Relvato

npx add-mcp 'https://app.relvato.com/api/mcp'

Quick start

Every request authenticates with an API key you create in the app. Point curl, your CI, or any HTTP client at https://app.relvato.com/api/v1.

# 1 — Confirm your key works and see the endpoints
curl https://app.relvato.com/api/v1 \
  -H "Authorization: Bearer rlv_your_key"

# 2 — List the sites Relvato monitors for you
curl https://app.relvato.com/api/v1/sites \
  -H "Authorization: Bearer rlv_your_key"

# 3 — Read recent runs (optionally scoped to one site)
curl "https://app.relvato.com/api/v1/runs?limit=10" \
  -H "Authorization: Bearer rlv_your_key"

# 4 — One run in detail, then the fix brief Relvato's AI would answer
curl https://app.relvato.com/api/v1/runs/RUN_ID \
  -H "Authorization: Bearer rlv_your_key"
curl https://app.relvato.com/api/v1/runs/RUN_ID/fix-prompt \
  -H "Authorization: Bearer rlv_your_key"

# 5 — Trigger an on-demand scan of a site (full-access key)
curl -X POST https://app.relvato.com/api/v1/sites/SITE_ID/scan \
  -H "Authorization: Bearer rlv_your_key"

Authentication

Send your key on every request as Authorization: Bearer rlv_your_key (an x-api-key header works too). A missing, revoked, or unknown key returns 401.

Create and revoke keys under API access in the app. Keys start with rlv_ and are shown once at creation. Each key is read-only (sites, runs, the site overview, fix briefs and alert settings) or full access (also add sites and checks, change schedules and run scans). Keys made before scopes existed have full access. Treat keys like a password.

REST endpoints

Every endpoint is scoped to the account behind the key and returns JSON. Base URL https://app.relvato.com/api/v1.

Method	Endpoint	Description
GET	/api/v1	Confirms the key and lists the available endpoints.
GET	/api/v1/sites	Lists the websites Relvato monitors for you.
GET	/api/v1/sites/:id/overview	A site's health verdict: what needs attention, each check's latest run and plan usage.
GET	/api/v1/runs	Recent verification runs, newest first — optional siteId and limit (1–100) query params.
GET	/api/v1/runs/:id	One run in detail: steps, warnings, findings and metrics (compacted when large).
GET	/api/v1/runs/:id/fix-prompt	For a run that found a problem: the brief Relvato's own AI answers — stack, what changed, the error and evidence.
GET	/api/v1/alert-settings	Who is told about what: frequency, severity, channels and routing. Never URLs or secrets.
POST	/api/v1/sites/:id/scan	Queues an on-demand scan of one site and returns the run ids. Needs a full-access key; counts against your monthly run quota.

Example: list sites

{
  "sites": [
    {
      "id": "st_1a2b3c",
      "name": "style4street",
      "url": "https://style4street.com",
      "connectionType": "wordpress"
    }
  ]
}

Example: recent runs

A run that failed but was later resolved (baseline accepted or ignored) reports status: "passed" with resolved: true.

{
  "runs": [
    {
      "id": "rn_9f8e7d",
      "siteId": "st_1a2b3c",
      "checkId": "ck_4d5e6f",
      "journey": "checkout",
      "checkName": "Checkout",
      "status": "passed",
      "resolved": false,
      "trigger": "schedule",
      "startedAt": "2026-08-31T09:15:00.000Z",
      "durationMs": 4210,
      "error": null,
      "warning": null
    }
  ]
}

Example: one run in detail

Findings come in metrics.items. A large run is compacted rather than cut: long series become summaries, and what was left out is listed in metricsTrimmed — the headline and findings are always kept.

{
  "runId": "rn_9f8e7d",
  "runUrl": "https://app.relvato.com/runs/rn_9f8e7d",
  "check": { "key": "google-search", "name": "Google Search" },
  "status": "passed",
  "warning": "https://style4street.com/category/topuri/hanorace/ lost 57% of its Google impressions",
  "metrics": {
    "headline": { "tone": "warn", "text": "🔎 1 thing to review on Google Search (as of 2026-09-24)" },
    "items": [
      { "text": "https://style4street.com/category/topuri/hanorace/ lost 57% of its Google impressions — 98 in the 7 days to 2026-09-24, against 226 in an average week before", "tone": "warn" }
    ],
    "search": { "engine": "google", "tiles": [ … ], "dailies": [ { "label": "Impressions per day", "days": 84, "last7Total": 2196, "usualLast7Total": 2583 } ], … }
  },
  "metricsTrimmed": {
    "note": "Large parts were left out to keep this short — the run page has everything.",
    "omitted": ["search.dailies (the per-day values — summarized)", "search.tiles[].weekly (the 8 weekly bars)"]
  }
}

Example: a run's fix brief

For a run that found a problem, fix-prompt returns the brief Relvato's own AI answers: the site's stack, what changed just before, the error and findings, and for Google / Bing Search the evidence that rules causes out. Hand it to your own model, or read it yourself.

{
  "runId": "rn_9f8e7d",
  "runUrl": "https://app.relvato.com/runs/rn_9f8e7d",
  "hasIssue": true,
  "prompt": "# Help me understand a Google Search change on my WordPress site\n\nYou are a senior SEO specialist. … ## Evidence Relvato already has …"
}

Rate limits

Requests are limited per minute, per account, across REST and MCP combined. Your plan sets the ceiling:

Plan	Requests / min
Free	30
Pro	120
Business	600
Agency	2,400

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Over the limit returns 429 with a Retry-After header.

Status codes

Status	Meaning
200	Success.
400	The request is missing something or can't be done — the message says what.
401	Missing, unknown, or revoked API key.
403	The key is read-only and the request would change something or run a scan.
404	Site or run not found for this account.
409	Site is disabled, or you haven't proven you own it yet (domain not verified, or WordPress plugin never connected).
429	Rate limit hit, or the monthly run quota is used up.

MCP server (for AI agents)

Relvato is also a remote Model Context Protocol server, so an agent like Claude can set up monitoring in a conversation: add a site, walk you through connecting it, pick its checks, run them and explain the results. It uses the same key and the same rate limit as the REST API. Accepting baselines, ignoring warnings and fixes stay in the dashboard, with you looking. A read-only key only gets the read tools.

Things you can ask an agent connected to Relvato:

• “Why did checkout fail on my shop last night, and how do I fix it?”
• “Set up monitoring for example.com and tell me what I need to do to connect it.”
• “Who gets alerted when a Security check fails, and on which channels?”

Endpoint https://app.relvato.com/api/mcp

Tool	What it does
list_sites	List the account's websites and whether each is ready to run checks.
add_site	Add a website and get its setup step: connect the WordPress plugin, or verify the domain.
verify_site	Check that setup step: the plugin connection, or the domain-verification DNS record or meta tag.
site_overview	Plain-language health verdict: what needs attention, every check with its latest run and schedule, and plan usage.
list_checks	The checks you can add to a site: what each catches, whether your plan includes it, and which are recommended.
add_checks	Add checks to a site; each one reports added, already there, or why not.
update_check	Turn a check on or off, or change its schedule.
trigger_scan	Run a site's checks now — or a single check — and get the run ids back (uses the monthly quota).
list_runs	List recent runs, newest first — optionally for one site.
get_run	One run in detail: status, error, warnings, steps, visual comparisons and the dashboard link.
get_fix_prompt	For a run that found a problem: the same brief Relvato's own AI answers, to reason about the likely cause and fixes.
get_alert_settings	Who is told about what: frequency, severity, each channel's state and routing — no URLs or secrets.

Add it as a remote HTTP connector. In a client that reads an mcp.json, the entry looks like this:

{
  "mcpServers": {
    "relvato": {
      "type": "http",
      "url": "https://app.relvato.com/api/mcp",
      "headers": {
        "Authorization": "Bearer rlv_your_key"
      }
    }
  }
}

Webhooks

The API answers when you ask. To be told the moment a check fails, add a webhook: Relvato POSTs a signed JSON event to your URL for every alert (Pro and up). Set up a webhook →

Frequently asked questions

Which plans include API and MCP access?

All of them, including Free — only the per-minute rate limit differs. Free allows 30 requests a minute; paid plans allow more.

How do I get a key?

Sign in and open API access in the app. Choose read-only or full access for each key; you can create several and revoke any of them at any time.

What can a read-only key do?

Everything that only reads: sites, runs, the site health overview, fix briefs, alert settings and the check catalog — over REST and MCP. An MCP client connected with a read-only key only sees the read tools. Adding sites or checks, changing schedules and running scans return 403 and need a full-access key.

Does triggering a scan use my quota?

Yes. On-demand scans — over REST or MCP — draw from the same monthly run quota as scheduled checks.

Can an agent add sites and change checks?

Yes — within your plan's limits, the same as in the dashboard. It can't skip ownership: a new site only runs once its WordPress plugin is connected or its domain is verified. Accepting new baselines, ignoring warnings and applying fixes aren't available over MCP.