cordlesssteve/webby-mcp
If you are the rightful owner of webby-mcp and would like to certify it and/or have it hosted online, please leave a comment on the right or send an email to henry@mcphub.com.
Webby is a comprehensive website validator MCP server that tests websites across performance, accessibility, SEO, and security dimensions.
Webby - Comprehensive Website Validator MCP Server
A Model Context Protocol (MCP) server that provides comprehensive website testing across performance, accessibility, SEO, and security dimensions.
Features
š Performance Testing
- WebPageTest ā - Real browser testing via Playwright automation (300 tests/month free, no API key)
- Google PageSpeed Insights ā - Core Web Vitals and Google ranking signals (25K API calls/day free)
- GTmetrix ā - Lighthouse + custom metrics with historical tracking (requires API key)
āæ Accessibility Testing
- Axe DevTools ā - Fast WCAG scans via Playwright + axe-core (free, open-source)
- WAVE ā - WCAG compliance and contrast analysis (requires API key)
š SEO Testing
- PageSpeed Insights SEO ā - Uses Lighthouse SEO (free, comprehensive)
š Security Testing
- Mozilla Observatory ā - HTTP security headers analysis (CSP, HSTS) - Free API, 1 scan/min
- SSL Labs ā - Comprehensive SSL/TLS certificate testing - Free API (requires email)
Installation
cd ~/mcp-servers/servers/src/webby
npm install
npm run build
MCP Tools (11 Total)
Performance Tools (3)
validate_performance_pagespeed
{
url: string,
strategy?: 'mobile' | 'desktop', // default: mobile
apiKey?: string // optional, for higher quota
}
// Returns: Performance score, Core Web Vitals, metrics
validate_performance_webpagetest
⨠NEW
{
url: string,
location?: string, // e.g., 'Dulles:Chrome'
runs?: number, // default: 1
waitForResults?: boolean, // default: false (returns test ID immediately)
timeout?: number // default: 300000 (5 min)
}
// Returns: Test ID + results URL immediately OR full results if waitForResults=true
// Metrics: Load Time, FCP, LCP, Speed Index, TTI, TBT, CLS, Performance Grade
validate_performance_gtmetrix
{
url: string,
apiKey: string, // required
location?: string, // e.g., 'vancouver-canada'
browser?: string // e.g., 'chrome'
}
// Returns: Lighthouse score, PageSpeed score, load time, page size
Accessibility Tools (2)
validate_accessibility_axe
{
url: string,
wcagLevel?: string // wcag2a, wcag2aa, wcag2aaa, wcag21aa, wcag22aa
}
// Returns: Violations by severity (critical, serious, moderate, minor), passes, incomplete
validate_accessibility_wave
{
url: string,
apiKey: string, // required
reporttype?: 1 | 2 | 3 | 4 // detail level (default: 2)
}
// Returns: Errors, contrast errors, alerts, WAVE report URL, credits remaining
Security Tools (2)
validate_security_mozilla_observatory
{
url: string,
forceRescan?: boolean // default: false
}
// Returns: Grade (A+ to F), score, tests passed/failed, details URL
validate_security_ssl_labs
{
url: string,
email: string, // required by API
maxAge?: number, // cached report age in hours
startNew?: boolean, // force new assessment
waitForComplete?: boolean, // wait for completion (can take 2-5 min)
maxWaitMinutes?: number // default: 5
}
// Returns: Grade (A+ to F), endpoint details, protocol info, status
Category Runners (4)
validate_all_performance
{
url: string,
pagespeedApiKey?: string,
gtmetrixApiKey?: string,
webpagetestEnabled?: boolean, // enable browser automation
webpagetestWaitForResults?: boolean // wait for WPT completion
}
// Returns: Results from PageSpeed + optionally WebPageTest + optionally GTmetrix
validate_all_accessibility
{
url: string,
waveApiKey?: string, // optional
wcagLevel?: string // for Axe
}
// Returns: Results from Axe + optionally WAVE
validate_all_seo
{
url: string
}
// Returns: SEO analysis from PageSpeed Insights (Lighthouse SEO)
validate_all_security
{
url: string,
email: string, // for SSL Labs
waitForSSL?: boolean // wait for SSL Labs completion
}
// Returns: Results from Mozilla Observatory + SSL Labs
Master Runner (1)
validate_comprehensive
{
url: string,
email: string, // required for SSL Labs
categories?: string[], // ['performance', 'accessibility', 'seo', 'security']
pagespeedApiKey?: string,
gtmetrixApiKey?: string,
waveApiKey?: string,
wcagLevel?: string,
waitForSSL?: boolean
}
// Returns: Complete analysis across all selected categories with overall health score
Response Format
{
"tool": "webpagetest",
"success": true,
"url": "https://example.com",
"test_id": "250107_AiDcA4_ABC",
"results_url": "https://www.webpagetest.org/result/250107_AiDcA4_ABC/",
"status": "complete",
"summary": {
"loadTime": 2500,
"firstContentfulPaint": 1200,
"speedIndex": 2300,
"largestContentfulPaint": 2100,
"timeToInteractive": 3500,
"totalBlockingTime": 250,
"cumulativeLayoutShift": 0.05
},
"performance_grade": "A",
"security_grade": "A+"
}
Implementation Status
ā Fully Implemented (9 tools)
validate_performance_pagespeed
- Google PageSpeed Insights APIvalidate_performance_webpagetest
- Playwright browser automation āØvalidate_performance_gtmetrix
- GTmetrix APIvalidate_accessibility_axe
- Playwright + axe-corevalidate_accessibility_wave
- WAVE APIvalidate_security_mozilla_observatory
- Mozilla Observatory APIvalidate_security_ssl_labs
- SSL Labs API with pollingvalidate_all_*
- All 4 category orchestratorsvalidate_comprehensive
- Master orchestrator
ā All Tools Functional
No placeholders - all 11 tools are fully implemented and working!
API Quotas & Limits
Tool | Free Limit | API Key Required | Implementation |
---|---|---|---|
Mozilla Observatory | 1 scan/min per domain | No | ā Direct API |
SSL Labs | Unlimited (rate limited) | Email only | ā Direct API |
PageSpeed Insights | 25,000/day | Optional (free) | ā Direct API |
WebPageTest | 300/month | No | ā Browser automation |
GTmetrix | Limited credits | Yes (free tier) | ā Direct API |
Axe | Unlimited | No | ā Browser automation |
WAVE | Varies by plan | Yes (paid) | ā Direct API |
Browser Automation
WebPageTest and Axe use Playwright for headless browser automation:
- Singleton browser instance - Reused across tests for efficiency
- Configurable timeouts - Default 5 minutes for WebPageTest, 1 minute for Axe
- Graceful cleanup - Browser closed on MCP server shutdown
- No API keys needed - Free access via web UI automation
Project Structure
webby/
āāā src/
ā āāā performance/
ā ā āāā pagespeed.ts ā
Google API
ā ā āāā webpagetest.ts ā
Playwright automation
ā ā āāā gtmetrix.ts ā
GTmetrix API
ā āāā accessibility/
ā ā āāā axe.ts ā
Playwright + axe-core
ā ā āāā wave.ts ā
WAVE API
ā āāā security/
ā ā āāā mozilla-observatory.ts ā
Mozilla API
ā ā āāā ssl-labs.ts ā
SSL Labs API + polling
ā āāā shared/
ā ā āāā browser-utils.ts ā
Playwright utilities
ā āāā orchestrator/
ā āāā run-all.ts ā
All orchestrators
āāā dist/ # Compiled JavaScript
āāā index.ts # Main MCP server entry
āāā package.json
āāā README.md
Usage Examples
Quick WebPageTest (instant response)
validate_performance_webpagetest("https://example.com")
// Returns test ID immediately, check results later at provided URL
Complete WebPageTest (wait for results)
validate_performance_webpagetest("https://example.com", {
waitForResults: true,
timeout: 300000 // 5 minutes
})
// Waits for test completion, returns full metrics
Run all performance tests
validate_all_performance("https://example.com", {
webpagetestEnabled: true, // Enable browser automation
webpagetestWaitForResults: false // Get test ID instantly
})
// Returns: PageSpeed + WebPageTest results
Comprehensive validation
validate_comprehensive("https://example.com", {
email: "your@email.com", // For SSL Labs
categories: ["performance", "security"],
webpagetestEnabled: true
})
// Returns: Full analysis with overall health score
License
MIT