CertScore.ai MCP Light MCP server

CertScore

CertScore (certscore.ai) is a production-minded MVP for scanning public websites for potential accessibility, privacy, cookie, policy, and disclosure risk signals. It is a risk signal and monitoring product, not a legal certification platform.

Monorepo structure

website-signal-risk-scanner/
├─ apps/
│  ├─ web/
│  └─ validation-worker/
├─ packages/
│  ├─ shared/
│  ├─ web-bot-auth/
│  ├─ db/
│  └─ ui/
├─ docs/
├─ .env.example
├─ turbo.json
├─ package.json
└─ pnpm-workspace.yaml

Workspace packages

• apps/web: product-facing web app and control-plane workflows
• apps/validation-worker: active validation runtime owned by WC01
• packages/shared: shared constants, types, validators, scoring config, and scheduling helpers
• packages/web-bot-auth: server-only Web Bot Auth signing and key-directory helpers
• packages/db: PostgreSQL query helpers, migrations, seed SQL, and env helpers
• packages/ui: reusable UI primitives

Repo boundary

WC01 is now the product/control-plane repo.

• product web flows, scan creation, reporting, and validation stay here
• the standalone scanner runtime now lives in WS01
• scanner operational changes, crawler identity work, and scanner deploy flow should originate in WS01

What the MVP includes

• public homepage with preview scan funnel
• Better Auth with Google OAuth and email/password login flows
• organization bootstrap and protected workspace routes
• domain management, plan limits, and client grouping
• DB-backed scan creation with scanner-service claiming
• crawl/discovery, accessibility, privacy, and legal heuristics
• deterministic scoring, canonical report payloads, and authenticated report UI
• scanner-generated PDF generation and upload
• regression summaries and scheduled rescans
• lightweight branding for reports and PDFs

MCP Light

CertScore.ai MCP Light is the free, no-auth, hosted three-tool integration for public website privacy scans. It detects evidence-backed privacy, cookie, tracker, consent, policy, regulatory-review, HTTPS/TLS, and eligible Reject Path post-refusal signals. Results include a CertScore score and supporting evidence for human and agentic review; they are not legal advice, certification, or a compliance determination.

Add CertScore to Cursor · MCP Light landing page · Cursor Directory listing · Agent installation guide · Full installation reference · MCP package guide

Try it with: Use CertScore.ai to review [PUBLIC URL] before launch. Report the CertScore score, evidence-backed findings, Reject Path observations when available, coverage limitations, and the report URL.

Environment variables

This monorepo should use apps/web/.env.local as the single local development runtime env:

• copy apps/web/.env.example to apps/web/.env.local

Use .env.example only as a reference template for shared keys. Do not rely on a root .env.local for app runtime configuration.

Recommended environment split inside WC01:

• local web + local validation runtime: dedicated dev PostgreSQL database plus S3-compatible storage
• production web + production validation runtime: dedicated production PostgreSQL database plus S3-compatible storage

Do not point localhost at the production database or production auth credentials unless you are intentionally testing production behavior.

Required for the web app:

Shortened. The full README is on GitHub.