CertScore.ai MCP Light

What it can reach

From its install config and its own description; a sandbox run will confirm this later.

Checks on v0.2.20

1. Real tool

   passrules 2026-09-29.1 · 4 hours ago

2. Static scan

   passrules 2026-09-29.1 · 4 hours ago

3. Claims check

   skippedrules 2026-09-29.1 · 4 hours ago
   • infoLLM claims check is not configured on this deploy.

Install

Each app still asks you to confirm. Everything is pinned to the version checked above.

{
  "servers": {
    "mcp-light": {
      "type": "http",
      "url": "https://mcp.certscore.ai/mcp/light"
    }
  }
}

Tools it offers

As the server describes them. This text comes from the publisher and is shown as-is.

• certscore_scan_site

  Creates a public-website privacy scan or reuses an eligible recent completed scan. Coverage includes pre-consent storage, trackers, consent and CMP signals, privacy-policy disclosures, transport security, and GDPR/ePrivacy or CCPA/CPRA review signals. The response contains a stable scanId, lifecycle status, retry timing, and sometimes a bounded preliminary preConsentPreview; preliminary data contains no final findings or score. Results are automated public-web observations, not legal advice, certification, or a compliance determination. Tool and workflow documentation: https://certscore.ai/developers/mcp.

• certscore_get_scan_status

  Returns lifecycle status for a stable CertScore scanId. Active responses include phase, heartbeat, estimated progress, retryAfterSeconds, and sometimes a bounded preliminary preConsentPreview. Terminal responses include completion status, CertScore score and risk metadata when available, coverage, persisted execution region and timestamps, report URL, and a next-action field. Preliminary observations are distinct from completed findings.

• certscore_get_report_evidence_page

  Use workpaper=tracking for the starting-page tracking inventory, privacy choices/notices and GPC evidence, with JSON and CSV downloads. The workpaper selector also applies to every continuation request. Otherwise retrieve scan report display content as paginated JSON, without internal diagnostic JSON downloads. The response also offers a single-file full JSON download; private JSON download links expire after five minutes and need no OAuth header; use pagination if your host blocks file downloads. Repeated display records use reportContentRef JSON Pointers. Includes evidence tables, full-site page and resource inventories, all retained additional-page form fields, form snapshot download references, and retained limitations. Snapshot images are downloaded separately from the returned URLs, with OAuth bearer authentication for workspace scans. Available on OAuth and Light. Start with scanId; follow pagination.nextCursor until complete. Pages share a snapshot; restart if it changes. Each entry has a JSON Pointer path and value; oversized strings use numbered parts. Export completion is not complete observation coverage. Use the concise scan bundle for summaries; use this tool for exhaustive report evidence. No new scan is created.