Skip to main content
Glama

Webby - Comprehensive Website Validator MCP Server

A Model Context Protocol (MCP) server that provides comprehensive website testing across performance, accessibility, SEO, and security dimensions.

Features

🚀 Performance Testing

  • WebPageTest ✅ - Real browser testing via Playwright automation (300 tests/month free, no API key)

  • Google PageSpeed Insights ✅ - Core Web Vitals and Google ranking signals (25K API calls/day free)

  • GTmetrix ✅ - Lighthouse + custom metrics with historical tracking (requires API key)

♿ Accessibility Testing

  • Axe DevTools ✅ - Fast WCAG scans via Playwright + axe-core (free, open-source)

  • WAVE ✅ - WCAG compliance and contrast analysis (requires API key)

🔍 SEO Testing

  • PageSpeed Insights SEO ✅ - Uses Lighthouse SEO (free, comprehensive)

🔒 Security Testing

  • Mozilla Observatory ✅ - HTTP security headers analysis (CSP, HSTS) - Free API, 1 scan/min

  • SSL Labs ✅ - Comprehensive SSL/TLS certificate testing - Free API (requires email)

Installation

cd ~/mcp-servers/servers/src/webby
npm install
npm run build

MCP Tools (11 Total)

Performance Tools (3)

validate_performance_pagespeed

{
  url: string,
  strategy?: 'mobile' | 'desktop',  // default: mobile
  apiKey?: string                   // optional, for higher quota
}
// Returns: Performance score, Core Web Vitals, metrics

validate_performance_webpagetest ✨ NEW

{
  url: string,
  location?: string,              // e.g., 'Dulles:Chrome'
  runs?: number,                  // default: 1
  waitForResults?: boolean,       // default: false (returns test ID immediately)
  timeout?: number                // default: 300000 (5 min)
}
// Returns: Test ID + results URL immediately OR full results if waitForResults=true
// Metrics: Load Time, FCP, LCP, Speed Index, TTI, TBT, CLS, Performance Grade

validate_performance_gtmetrix

{
  url: string,
  apiKey: string,                 // required
  location?: string,              // e.g., 'vancouver-canada'
  browser?: string                // e.g., 'chrome'
}
// Returns: Lighthouse score, PageSpeed score, load time, page size

Accessibility Tools (2)

validate_accessibility_axe

{
  url: string,
  wcagLevel?: string              // wcag2a, wcag2aa, wcag2aaa, wcag21aa, wcag22aa
}
// Returns: Violations by severity (critical, serious, moderate, minor), passes, incomplete

validate_accessibility_wave

{
  url: string,
  apiKey: string,                 // required
  reporttype?: 1 | 2 | 3 | 4     // detail level (default: 2)
}
// Returns: Errors, contrast errors, alerts, WAVE report URL, credits remaining

Security Tools (2)

validate_security_mozilla_observatory

{
  url: string,
  forceRescan?: boolean           // default: false
}
// Returns: Grade (A+ to F), score, tests passed/failed, details URL

validate_security_ssl_labs

{
  url: string,
  email: string,                  // required by API
  maxAge?: number,                // cached report age in hours
  startNew?: boolean,             // force new assessment
  waitForComplete?: boolean,      // wait for completion (can take 2-5 min)
  maxWaitMinutes?: number         // default: 5
}
// Returns: Grade (A+ to F), endpoint details, protocol info, status

Category Runners (4)

validate_all_performance

{
  url: string,
  pagespeedApiKey?: string,
  gtmetrixApiKey?: string,
  webpagetestEnabled?: boolean,        // enable browser automation
  webpagetestWaitForResults?: boolean  // wait for WPT completion
}
// Returns: Results from PageSpeed + optionally WebPageTest + optionally GTmetrix

validate_all_accessibility

{
  url: string,
  waveApiKey?: string,            // optional
  wcagLevel?: string              // for Axe
}
// Returns: Results from Axe + optionally WAVE

validate_all_seo

{
  url: string
}
// Returns: SEO analysis from PageSpeed Insights (Lighthouse SEO)

validate_all_security

{
  url: string,
  email: string,                  // for SSL Labs
  waitForSSL?: boolean            // wait for SSL Labs completion
}
// Returns: Results from Mozilla Observatory + SSL Labs

Master Runner (1)

validate_comprehensive

{
  url: string,
  email: string,                  // required for SSL Labs
  categories?: string[],          // ['performance', 'accessibility', 'seo', 'security']
  pagespeedApiKey?: string,
  gtmetrixApiKey?: string,
  waveApiKey?: string,
  wcagLevel?: string,
  waitForSSL?: boolean
}
// Returns: Complete analysis across all selected categories with overall health score

Response Format

{
  "tool": "webpagetest",
  "success": true,
  "url": "https://example.com",
  "test_id": "250107_AiDcA4_ABC",
  "results_url": "https://www.webpagetest.org/result/250107_AiDcA4_ABC/",
  "status": "complete",
  "summary": {
    "loadTime": 2500,
    "firstContentfulPaint": 1200,
    "speedIndex": 2300,
    "largestContentfulPaint": 2100,
    "timeToInteractive": 3500,
    "totalBlockingTime": 250,
    "cumulativeLayoutShift": 0.05
  },
  "performance_grade": "A",
  "security_grade": "A+"
}

Implementation Status

✅ Fully Implemented (9 tools)

  • validate_performance_pagespeed - Google PageSpeed Insights API

  • validate_performance_webpagetest - Playwright browser automation ✨

  • validate_performance_gtmetrix - GTmetrix API

  • validate_accessibility_axe - Playwright + axe-core

  • validate_accessibility_wave - WAVE API

  • validate_security_mozilla_observatory - Mozilla Observatory API

  • validate_security_ssl_labs - SSL Labs API with polling

  • validate_all_* - All 4 category orchestrators

  • validate_comprehensive - Master orchestrator

✅ All Tools Functional

No placeholders - all 11 tools are fully implemented and working!

API Quotas & Limits

Tool

Free Limit

API Key Required

Implementation

Mozilla Observatory

1 scan/min per domain

No

✅ Direct API

SSL Labs

Unlimited (rate limited)

Email only

✅ Direct API

PageSpeed Insights

25,000/day

Optional (free)

✅ Direct API

WebPageTest

300/month

No

Browser automation

GTmetrix

Limited credits

Yes (free tier)

✅ Direct API

Axe

Unlimited

No

Browser automation

WAVE

Varies by plan

Yes (paid)

✅ Direct API

Browser Automation

WebPageTest and Axe use Playwright for headless browser automation:

  • Singleton browser instance - Reused across tests for efficiency

  • Configurable timeouts - Default 5 minutes for WebPageTest, 1 minute for Axe

  • Graceful cleanup - Browser closed on MCP server shutdown

  • No API keys needed - Free access via web UI automation

Project Structure

webby/
├── src/
│   ├── performance/
│   │   ├── pagespeed.ts          ✅ Google API
│   │   ├── webpagetest.ts        ✅ Playwright automation
│   │   └── gtmetrix.ts           ✅ GTmetrix API
│   ├── accessibility/
│   │   ├── axe.ts                ✅ Playwright + axe-core
│   │   └── wave.ts               ✅ WAVE API
│   ├── security/
│   │   ├── mozilla-observatory.ts ✅ Mozilla API
│   │   └── ssl-labs.ts           ✅ SSL Labs API + polling
│   ├── shared/
│   │   └── browser-utils.ts      ✅ Playwright utilities
│   └── orchestrator/
│       └── run-all.ts            ✅ All orchestrators
├── dist/                         # Compiled JavaScript
├── index.ts                      # Main MCP server entry
├── package.json
└── README.md

Usage Examples

Quick WebPageTest (instant response)

validate_performance_webpagetest("https://example.com")
// Returns test ID immediately, check results later at provided URL

Complete WebPageTest (wait for results)

validate_performance_webpagetest("https://example.com", {
  waitForResults: true,
  timeout: 300000  // 5 minutes
})
// Waits for test completion, returns full metrics

Run all performance tests

validate_all_performance("https://example.com", {
  webpagetestEnabled: true,        // Enable browser automation
  webpagetestWaitForResults: false // Get test ID instantly
})
// Returns: PageSpeed + WebPageTest results

Comprehensive validation

validate_comprehensive("https://example.com", {
  email: "your@email.com",         // For SSL Labs
  categories: ["performance", "security"],
  webpagetestEnabled: true
})
// Returns: Full analysis with overall health score

License

MIT

Install Server
A
license - permissive license
B
quality
-
maintenance - not tested

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

  • AI QA tester — real browsers scan sites for bugs, SEO, perf, and accessibility issues via chat.

  • Website performance monitoring: scans, Core Web Vitals, RUM data and alerts.

  • Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/cordlesssteve/webby-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server