are live. Past about 8, bidding spreads across steps that don't make money.
- [no_values, -8] 27 of 27 Google Ads conversions send no value. Bidding can't tell a $10 lead from a $10,000 one.
Primary vs secondary status of Ads conversions isn't visible from outside. A conversion set to secondary doesn't drive bidding.
Full report: https://fireshift.ai/scan/?d=b2b-saas.example

Set it up

Claude Code, one command:

claude mcp add --transport http fireshift https://mcp.fireshift.ai/mcp

Claude Desktop and claude.ai. Customize, Connectors, Add custom connector. Name it Fireshift, paste the URL, no sign-in. Free plan: one connector.

Claude Desktop stdio bridge, Cursor, VS Code, Windsurf

Claude Desktop without a free connector slot: the stdio bridge in claude_desktop_config.json (needs Node.js)

{
  "mcpServers": {
    "fireshift": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.fireshift.ai/mcp"]
    }
  }
}

Cursor (~/.cursor/mcp.json or .cursor/mcp.json)

{"mcpServers": {"fireshift": {"url": "https://mcp.fireshift.ai/mcp"}}}

VS Code (.vscode/mcp.json)

{"servers": {"fireshift": {"type": "http", "url": "https://mcp.fireshift.ai/mcp"}}}

Windsurf (~/.codeium/windsurf/mcp_config.json, then refresh the MCP list in Cascade)

{"mcpServers": {"fireshift": {"serverUrl": "https://mcp.fireshift.ai/mcp"}}}

Any other client takes the URL as is. From a terminal:

curl -s https://mcp.fireshift.ai/mcp \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scan_site","arguments":{"domain":"yoursite.com"}}}'

Limits

• 10 tool calls a minute per IP, one domain per call. Past that, wait a minute.
• A daily cap on fresh homepage reads, shared with the website.
• Public tags only. We never log in, fill a form or click. Server-side tags and tags behind consent are out of reach.

What we store

Same as a website scan: the domain and its result (score, grade, finding codes, first and last scan, count, via MCP). No IP, no email. Kept 12 months after the last scan. Privacy policy.