SlapMyWeb MCP server
Let an AI assistant run audits and read your results through the Model Context Protocol. It uses the same API key as the REST API.
Connect
Add the server
Works with MCP clients that support Streamable HTTP. Replace YOUR_KEY with a key from the API keys page.
Claude Code
claude mcp add --transport http slapmyweb https://api.slapmyweb.com/mcp --header "Authorization: Bearer YOUR_KEY"
JSON config (mcpServers format, e.g. a project .mcp.json)
{
"mcpServers": {
"slapmyweb": {
"type": "http",
"url": "https://api.slapmyweb.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_KEY"
}
}
}
}- Endpoint
- POST https://api.slapmyweb.com/mcp
- API key
- Pro, Agency or Enterprise plan. Create one on the API keys page.
- Rate limit
- Per key, per minute: Pro 60, Agency 100, Enterprise 1,000 requests, and 100 requests per minute per IP address. A batch counts as one request: up to 10 calls, and one audit start per request.
Tools
Four tools
Each tool only sees data that belongs to the key's owner. An audit that is missing or belongs to someone else returns "Audit not found".
run_audit
- Arguments:
- { "url": "https://example.com" }
- Needs:
- Enterprise API key (write:audit scope). Other keys get the error "This key cannot start audits".
- Returns:
- scanId, status ("queued", or "completed" when a scan of the same URL from the last 24 hours is reused) and the results URL.
get_audit
- Arguments:
- { "scanId": "…" }
- Needs:
- Keys with the read:scan scope (included by default on every plan).
- Returns:
- Status, overall score (0–100), letter grade and the 8 pillar scores. Scores are null until the scan has completed.
list_issues
- Arguments:
- { "scanId": "…", "level": "high" }
- Needs:
- Keys with the read:scan scope (included by default on every plan). level is optional: critical, high, medium, low or insight.
- Returns:
- Up to 100 findings, each with level, rule_id, title, affected_count and a fix summary of at most 300 characters.
list_sites
- Arguments:
- {}
- Needs:
- Keys with the read:site scope (included by default on every plan).
- Returns:
- Your sites, newest first, up to 100: domain, name, health score, pages crawled, issue count, last audit date.
Limits
The server answers with JSON only: it does not open an event stream and does not keep sessions, so GET and DELETE on the endpoint return 405. Request bodies are limited to 256 KB. A batch may hold up to 10 calls, with at most one run_audit.