Give your AI agent the audit context it needs.
Connect Claude Desktop, Cursor or any MCP-compatible client. Your assistant can read PageLens findings, pull quick wins, open the Markdown report and record structured decisions from your editor.
Free. OAuth 2.1 with PKCE. Read access plus bounded, score-neutral feedback tools. View on GitHub.
Add PageLens to your client
Pick your assistant, paste the config, restart, and click through the consent screen. The MCP URL below is yours; the OAuth client registers itself the first time it connects.
Claude Desktop
Use Claude Desktop's Settings > Developer > Edit Config button first. If the file is missing, create it and paste the JSON below.
claude_desktop_config.jsonjson{
"mcpServers": {
"pagelens": {
"type": "http",
"url": "https://www.pagelensai.com/api/mcp"
}
}
}Claude Desktop on Windows
Older docs often point to %APPDATA%\Claude\claude_desktop_config.json. Recent Windows/MSIX builds can instead read from the package-container path:
%LOCALAPPDATA%\Packages\Claude_*\LocalCache\Roaming\Claude\claude_desktop_config.json
If Claude's “Edit Config” button opens a file but PageLens does not appear after a full Claude restart, check that second location too. The drive Claude is installed on, such as C: or E:, is not usually the deciding factor; Windows stores the config under your user AppData folder. If the file already has settings, merge the mcpServers block into the existing top-level JSON object instead of replacing the whole file.
Cursor
Settings → Features → Model Context Protocol → Add new MCP server.
.cursor/mcp.jsonjson{
"mcpServers": {
"pagelens": {
"url": "https://www.pagelensai.com/api/mcp"
}
}
}Codex CLI
Codex picks this up from your config dir on next launch.
~/.codex/config.tomltoml[mcp_servers.pagelens]
url = "https://www.pagelensai.com/api/mcp"Generic / other clients
Any client that supports the streamable HTTP transport over OAuth 2.1 can connect. Discovery follows RFC 8414 + RFC 9728.
MCP server URLtexthttps://www.pagelensai.com/api/mcpOn first connect your client will pop a browser tab to PageLens for you to log in and approve the requested scopes. Tokens are short-lived (1 hour, refreshed automatically) and bound to your account — no shared keys, no credentials in your config.
MCP tools for AI-powered site audits
Six read-only tools, three bounded write tools, and two pinnable resources per scan (Markdown report + summary JSON). Nothing the agent calls can edit, hide, or delete a scan — the only mutations are feedback flags and owner decision notes.
list_scans
Browse the most recent scans on your account.
get_scan
Pull a single scan's headline data — score, grade, exec summary, top-5 findings.
list_findings
Page through every finding for a scan, filtered by severity, persona, or page.
get_quick_wins
Fetch the top N quick-win findings (high impact + low effort) for a scan.
list_domains
List the domains you've verified ownership of, with their badge status.
whoami
Confirm which PageLens account this connection is operating against.
report_finding_feedback
Write · score-neutralFlag a finding as a false positive, miscategorised, or non-actionable, with required structured evidence. Submission is queued for human review at PageLens — it does not edit or hide the finding.
acknowledge_finding_decision
Write · score-neutralRecord that a real finding is an intentional architecture, security, or product tradeoff. The score stays unchanged and the finding remains visible.
clear_finding_decision
Write · score-neutralClear a previously acknowledged decision so it stops appearing on current and future reports while preserving the audit trail.
Pinnable resources
pagelensai://scan/{id}/markdown— the same agent-friendly Markdown export the report's “Download as .md” button produces.pagelensai://scan/{id}/summary.json— slim JSON: score, grade, severity counts, top findings, persona reviews.
Your agent can talk back.
Lighthouse, PageSpeed, Ahrefs, Semrush — every audit tool that's ever existed is a one-way pipe. Crawler runs, report comes out, you read it, it's done. If a finding's wrong about your code, you have nowhere to put that.
We built the other half of the pipe. When your agent reads a PageLens report and disagrees with a finding, it can call report_finding_feedback with structured evidence — kind, reason, the actual DOM or code snippet it inspected. The submission lands in our review queue, a human at PageLens looks at it, and the rule gets tuned. Every other PageLens user's next scan benefits from that disagreement.
And when the finding is real but intentional — like a CSP tradeoff forced by a framework constraint — the agent can call acknowledge_finding_decision instead. The report shows the decision, future scans can recognise it, and the score still tells the truth.
The audit is no longer the product. The conversation is.
Five disagreement kinds
FALSE_POSITIVE, INCORRECT_SEVERITY, INCORRECT_CATEGORY, NOT_ACTIONABLE, OTHER. Required prose fields keep drive-by “this is wrong” submissions out of the queue.
Evidence is required, not optional
Each submission includes the actual DOM snippet, header value, or code excerpt the agent verified against. We can't accept “trust me bro” from a model — and the agent already has your codebase open, so the cost of producing real evidence is near zero.
Accepted decisions stay with the report
ACKNOWLEDGED, ACCEPTED_RISK, INTENTIONAL_TRADEOFF, WONT_FIX_NOW. The finding stays visible, the score stays unchanged, and the context can carry into future scans.
Per-model accuracy tracking
Submissions optionally carry an agent_model identifier (e.g. claude-3.7-sonnet, cursor-composer-1). Lets us see which models tend to be right when they disagree, and tune trust accordingly.
No silent suppression
Feedback submissions are flagged, never auto-applied. Owner decisions annotate a finding but never hide it or reduce its score impact. That stops a misbehaving agent from silencing true findings while still preserving useful context.
OAuth 2.1 scopes you control
Every connected client requests one or more scopes. The consent screen is the gate — only what you approve gets granted, and you can revoke per-token from your settings.
read:scans— Read your scansList the scans on your account and read their headline data (URL, score, timestamp, tier, viewports).
read:findings— Read scan findingsRead the per-page findings, evidence, and quick-wins for any scan on your account.
read:domains— Read your verified domainsList the domains you've verified ownership of and which scan is currently anchored to each.
read:profile— Read your basic profileRead your account name and email so the assistant can confirm whose data it's working with.
write:feedback— Submit finding feedback and decisionsFlag findings on YOUR scans as false positives, miscategorised, or non-actionable, or attach your own acknowledged decision when a finding is a deliberate tradeoff. The assistant cannot edit, hide, delete, or rescore the scan itself; it can only attach or clear bounded notes that are rate-limited and audit-logged against the OAuth client.
How we keep this safe
OAuth 2.1 with PKCE
No bearer tokens in your config. Each connection runs the full authorisation-code + PKCE flow, audience-bound to /api/mcpvia RFC 8707 so a leaked token can't be replayed against another resource. Tokens hash-at-rest; the raw value lives only in your client.
Read-mostly, bounded writes, rate-limited
Six read-only tools plus score-neutral write tools for feedback and owner decisions — nothing the agent calls edits, hides, deletes, or rescores a scan. Per-token (60/min), per-user (200/min) and per-client (1000/min) Upstash buckets stop a runaway loop from eating your context window or our DB pool. 429s come back with the standard Retry-After + X-RateLimit-* headers.
One-click revoke
Settings → Integrations shows every connected client and every active token, with a “Disconnect” button per client and a per-token revoke for the cautious. Revocation is immediate — the next request fails 401.
Standards-compliant · open spec
We follow the MCP 2025-03-26 spec to the letter — streamable HTTP transport, RFC 7591 Dynamic Client Registration, RFC 8414 Authorization Server Metadata, RFC 9728 Protected Resource Metadata, RFC 7009 Token Revocation. Your client never has to hard-code anything PageLens-specific. Full spec on GitHub.
Plug it in. Ask the assistant.
Already have a PageLens scan? You're 30 seconds away from “tell me what to fix” working in your editor.