CertScore.ai
Herkese açık web sitelerini gizlilik, çerez, izleyici, onay, politika ve açıklama risk sinyalleri açısından tarayın—sıfır kimlik doğrulamalı Light modu ile anında başlayın.
Dokümantasyon
Start here
Which route should I choose?
Start anonymously in one minute. Upgrade only when you need more scans, team or backend access, history, or advanced tools.
Recommended first step
Light MCP — no authentication
No account, API key, bearer token, browser login, or OAuth. Use it for first-time setup, testing, discovery, and low-volume public website scans.
When Light is not enough
Authenticated MCP
Hosted MCP — OAuth is for managed remote clients. Local MCP — scoped API key is for stdio, backend, and controlled local environments.
OpenAI MCP integration demo
See Light MCP in action
Watch the OpenAI/ChatGPT flow from prompt to CertScore tool calls, public-safe scan observations, and the full report. It is the quickest way to understand what the Light route feels like in practice.
Codex quickstart
Light MCP — no authentication
Run this command, then paste the first-run prompt into Codex. The connection uses Streamable HTTP and should not open a browser, request OAuth, or ask for an API key.
codex mcp add certscore --url https://mcp.certscore.ai/mcp/light
First-run prompt
Scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html. If certscore_scan_site includes preConsentPreview, treat it as a partial preview and continue the workflow. Distinguish captured totals from bounded returned identities; use trackingVendorCount for non-operational tracking vendors and keep operationalVendors separate. Do not compare the compatibility preview trackerCount with the completed inventory's broader trackerCount. Never report preview counts as final totals. If certscore_scan_site returns a queued, running, or finalizing result, retain the returned scanId and poll certscore_get_scan_status using scanId only. If certscore_scan_site returns a retryable error without a scanId, wait for retryAfterSeconds and retry certscore_scan_site; do not call certscore_get_scan_status until a scanId exists. Once the scan reaches a terminal status, call certscore_get_scan_bundle with detail=findings and maxBytes=8000. Summarize whether the result was new or reused, the score, risk level, findings, evidence links, coverage limitations, and report URL. Explain truncation or omitted sections when present. Treat results as automated public-web observations, not legal conclusions, certifications, or compliance determinations.
The ErgoVeritas canary page is a controlled, stable test site for demonstrating the complete scan, status, and bundle flow. Substitute your own public URL at any time.
CertScore results are automated observations from a public-web scan. No-go, not-observed, and limited-coverage results are not proof of compliance, absence of risk, or legal status. Review the retained evidence and applicable context before relying on a finding.
Cursor quickstart
Install CertScore in one click
Add the hosted, no-auth Light MCP directly to Cursor. Cursor will show the server configuration before installation; no API key, OAuth flow, or local executable is required.
After installation, confirm Cursor discovers exactly the three Light tools, then use one of the prompts below.
Canonical workflow
Exactly what the agent should do
certscore_scan_site
→ retry certscore_scan_site if a retryable error has no scanId
→ summarize preConsentPreview only as preliminary context when present
→ certscore_get_scan_status with scanId if still running
→ certscore_get_scan_bundle after terminal status
- 1Call certscore_scan_site with a public URL.
- 2If a retryable error has no scanId, wait retryAfterSeconds and retry certscore_scan_site.
- 3If preConsentPreview is present, summarize it only as preliminary passive observations and continue the workflow.
- 4If the result is queued, running, or finalizing, retain scanId.
- 5Poll certscore_get_scan_status using scanId only. Never poll until scanId exists.
- 6Stop polling when the scan reaches a terminal status, then call certscore_get_scan_bundle.
- 7Use detail=findings for a compact finding review.
- 8Use detail=evidence for evidence digests and references.
- 9If truncated, follow recommendedNextAction or increase maxBytes.
- 10Summarize findings together with coverage limitations and the report URL.
Terminal statuses are completed, completed_limited, failed, expired, and rate_limited. A completed_limited or no-go result is a usable observation with explicit limitations, not a transport failure.
certscore_get_scan_status should only be called after certscore_scan_site returns a scanId.
What can happen?
| Outcome | What the agent should do |
|---|---|
| completed | Call certscore_get_scan_bundle and summarize the result. |
| reused_scan | Report that an eligible prior scan was reused and quota was not consumed. Keep this original creation decision separate from a later scan_id_lookup. |
| queued / running / finalizing | Retain scanId and poll certscore_get_scan_status using scanId only. |
| preConsentPreview | Summarize only as preliminary passive cookie/tracker observations. It is not a finding, score, or final result; continue status polling. |
| completed_limited / no-go | Explain the limitation and never treat it as proof of compliance or absence of risk. |
| retryable error without scanId | Wait retryAfterSeconds and retry certscore_scan_site; do not poll status. |
| invalid URL | Correct the public HTTP or HTTPS URL, then retry certscore_scan_site. |
| rate_limited | Wait for the recommended delay or stop; do not guess a polling action. |
| truncated bundle | Report actualBytes, omittedSections, canonicalFindingsComplete, and nextRecommendedMaxBytes. When canonical findings are complete, retry only for omitted envelope detail; otherwise increase maxBytes or follow a report or evidence URL. |
Live demonstration
Scan a public website now
This starts the same no-account scan available to Light agents and opens its shareable public report.
Need more scans or advanced tools? Upgrade to Authenticated MCP.
Connect from your MCP client
Claude
Add a custom remote MCP connector and paste the Light endpoint.
ChatGPT
Add the remote MCP server in developer mode and paste the Light endpoint.
Cursor
Add a remote Streamable HTTP MCP server using the Light endpoint.
VS Code
Add an HTTP MCP server and use the Light endpoint as its URL.
Codex
Run: codex mcp add certscore --url https://mcp.certscore.ai/mcp/light
Transport: Streamable HTTP
URL: https://mcp.certscore.ai/mcp/light
Authentication: None
Bundle detail is explicit: summary returns the compact default, findings adds bounded finding detail,evidence adds retained-evidence summaries and references, and full adds the bounded public report without repeating findings or transport sections already present at the top level. Use maxBytes to request a byte budget. Light applies a transport-safe 25,000-byte ceiling and reports the requested budget, effective budget, ceiling, actual bytes, complete-tier bytes, and any truncation reason.
| detail | Recommended maxBytes | Use |
|---|---|---|
| summary | 5000 | Canonical overview |
| findings | 8000 | Compact finding review |
| evidence | 8000 | Finding plus evidence digests and references |
| full | 12000–25000 | All available bounded sections within the Light ceiling |
A 5,000-byte response preserves compact core findings before reducing optional inventory or duplicate envelope fields. At this tight tier, repeated per-finding URLs may be replaced by evidenceUrlTemplate; substitute the returned finding ID into that template using contentUrls.findings to reach the same canonical evidence endpoint. Short canonical nextStep actions are retained only when they fit without displacing a finding; use the finding URL or complete tier for longer actions. Inspect canonicalFindingsComplete, requestedMaxBytes, effectiveMaxBytes, responseCeilingBytes, actualBytes, fullPayloadBytes, truncated, omittedSections, nextRecommendedMaxBytes, and the report or evidence content URLs before retrying.
Prefer a managed directory connection? Find CertScore.ai on Smithery.
Verify the connection
Confirm the three-tool Light surface
List the available CertScore tools and confirm that certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle are available. Then scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html and report whether the result was new or reused.
Success means Codex lists exactly certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle; no OAuth prompt appears; and certscore_scan_site returns a stable scanId plus an explicit new-or-reused decision. A reused eligible result should show that quota was not consumed.
Codex troubleshooting
Common first-run issues
- Unexpected OAuth: remove the connection and add it again with the exact URL
https://mcp.certscore.ai/mcp/light. Do not configure a bearer token; the Light endpoint has no authentication. - Connection check: a successful Streamable HTTP connection completes initialization and lists the three Light tools without opening an authorization page.
- Missing scanId: retry
certscore_scan_siteonly when the error saysretryable: true; never pollcertscore_get_scan_statuswithoutscanId. - Rate limited: follow
retryAfterSecondsandrecommendedNextAction, or reuse an eligible result. The daily allowance resets at the returned UTC time. - Provenance:
retrievalModedescribes the current tool call, whilecreationDecisionsays whether the original scan was new or reused only when retained. Never treatscan_id_lookupalone as proof of reuse; reportunknownhonestly. Use numericscanAgeSecondswhen available. - Truncated bundle: when
canonicalFindingsCompleteis true, retry only for omitted envelope detail. Otherwise follownextRecommendedMaxByteswhen it fitsresponseCeilingBytes, or open one of the returned canonical report or evidence content URLs. - Invalid URL: correct the
urlfield using the structuredinvalid_argumentsresponse, then retrycertscore_scan_sitewith a public HTTP or HTTPS URL. - Limited result:
completed_limited, no-go, not-observed, and limited coverage are observations only, never proof of compliance. Transport failures instead returnfailed,expired, or a connection error with retry guidance.
At a glance
Compare the three MCP setup routes
| Route | Setup method | Authentication | Account | Quota | Available tools | Intended user | Website / access limits | Upgrade path |
|---|---|---|---|---|---|---|---|---|
| Light MCP — no authentication | One Codex command or a remote Streamable HTTP URL | None | Not required | Up to 50 new scans per UTC day across Light and 5 per rolling 10 minutes; eligible reuse is free | certscore_scan_site, certscore_get_scan_status, certscore_get_scan_bundle | First-time users, testing, and discovery | Public HTTP or HTTPS websites; core tools only | Choose authenticated access for volume, history, teams, or advanced tools |
| Hosted MCP — OAuth | Connect the hosted MCP endpoint from an OAuth-capable client | OAuth authorization code with PKCE | Required | Higher-volume allowance based on access | Core tools plus approved history and diagnostic tools | Production, team, and managed remote clients | Scopes control read and scan creation; scan creation may require support | Request additional scopes or volume from support |
| Local MCP — scoped API key | Install and run the local stdio server | Scoped API key in the client environment | Required | Higher-volume allowance based on key access | Tools permitted by the key scopes | Backend, local, and controlled automation workflows | Key scopes control read and scan creation; protect and rotate credentials | Request scan:create-equivalent scope, advanced access, or more volume |
Copy and run
Prompts for three common reviews
Launch review
Use CertScore.ai to scan [PUBLIC URL] before launch. Report the CertScore score and evidence-backed findings for pre-consent cookies and trackers, consent controls, the jurisdiction-neutral GPC response, Accept and Reject Path post-action observations when available, privacy-policy transparency, and HTTPS/TLS. Treat Accept as a score-neutral baseline and non-confirmed choice-path results as limited coverage. Do not present the result as legal advice, certification, or a compliance determination.
Vendor review
Use CertScore.ai to review [VENDOR PUBLIC URL]. Summarize the observed third-party tracking technologies, cookies and storage, CMP and consent-management signals, the jurisdiction-neutral GPC response, Accept and Reject Path post-action observations when available, policy and transparency findings, regulatory review signals, and HTTPS/TLS observations. Treat Accept as a score-neutral baseline. Include supporting evidence, the report URL, and all material coverage limitations.
Audit diagnostics
Use CertScore.ai to scan [PUBLIC URL] for audit diagnostics. Follow the scan through a terminal status, retrieve the findings bundle, and prioritize evidence-backed privacy, cookie, tracker, consent, jurisdiction-neutral GPC response, Accept Path, Reject Path, policy, GDPR/ePrivacy, CCPA/CPRA, and transport observations. Treat Accept as a score-neutral baseline and non-confirmed choice-path results as limited coverage. Explain what was observed, what remains unknown or limited, and which evidence a human reviewer should inspect next.
Light-to-Authenticated migration
Upgrade when Light becomes a constraint
Upgrade when you need a dedicated higher-volume allowance, production or team access, backend automation, scan history, advanced diagnostic tools, or support-managed scopes.
What changes
Use the full endpoint, authenticate with hosted OAuth or a local scoped API key, and receive the quota and tools granted to that access.
What stays compatible
Core identifiers and canonical response fields—including scanId, status, score, risk, coverage, and timestamps—remain compatible.
Need more scans or advanced tools? Upgrade to Authenticated MCP.
CertScore results are automated observations from a public-web scan. No-go, not-observed, and limited-coverage results are not proof of compliance, absence of risk, or legal status. Review the retained evidence and applicable context before relying on a finding.