Wardzo MCP

An official MCP server by Wardzo that enables AI agents to scan live websites for security vulnerabilities (leaked keys, exposed files), SEO health issues, and uptime problems. It provides tools to list sites, get reports, explain issues with fix instructions, and re-check sites after fixes are deployed.

Visit Wardzo

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Vendor evidenceStreamable HTTPNo sign-inEndpoint checked 2026-11-01Operated by Wardzo

You need:Create a free account and add your site.Open Dashboard → API keys & MCP ( wardzo.com/app/keys ) and click Create key .

MCP endpoint (Streamable HTTP)

https://wardzo.com/mcp

Vendor documentation

What you can do with it

Scan a public website for security, SEO, and uptime issues
Explain specific security or SEO findings with step-by-step fixes
Monitor listed sites for new findings and uptime changes
Add or remove endpoint checks for API health and login URLs

Source and maintenance

Vendor evidenceRegistry 1.1.0

mcp-registry: com.wardzo/wardzo@1.1.0 Project website

Protocol and capabilities

Server: wardzo 1.2.0
MCP protocol: 2025-06-18
Tools: 12 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": true
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Wardzo monitors live websites from the outside for security (leaked API keys, exposed .env/.git files, security headers, TLS, SEO spam/cloaking), SEO health (noindex, robots.txt, sitemaps, titles, broken pages) and uptime. Use scan_site for a quick passive scan of any public URL (works without an API key, but then returns a summary only: score, counts by severity and the top finding). With an API key: list_sites, add_site, get_site_status, list_issues, get_new_findings, explain_issue, recheck_site, plus endpoint checks (list_endpoints, add_endpoint, remove_endpoint) that watch specific URLs on your verified sites with GET/HEAD. Typical fix loop for a coding agent: list_issues -> explain_issue(issue_id) -> apply the fix in the codebase or hosting config -> deploy -> recheck_site. Staying up to date: Wardzo re-scans monitored sites in the background. Call get_new_findings at the start of a session (or when the user asks "anything new from Wardzo?") to get only the findings that appeared since this connection last checked; they are then marked as seen for this connection. When there is something new, other account tools end their answer with a one-line heads-up. The resource wardzo://findings/new shows the same list without marking it seen. This server is stateless (no push stream), so poll with get_new_findings; the account owner also gets an email (if alerts are on) when new findings from background scans are not fetched by any connected AI within about an hour. Scans are passive and read-only; Wardzo never attacks a site. Secrets in evidence are masked; any exposed key must be rotated.

Tools

12 advertised

scan_site — Scan a website

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Run a passive outside-in Wardzo scan of a public website (security, SEO health, uptime) and return the score, issues and report URL. Waits up to ~45 seconds for the result. Works without an API key (rate limited).

scan_site input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 300,
      "minLength": 3,
      "description": "Website URL or domain, e.g. example.com"
    }
  },
  "additionalProperties": false
}

scan_site annotations

{
  "title": "Scan a website",
  "readOnlyHint": true,
  "openWorldHint": true
}

get_report — Get a scan report

Advertised by the server during the last successful anonymous check.

Advertised read-only

Get the result of a Wardzo scan by its id (from scan_site, recheck_site or a wardzo.com/r/<id> link).

get_report input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "maxLength": 80,
      "minLength": 6,
      "description": "Scan id or report URL"
    }
  },
  "additionalProperties": false
}

get_report annotations

{
  "title": "Get a scan report",
  "readOnlyHint": true
}

list_sites — List monitored sites

Advertised by the server during the last successful anonymous check.

Advertised read-only

List the websites monitored in your Wardzo account with their latest score, open issue counts and uptime status.

list_sites input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {}
}

list_sites annotations

{
  "title": "List monitored sites",
  "readOnlyHint": true
}

add_site — Add a site to monitoring

Advertised by the server during the last successful anonymous check.

Open-world

Start monitoring a website: it is scanned now, then re-scanned on your plan schedule, with uptime checks and email alerts.

add_site input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 300,
      "minLength": 3,
      "description": "Website URL or domain"
    }
  },
  "additionalProperties": false
}

add_site annotations

{
  "title": "Add a site to monitoring",
  "readOnlyHint": false,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_site_status — Get site status

Advertised by the server during the last successful anonymous check.

Advertised read-only

Latest score (with change since the previous scan), open issues by severity, top issues, uptime (24h and 7d) and what changed in the last scan, for one of your monitored sites.

get_site_status input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "site"
  ],
  "properties": {
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Site id, domain or URL"
    }
  },
  "additionalProperties": false
}

get_site_status annotations

{
  "title": "Get site status",
  "readOnlyHint": true
}

list_issues — List open issues

Advertised by the server during the last successful anonymous check.

Advertised read-only

List open issues from the latest scan of one of your sites, most severe first. Each issue has an issue_id for explain_issue.

list_issues input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "site"
  ],
  "properties": {
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Site id, domain or URL"
    },
    "severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "info"
      ],
      "type": "string",
      "description": "Minimum severity to include (default: low)"
    }
  },
  "additionalProperties": false
}

list_issues annotations

{
  "title": "List open issues",
  "readOnlyHint": true
}

get_new_findings — Get new findings since last check

Advertised by the server during the last successful anonymous check.

Get the findings Wardzo detected on your monitored sites since this connection last checked (background re-scans, re-checks and new sites), newest last, and mark them as seen for this connection. A finding that stays open across scans is reported once, not every scan. The first call on a new connection returns every open finding. Each item has an issue_id for explain_issue, a status (open, or resolved if it was already fixed by the next scan) and evidence (secrets masked). Use mark_seen=false to peek without marking, or since (ISO timestamp) to list findings first seen after a time (does not move the marker). Filtering by site is also a peek.

get_new_findings input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Only this site (id, domain or URL). Peek only: does not mark anything as seen."
    },
    "limit": {
      "type": "integer",
      "maximum": 100,
      "minimum": 1,
      "description": "Maximum findings to return (default 50). If more are waiting, call again."
    },
    "since": {
      "type": "string",
      "maxLength": 40,
      "minLength": 10,
      "description": "ISO 8601 timestamp, e.g. 2026-10-27T08:00:00Z. Returns findings first seen after it, ignoring and not moving the last-seen marker."
    },
    "mark_seen": {
      "type": "boolean",
      "description": "Mark the returned findings as seen for this connection (default true)"
    }
  },
  "additionalProperties": false
}

get_new_findings annotations

{
  "title": "Get new findings",
  "readOnlyHint": false,
  "openWorldHint": false,
  "idempotentHint": false,
  "destructiveHint": false
}

explain_issue — Explain an issue and how to fix it

Advertised by the server during the last successful anonymous check.

Advertised read-only

Explain why an issue matters and give step-by-step fix instructions (with Next.js, Vercel, Netlify, Nginx, Apache, Cloudflare and WordPress snippets where relevant) that an AI coding agent can apply, plus how to verify.

explain_issue input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "issue_id"
  ],
  "properties": {
    "issue_id": {
      "type": "string",
      "maxLength": 120,
      "minLength": 3,
      "description": "issue_id from list_issues/scan_site (e.g. \"AbC123xyz:hsts_missing\") or a check name (e.g. \"exposed_env\")"
    }
  },
  "additionalProperties": false
}

explain_issue annotations

{
  "title": "Explain an issue",
  "readOnlyHint": true
}

recheck_site — Re-scan one of your sites

Advertised by the server during the last successful anonymous check.

Open-world

Run a fresh scan of one of your monitored sites (e.g. after deploying a fix) and report what changed. Waits up to ~45 seconds.

recheck_site input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "site"
  ],
  "properties": {
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Site id, domain or URL"
    }
  },
  "additionalProperties": false
}

recheck_site annotations

{
  "title": "Re-scan a site",
  "readOnlyHint": false,
  "openWorldHint": true,
  "destructiveHint": false
}

list_endpoints — List endpoint checks

Advertised by the server during the last successful anonymous check.

Advertised read-only

List the endpoint checks (GET/HEAD monitors for specific URLs such as /api/health) on one of your sites, with their current status, last HTTP status and response time.

list_endpoints input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "site"
  ],
  "properties": {
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Site id, domain or URL"
    }
  },
  "additionalProperties": false
}

list_endpoints annotations

{
  "title": "List endpoint checks",
  "readOnlyHint": true
}

add_endpoint — Add an endpoint check

Advertised by the server during the last successful anonymous check.

Open-world

Monitor a specific URL on one of your verified sites (for example an API health route, login or checkout page) with a GET or HEAD request on a schedule. The domain must be verified first, and the URL must not include a query string. Optionally require an exact HTTP status, a text snippet in the response, and a maximum response time. You get an email alert when it fails twice in a row and when it recovers. Wardzo never submits forms or sends request bodies.

add_endpoint input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "site",
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 500,
      "minLength": 1,
      "description": "Full URL on that site, or a path like \"/api/health\""
    },
    "site": {
      "type": "string",
      "maxLength": 300,
      "minLength": 1,
      "description": "Site id, domain or URL of one of your monitored sites"
    },
    "max_ms": {
      "type": "integer",
      "maximum": 30000,
      "minimum": 100,
      "description": "Fail if the response takes longer than this many milliseconds"
    },
    "method": {
      "enum": [
        "GET",
        "HEAD"
      ],
      "type": "string",
      "description": "HTTP method (default GET)"
    },
    "expect_status": {
      "type": "integer",
      "maximum": 599,
      "minimum": 100,
      "description": "Exact expected HTTP status (default: any 2xx or 3xx)"
    },
    "expect_keyword": {
      "type": "string",
      "maxLength": 100,
      "description": "Text that must appear in the response body (GET only)"
    }
  },
  "additionalProperties": false
}

add_endpoint annotations

{
  "title": "Add an endpoint check",
  "readOnlyHint": false,
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}

remove_endpoint — Remove an endpoint check

Advertised by the server during the last successful anonymous check.

Advertised destructive

Stop monitoring one endpoint check and delete its history. Use list_endpoints to find the endpoint_id.

remove_endpoint input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "endpoint_id"
  ],
  "properties": {
    "endpoint_id": {
      "type": "integer",
      "description": "endpoint_id from list_endpoints",
      "exclusiveMinimum": 0
    }
  },
  "additionalProperties": false
}

remove_endpoint annotations

{
  "title": "Remove an endpoint check",
  "readOnlyHint": false,
  "openWorldHint": false,
  "idempotentHint": true,
  "destructiveHint": true
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 623 ms
95th percentile latency: 623 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 1, 2026, 9:07 AM UTC · probe · passed · 623 ms · metadata changed · 12 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http wardzo-mcp https://wardzo.com/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add wardzo-mcp --url https://wardzo.com/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable wardzo-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "wardzo-mcp": {
      "url": "https://wardzo.com/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "wardzo-mcp": {
      "type": "streamableHttp",
      "url": "https://wardzo.com/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start wardzo-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "wardzo-mcp": {
      "type": "http",
      "url": "https://wardzo.com/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http wardzo-mcp https://wardzo.com/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.

Claude Desktop configuration

{
  "mcpServers": {
    "wardzo-mcp": {
      "url": "https://wardzo.com/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "wardzo-mcp": {
      "serverUrl": "https://wardzo.com/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Wardzo MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows

See all 6,904

Do you run Wardzo MCP?

Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.

Claim this listing

Wardzo MCP

Endpoint and access

What you can do with it

Source and maintenance

Protocol and capabilities

Server-provided instructions

Tools

Prompts

Resources

30-day availability

Maintenance history

Connect from your client

Claude Code

Codex

Cursor

Cline

VS Code

Gemini CLI

Claude Desktop

Windsurf

Let your agent find its tools

Other developer tools servers

Do you run Wardzo MCP?