MCP server

Connect a client

The server runs at https://checkanysite.com/mcp over Streamable HTTP. Clients that support sign-in, such as Claude and ChatGPT, need only this URL (Connect with OAuth). Other clients send your API key in the Authorization header. Choose your client:

claude mcp add --transport http checkanysite https://checkanysite.com/mcp \
  --header "Authorization: Bearer $CHECKANYSITE_API_KEY"

{
  "mcpServers": {
    "checkanysite": {
      "url": "https://checkanysite.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

{
  "servers": {
    "checkanysite": {
      "type": "http",
      "url": "https://checkanysite.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

https://checkanysite.com/mcp

{
  "mcpServers": {
    "checkanysite": {
      "serverUrl": "https://checkanysite.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

[mcp_servers.checkanysite]
url = "https://checkanysite.com/mcp"
bearer_token_env_var = "CHECKANYSITE_API_KEY"

URL:     https://checkanysite.com/mcp
Type:    Streamable HTTP
Header:  Authorization: Bearer YOUR_API_KEY

Connect with OAuth

Claude, ChatGPT and other clients that support MCP sign-in connect with the server’s URL alone, https://checkanysite.com/mcp. There’s no key to copy:

1. Add the URL as a custom connector in your client and choose Connect. In Claude, go to Settings › Connectors › Add custom connector.
2. A CheckAnySite window opens. Sign in, or create a free account.
3. Review the request: the page names the app and the site it returns you to. If you allow it, the app can look up and scan sites with the server’s tools, using your account’s credits.
4. Choose Allow. You return to the app, connected.

The connection is an API key. It appears on your API keys page under the app’s name followed by “(MCP)”, with full access and no expiry. Its requests cost credits and appear under Usage like any other key’s. To disconnect, revoke the key there: the app’s next request is refused, and the app asks you to sign in again.

For client developers, the server uses OAuth 2.1 with PKCE (S256) and dynamic client registration. Discovery starts from the WWW-Authenticate header of a 401 response, which points to /.well-known/oauth-protected-resource/mcp. That document names the authorization server, whose metadata is at /.well-known/oauth-authorization-server. Redirect URLs must use https, or http on localhost, 127.0.0.1 or [::1].

Tools

Every request needs a key, either from an OAuth sign-in or sent by the client. Each tool takes a domain, and optionally a source (where the answer comes from) and maxAgeDays.

• check_websiteCheck a website

  Everything we know about a website in one call: AI website builder traces, how ready it is for AI tools, popularity, the technology it runs on, trust signals and score, what it is, and its domain history, each finding with its evidence or source (its DNS records ride along in the structured result). Use it when someone asks what a site is, who is behind it, or whether it looks established. Report the findings with their evidence; never call a site safe, a scam or fake. Costs 3 credits from our stored result (the default), 15 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• detect_ai_builderWas it built with an AI builder?

  Whether a website shows traces of an AI website builder (such as Lovable, Bolt, v0, Base44 or Replit) or of another site builder, with the evidence line for each. Use it when someone asks if a site was made with AI or "vibe coded". A trace says how the site was built, nothing about who runs it. Report the findings with their evidence; never call a site safe, a scam or fake. Costs 1 credit from our stored result (the default), 3 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_ai_readinessIs it ready for AI?

  How easily AI tools (assistants, AI search and agents) can find, read and use a website: a score out of 100 from checks such as its text without scripts, a search listing, a title and description, structured data, a sitemap, llms.txt and files for AI agents (an MCP server card, an API catalog, agent skills), each with its evidence; the level it reaches; and for each gap what to do, with a prompt for an AI coding assistant. It also says which AI crawlers its robots.txt lets in or keeps out: the site's choice, never scored. Use it when someone asks whether AI can find, read or cite a site, or how to make theirs ready for AI. Costs 1 credit from our stored result (the default), 4 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_popularityHow popular is it?

  How popular a website is, from public ranked lists (Chrome UX Report, Majestic Million): a band such as "Top 100K" and each list's rank. Never a visit count. Costs 1 credit from our stored result (the default), 1 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_tech_stackWhat does it run on?

  The technologies a website shows (frameworks, site builders, shop systems, analytics, servers) with the evidence for each, and the network announcing its address. Costs 1 credit from our stored result (the default), 3 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_dns_recordsWhat are its DNS records?

  A domain's DNS records as we read them over DNS over HTTPS (A, AAAA, CNAME, MX, TXT, NS, CAA, and the AI agents a site names under _agents), whether its answer was validated with DNSSEC, and the network announcing its address. Use it when someone asks where a domain points, who handles its email, or what its TXT records say. Costs 1 credit from our stored result (the default), 1 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_trust_signalsHow established does it look?

  Signals about how established and reachable a website is: contact and company details, policy pages, domain age, HTTPS and security setup, and a score out of 100 for how established it looks. Signals for a person to weigh, never a verdict about intent. Report the findings with their evidence; never call a site safe, a scam or fake. Costs 2 credits from our stored result (the default), 6 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

• get_domain_historyHow old is it?

  A domain's history from public records: when it was registered (domain registry), its first TLS certificate (certificate logs) and when the web archive first captured it. Costs 1 credit from our stored result (the default), 2 with source "scan" when it has to scan (free monthly credits; get a key at https://checkanysite.com/account/keys).

Tool responses

Each tool asks for the checks that answer its question, from one of the two APIs, depending on its source:

• By default (source: "stored"), a tool works like the Lookup API: it returns our latest stored result, however old unless you set maxAgeDays, at the stored price, and never scans. The response says when the site was scanned. With source: "scan", it works like the Scan API: it scans the site at the scan price and waits up to 25 seconds for the result. Each tool’s description gives its cost.
• The text of a response is written for a model to read, with each finding and its evidence. The structured result comes alongside it, with the fields of the result object.
• With source: "scan", a result from the last day is still returned instead of a new scan. For get_ai_readiness, the check runs again once the result is a few minutes old, so you can verify a fix.
• A read-only key can read stored results. If it’s asked to scan, it gets read_only_key.
• Errors, such as running out of credits or hitting the rate limit, come back as tool results the model can pass on, with the API’s codes (Errors). A request without a key, or with a revoked key, gets HTTP 401, which starts the sign-in.

Pass the key in the URL

Send the key in the Authorization header whenever your client allows it. If a client accepts only a URL and can’t sign in with OAuth, add the key as ?key= to the server’s URL. No other endpoint accepts a key this way.

How agents find it

• The server’s card (MCP Server Cards, SEP-2127) is at /mcp/server-card and /.well-known/mcp/server-card.json on checkanysite.com.
• Our AI Catalog lists the card, the agent skill and the OpenAPI document.
• The API catalog (RFC 9727) lists the API, its OpenAPI document and these docs.