Wardzo

Wardzo MCP server

Give your AI assistant eyes on your live website. The Wardzo MCP server lets Claude, ChatGPT, Cursor and other agents scan a site for security, SEO and uptime problems, explain each issue, fix it in your code and confirm the fix.

Server URLs

• Sign in with your Wardzo account (OAuth): https://wardzo.com/mcp/account. Use this as a custom connector in Claude, ChatGPT or Cursor.
• No account or API key: https://wardzo.com/mcp. Scans and reports work anonymously as a summary (score, counts, top finding); full findings and fix guides need an account. Add Authorization: Bearer wz_… for your sites.

Transport: Streamable HTTP (stateless). Auth: OAuth 2.1 with PKCE and dynamic client registration, or API keys.

Quick setup

Claude Code

claude mcp add --transport http wardzo https://wardzo.com/mcp/account

Cursor, VS Code, Windsurf and other clients (JSON config)

{
  "mcpServers": {
    "wardzo": {
      "url": "https://wardzo.com/mcp/account"
    }
  }
}

Claude.ai and ChatGPT: add a custom connector with the URL https://wardzo.com/mcp/account and approve access. Full steps for every client are in the MCP setup guide.

Tools

Tool	Account	What it does
scan_site	No	Scan any public website for security, SEO health and uptime issues. Without an account: score, counts by severity and the top finding. With an account: every finding. For sensitive ones (exposed keys or files, and critical or high security issues), you see full details of every finding after you verify your domain.
get_report	No	Get a finished scan report by its id or wardzo.com/r/ link.
explain_issue	Yes	Why an issue matters and step-by-step fix instructions with framework and hosting snippets.
list_sites	Yes	Your monitored sites with score, open issues and uptime.
add_site	Yes	Start monitoring a website: scheduled scans, uptime checks and alerts.
get_site_status	Yes	Latest score and change, issues by severity, uptime and what changed.
list_issues	Yes	Open issues from the latest scan, most severe first, with ids for explain_issue.
get_new_findings	Yes	Only the findings that appeared since your AI last checked (deduplicated), then marked as seen.
recheck_site	Yes	Re-scan after you deploy a fix and see what got resolved.
list_endpoints	Yes	Endpoint checks on a site (API health, login, checkout URLs) with their status.
add_endpoint	Yes	Watch a URL on your site with GET/HEAD: expected status, required text, max response time.
remove_endpoint	Yes	Stop an endpoint check.

What it checks

• Security: leaked API keys in JavaScript, exposed .env and .git files, security headers (CSP, HSTS, clickjacking), TLS certificate, mixed content, SEO spam and cloaking. Verified domains on paid plans also get deep checks for backups, logs and credential files.
• SEO health: noindex mistakes, robots.txt, sitemaps, titles and descriptions, canonical tags and broken pages.
• Uptime: homepage checks, plus endpoint checks for API, login and checkout URLs.

Prompts to try

• “Scan mysite.com with Wardzo and fix the security headers in this Next.js project.”
• “List my critical and high Wardzo issues, explain the worst one, fix it, deploy, then recheck_site.”
• “Add an endpoint check for /api/health on mysite.com that must contain "ok".”
• “Is anything new on my sites since last week? Summarize the Wardzo status of all my sites.”

Limits

Plan	MCP calls	Sites
No account	30 per hour	Scans only
Free	20 per day	1
Basic	500 per month	3
Premium	5,000 per month	15
Scale	20,000 per month	50

Founder pricing: Founder Basic: $12/mo or $99/yr, locked while you stay subscribed, for the first 100 customers. No charge now; we email before anything is charged. Reserve a founder seat

Security and privacy

• Scans are passive and read-only; WardzoBot never submits forms or attacks a site. How WardzoBot behaves
• OAuth access tokens last one hour, refresh tokens rotate, and you can disconnect any app in your dashboard. Only hashes of tokens and keys are stored.
• Secrets found in evidence are masked. Any exposed key must still be rotated.

Frequently asked questions

What is the Wardzo MCP server?

It is a remote Model Context Protocol (MCP) server at https://wardzo.com/mcp. AI assistants and coding agents connect to it to scan live websites for security, SEO and uptime problems, read step-by-step fixes, monitor sites and re-check after a fix is deployed.

Is it free?

Yes. Scanning any public site works without an account (30 calls per hour). A free account adds monitoring of one site and 20 MCP calls per day. Paid plans add more sites and calls. Billing is not open yet: Founder Basic: $12/mo or $99/yr, locked while you stay subscribed, for the first 100 customers. No charge now; we email before anything is charged.

Which AI apps work with it?

Any client that supports remote MCP servers over Streamable HTTP: Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT developer mode connectors, Cursor, VS Code with GitHub Copilot, Windsurf, OpenAI Codex and others.

How does sign-in work?

Use https://wardzo.com/mcp/account as the connector URL. Your app opens a Wardzo page where you approve access with OAuth 2.1 and PKCE; no password or key is shared with the app. You can also use an API key from your dashboard as a Bearer token.

Is scanning safe for my website?

Yes. Scans are passive and read-only, like a careful visitor: no form submissions, no password guessing, no exploit payloads and no requests to private networks. Secrets found in evidence are masked.

What can my agent fix with it?

Typical fixes are security headers (CSP, HSTS, clickjacking), exposed.env or.git files, leaked API keys in JavaScript bundles, HTTPS redirects, robots.txt and sitemap problems, noindex mistakes, missing titles and descriptions, and broken pages.