Does CertScore.ai MCP Light require an account or API key?

No. MCP Light uses Streamable HTTP and requires no account, API key, bearer token, browser login, or OAuth.

Does CertScore.ai certify legal compliance?

No. Results are automated public-web observations for human and agentic review, not legal advice, certification, or a compliance determination.

Start here

Which route should I choose?

Start anonymously in one minute. Upgrade only when you need more scans, team or backend access, history, or advanced tools.

Recommended first step

Light MCP — no authentication

No account, API key, bearer token, browser login, or OAuth. Use it for first-time setup, testing, discovery, and low-volume public website scans.

Start with Light MCP

When Light is not enough

Authenticated MCP

Hosted MCP — OAuth is for managed remote clients. Local MCP — scoped API key is for stdio, backend, and controlled local environments.

Set up Authenticated MCP

Light MCP — no authentication

Give your agent a URL. Get a website privacy-risk scan.

No signup, API key, bearer token, browser login, or OAuth. Connect once and let an MCP-capable agent scan public websites for cookies, trackers, third-party technologies, CMP and consent signals, eligible Reject Path post-refusal observations, policy and transparency findings, regulatory review signals, and HTTPS/TLS observations.

Add to CursorTry it now Watch the demo

Streamable HTTP with no API key and no OAuth. Light allows up to 50 genuinely new scans per UTC day across the public Light surface and 5 per rolling 10 minutes; reused eligible results do not consume quota. Contact [email protected] for higher volume.

Read the MCP Light launch release

Official MCP Registry: ai.certscore/mcp-light v0.2.16 · Published by CertScore.ai, LLC

Remote MCP endpoint

https://mcp.certscore.ai/mcp/light

1Run the Codex setup command

2Paste the first-run prompt

3Review the canonical result

OpenAI MCP integration demo

See Light MCP in action

Watch the OpenAI/ChatGPT flow from prompt to CertScore tool calls, public-safe scan observations, and the full report. It is the quickest way to understand what the Light route feels like in practice.

Open the standalone MP4

Codex quickstart

Light MCP — no authentication

Run this command, then paste the first-run prompt into Codex. The connection uses Streamable HTTP and should not open a browser, request OAuth, or ask for an API key.

codex mcp add certscore --url https://mcp.certscore.ai/mcp/light

First-run prompt

Scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html. If certscore_scan_site includes preConsentPreview, treat it as a partial preview and continue the workflow. Distinguish captured totals from bounded returned identities; use trackingVendorCount for non-operational tracking vendors and keep operationalVendors separate. Do not compare the compatibility preview trackerCount with the completed inventory's broader trackerCount. Never report preview counts as final totals. If certscore_scan_site returns a queued, running, or finalizing result, retain the returned scanId and poll certscore_get_scan_status using scanId only. If certscore_scan_site returns a retryable error without a scanId, wait for retryAfterSeconds and retry certscore_scan_site; do not call certscore_get_scan_status until a scanId exists. Once the scan reaches a terminal status, call certscore_get_scan_bundle with detail=findings and maxBytes=8000. Summarize whether the result was new or reused, the score, risk level, findings, evidence links, coverage limitations, and report URL. Explain truncation or omitted sections when present. Treat results as automated public-web observations, not legal conclusions, certifications, or compliance determinations.

The ErgoVeritas canary page is a controlled, stable test site for demonstrating the complete scan, status, and bundle flow. Substitute your own public URL at any time.

CertScore results are automated observations from a public-web scan. No-go, not-observed, and limited-coverage results are not proof of compliance, absence of risk, or legal status. Review the retained evidence and applicable context before relying on a finding.

Cursor quickstart

Install CertScore in one click

Add the hosted, no-auth Light MCP directly to Cursor. Cursor will show the server configuration before installation; no API key, OAuth flow, or local executable is required.

Add to Cursor View Cursor Directory listing

After installation, confirm Cursor discovers exactly the three Light tools, then use one of the prompts below.

Canonical workflow

Exactly what the agent should do

certscore_scan_site
→ retry certscore_scan_site if a retryable error has no scanId
→ summarize preConsentPreview only as preliminary context when present
→ certscore_get_scan_status with scanId if still running
→ certscore_get_scan_bundle after terminal status

1Call certscore_scan_site with a public URL.
2If a retryable error has no scanId, wait retryAfterSeconds and retry certscore_scan_site.
3If preConsentPreview is present, summarize it only as preliminary passive observations and continue the workflow.
4If the result is queued, running, or finalizing, retain scanId.
5Poll certscore_get_scan_status using scanId only. Never poll until scanId exists.
6Stop polling when the scan reaches a terminal status, then call certscore_get_scan_bundle.
7Use detail=findings for a compact finding review.
8Use detail=evidence for evidence digests and references.
9If truncated, follow recommendedNextAction or increase maxBytes.
10Summarize findings together with coverage limitations and the report URL.

Terminal statuses are completed, completed_limited, failed, expired, and rate_limited. A completed_limited or no-go result is a usable observation with explicit limitations, not a transport failure.

certscore_get_scan_status should only be called after certscore_scan_site returns a scanId.

What can happen?

Outcome	What the agent should do
completed	Call `certscore_get_scan_bundle` and summarize the result.
reused_scan	Report that an eligible prior scan was reused and quota was not consumed. Keep this original creation decision separate from a later `scan_id_lookup`.
queued / running / finalizing	Retain `scanId` and poll `certscore_get_scan_status` using `scanId` only.
preConsentPreview	Summarize only as preliminary passive cookie/tracker observations. It is not a finding, score, or final result; continue status polling.
completed_limited / no-go	Explain the limitation and never treat it as proof of compliance or absence of risk.
retryable error without scanId	Wait `retryAfterSeconds` and retry `certscore_scan_site`; do not poll status.
invalid URL	Correct the public HTTP or HTTPS URL, then retry `certscore_scan_site`.
rate_limited	Wait for the recommended delay or stop; do not guess a polling action.
truncated bundle	Report `actualBytes`, `omittedSections`, `canonicalFindingsComplete`, and `nextRecommendedMaxBytes`. When canonical findings are complete, retry only for omitted envelope detail; otherwise increase `maxBytes` or follow a report or evidence URL.

Live demonstration

Scan a public website now

This starts the same no-account scan available to Light agents and opens its shareable public report.

Need more scans or advanced tools? Upgrade to Authenticated MCP.

Connect from your MCP client

Claude

Add a custom remote MCP connector and paste the Light endpoint.

ChatGPT

Add the remote MCP server in developer mode and paste the Light endpoint.

Cursor

Add a remote Streamable HTTP MCP server using the Light endpoint.

VS Code

Add an HTTP MCP server and use the Light endpoint as its URL.

Codex

Run: codex mcp add certscore --url https://mcp.certscore.ai/mcp/light

Transport: Streamable HTTP
URL: https://mcp.certscore.ai/mcp/light
Authentication: None

Bundle detail is explicit: summary returns the compact default, findings adds bounded finding detail,evidence adds retained-evidence summaries and references, and full adds the bounded public report without repeating findings or transport sections already present at the top level. Use maxBytes to request a byte budget. Light applies a transport-safe 25,000-byte ceiling and reports the requested budget, effective budget, ceiling, actual bytes, complete-tier bytes, and any truncation reason.

detail	Recommended maxBytes	Use
summary	5000	Canonical overview
findings	8000	Compact finding review
evidence	8000	Finding plus evidence digests and references
full	12000–25000	All available bounded sections within the Light ceiling

A 5,000-byte response preserves compact core findings before reducing optional inventory or duplicate envelope fields. At this tight tier, repeated per-finding URLs may be replaced by evidenceUrlTemplate; substitute the returned finding ID into that template using contentUrls.findings to reach the same canonical evidence endpoint. Short canonical nextStep actions are retained only when they fit without displacing a finding; use the finding URL or complete tier for longer actions. Inspect canonicalFindingsComplete, requestedMaxBytes, effectiveMaxBytes, responseCeilingBytes, actualBytes, fullPayloadBytes, truncated, omittedSections, nextRecommendedMaxBytes, and the report or evidence content URLs before retrying.

Prefer a managed directory connection? Find CertScore.ai on Smithery.

Verify the connection

Confirm the three-tool Light surface

List the available CertScore tools and confirm that certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle are available. Then scan https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html and report whether the result was new or reused.

Success means Codex lists exactly certscore_scan_site, certscore_get_scan_status, and certscore_get_scan_bundle; no OAuth prompt appears; and certscore_scan_site returns a stable scanId plus an explicit new-or-reused decision. A reused eligible result should show that quota was not consumed.

Codex troubleshooting

Common first-run issues

Unexpected OAuth: remove the connection and add it again with the exact URL https://mcp.certscore.ai/mcp/light. Do not configure a bearer token; the Light endpoint has no authentication.
Connection check: a successful Streamable HTTP connection completes initialization and lists the three Light tools without opening an authorization page.
Missing scanId: retry certscore_scan_site only when the error says retryable: true; never poll certscore_get_scan_status without scanId.
Rate limited: follow retryAfterSeconds and recommendedNextAction, or reuse an eligible result. The daily allowance resets at the returned UTC time.
Provenance: retrievalMode describes the current tool call, while creationDecision says whether the original scan was new or reused only when retained. Never treat scan_id_lookup alone as proof of reuse; report unknown honestly. Use numeric scanAgeSeconds when available.
Truncated bundle: when canonicalFindingsComplete is true, retry only for omitted envelope detail. Otherwise follow nextRecommendedMaxBytes when it fits responseCeilingBytes, or open one of the returned canonical report or evidence content URLs.
Invalid URL: correct the url field using the structured invalid_arguments response, then retry certscore_scan_site with a public HTTP or HTTPS URL.
Limited result: completed_limited, no-go, not-observed, and limited coverage are observations only, never proof of compliance. Transport failures instead return failed, expired, or a connection error with retry guidance.

At a glance

Compare the three MCP setup routes

Route	Setup method	Authentication	Account	Quota	Available tools	Intended user	Website / access limits	Upgrade path
Light MCP — no authentication	One Codex command or a remote Streamable HTTP URL	None	Not required	Up to 50 new scans per UTC day across Light and 5 per rolling 10 minutes; eligible reuse is free	certscore_scan_site, certscore_get_scan_status, certscore_get_scan_bundle	First-time users, testing, and discovery	Public HTTP or HTTPS websites; core tools only	Choose authenticated access for volume, history, teams, or advanced tools
Hosted MCP — OAuth	Connect the hosted MCP endpoint from an OAuth-capable client	OAuth authorization code with PKCE	Required	Higher-volume allowance based on access	Core tools plus approved history and diagnostic tools	Production, team, and managed remote clients	Scopes control read and scan creation; scan creation may require support	Request additional scopes or volume from support
Local MCP — scoped API key	Install and run the local stdio server	Scoped API key in the client environment	Required	Higher-volume allowance based on key access	Tools permitted by the key scopes	Backend, local, and controlled automation workflows	Key scopes control read and scan creation; protect and rotate credentials	Request scan:create-equivalent scope, advanced access, or more volume

Copy and run

Prompts for three common reviews

Launch review

Use CertScore.ai to scan [PUBLIC URL] before launch. Report the CertScore score and evidence-backed findings for pre-consent cookies and trackers, consent controls, Reject Path post-refusal observations when available, privacy-policy transparency, and HTTPS/TLS. Separate observed evidence from coverage limitations and do not present the result as legal advice, certification, or a compliance determination.

Try in Cursor

Vendor review

Use CertScore.ai to review [VENDOR PUBLIC URL]. Summarize the observed third-party tracking technologies, cookies and storage, CMP and consent-management signals, Reject Path post-refusal observations when available, policy and transparency findings, regulatory review signals, and HTTPS/TLS observations. Include supporting evidence, the report URL, and all material coverage limitations.

Try in Cursor

Audit diagnostics

Use CertScore.ai to scan [PUBLIC URL] for audit diagnostics. Follow the scan through a terminal status, retrieve the findings bundle, and prioritize evidence-backed privacy, cookie, tracker, consent, Reject Path, policy, GDPR/ePrivacy, CCPA/CPRA, and transport observations. Explain what was observed, what remains unknown or limited, and which evidence a human reviewer should inspect next.

Try in Cursor

Light-to-Authenticated migration

Upgrade when Light becomes a constraint

Upgrade when you need a dedicated higher-volume allowance, production or team access, backend automation, scan history, advanced diagnostic tools, or support-managed scopes.

What changes

Use the full endpoint, authenticate with hosted OAuth or a local scoped API key, and receive the quota and tools granted to that access.

What stays compatible

Core identifiers and canonical response fields—including scanId, status, score, risk, coverage, and timestamps—remain compatible.

Need more scans or advanced tools? Upgrade to Authenticated MCP.

Set up Authenticated MCP Contact support