Package Exports

@stacktown/webby
@stacktown/webby/dist/index.js

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (@stacktown/webby) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

Webby - Comprehensive Website Validator MCP Server

A Model Context Protocol (MCP) server that provides comprehensive website testing across performance, accessibility, SEO, and security dimensions.

Features

🚀 Performance Testing

WebPageTest ✅ - Real browser testing via Playwright automation (300 tests/month free, no API key)
Google PageSpeed Insights ✅ - Core Web Vitals and Google ranking signals (25K API calls/day free)
GTmetrix ✅ - Lighthouse + custom metrics with historical tracking (requires API key)

♿ Accessibility Testing

Axe DevTools ✅ - Fast WCAG scans via Playwright + axe-core (free, open-source)
WAVE ✅ - WCAG compliance and contrast analysis (requires API key)

🔍 SEO Testing

PageSpeed Insights SEO ✅ - Uses Lighthouse SEO (free, comprehensive)

🔒 Security Testing

Mozilla Observatory ✅ - HTTP security headers analysis (CSP, HSTS) - Free API, 1 scan/min
SSL Labs ✅ - Comprehensive SSL/TLS certificate testing - Free API (requires email)

Installation

cd ~/mcp-servers/servers/src/webby
npm install
npm run build

MCP Tools (11 Total)

Performance Tools (3)

validate_performance_pagespeed

{
  url: string,
  strategy?: 'mobile' | 'desktop',  // default: mobile
  apiKey?: string                   // optional, for higher quota
}
// Returns: Performance score, Core Web Vitals, metrics

validate_performance_webpagetest ✨ NEW

{
  url: string,
  location?: string,              // e.g., 'Dulles:Chrome'
  runs?: number,                  // default: 1
  waitForResults?: boolean,       // default: false (returns test ID immediately)
  timeout?: number                // default: 300000 (5 min)
}
// Returns: Test ID + results URL immediately OR full results if waitForResults=true
// Metrics: Load Time, FCP, LCP, Speed Index, TTI, TBT, CLS, Performance Grade

validate_performance_gtmetrix

{
  url: string,
  apiKey: string,                 // required
  location?: string,              // e.g., 'vancouver-canada'
  browser?: string                // e.g., 'chrome'
}
// Returns: Lighthouse score, PageSpeed score, load time, page size

Accessibility Tools (2)

validate_accessibility_axe

{
  url: string,
  wcagLevel?: string              // wcag2a, wcag2aa, wcag2aaa, wcag21aa, wcag22aa
}
// Returns: Violations by severity (critical, serious, moderate, minor), passes, incomplete

validate_accessibility_wave

{
  url: string,
  apiKey: string,                 // required
  reporttype?: 1 | 2 | 3 | 4     // detail level (default: 2)
}
// Returns: Errors, contrast errors, alerts, WAVE report URL, credits remaining

Security Tools (2)

validate_security_mozilla_observatory

{
  url: string,
  forceRescan?: boolean           // default: false
}
// Returns: Grade (A+ to F), score, tests passed/failed, details URL

validate_security_ssl_labs

{
  url: string,
  email: string,                  // required by API
  maxAge?: number,                // cached report age in hours
  startNew?: boolean,             // force new assessment
  waitForComplete?: boolean,      // wait for completion (can take 2-5 min)
  maxWaitMinutes?: number         // default: 5
}
// Returns: Grade (A+ to F), endpoint details, protocol info, status

Category Runners (4)

validate_all_performance

{
  url: string,
  pagespeedApiKey?: string,
  gtmetrixApiKey?: string,
  webpagetestEnabled?: boolean,        // enable browser automation
  webpagetestWaitForResults?: boolean  // wait for WPT completion
}
// Returns: Results from PageSpeed + optionally WebPageTest + optionally GTmetrix

validate_all_accessibility

{
  url: string,
  waveApiKey?: string,            // optional
  wcagLevel?: string              // for Axe
}
// Returns: Results from Axe + optionally WAVE

validate_all_seo

{
  url: string
}
// Returns: SEO analysis from PageSpeed Insights (Lighthouse SEO)

validate_all_security

{
  url: string,
  email: string,                  // for SSL Labs
  waitForSSL?: boolean            // wait for SSL Labs completion
}
// Returns: Results from Mozilla Observatory + SSL Labs

Master Runner (1)

validate_comprehensive

{
  url: string,
  email: string,                  // required for SSL Labs
  categories?: string[],          // ['performance', 'accessibility', 'seo', 'security']
  pagespeedApiKey?: string,
  gtmetrixApiKey?: string,
  waveApiKey?: string,
  wcagLevel?: string,
  waitForSSL?: boolean
}
// Returns: Complete analysis across all selected categories with overall health score

Response Format

{
  "tool": "webpagetest",
  "success": true,
  "url": "https://example.com",
  "test_id": "250107_AiDcA4_ABC",
  "results_url": "https://www.webpagetest.org/result/250107_AiDcA4_ABC/",
  "status": "complete",
  "summary": {
    "loadTime": 2500,
    "firstContentfulPaint": 1200,
    "speedIndex": 2300,
    "largestContentfulPaint": 2100,
    "timeToInteractive": 3500,
    "totalBlockingTime": 250,
    "cumulativeLayoutShift": 0.05
  },
  "performance_grade": "A",
  "security_grade": "A+"
}

Implementation Status

✅ Fully Implemented (9 tools)

validate_performance_pagespeed - Google PageSpeed Insights API
validate_performance_webpagetest - Playwright browser automation ✨
validate_performance_gtmetrix - GTmetrix API
validate_accessibility_axe - Playwright + axe-core
validate_accessibility_wave - WAVE API
validate_security_mozilla_observatory - Mozilla Observatory API
validate_security_ssl_labs - SSL Labs API with polling
validate_all_* - All 4 category orchestrators
validate_comprehensive - Master orchestrator

✅ All Tools Functional

No placeholders - all 11 tools are fully implemented and working!

API Quotas & Limits

Tool	Free Limit	API Key Required	Implementation
Mozilla Observatory	1 scan/min per domain	No	✅ Direct API
SSL Labs	Unlimited (rate limited)	Email only	✅ Direct API
PageSpeed Insights	25,000/day	Optional (free)	✅ Direct API
WebPageTest	300/month	No	✅ Browser automation
GTmetrix	Limited credits	Yes (free tier)	✅ Direct API
Axe	Unlimited	No	✅ Browser automation
WAVE	Varies by plan	Yes (paid)	✅ Direct API

Browser Automation

WebPageTest and Axe use Playwright for headless browser automation:

Singleton browser instance - Reused across tests for efficiency
Configurable timeouts - Default 5 minutes for WebPageTest, 1 minute for Axe
Graceful cleanup - Browser closed on MCP server shutdown
No API keys needed - Free access via web UI automation

Project Structure

webby/
├── src/
│   ├── performance/
│   │   ├── pagespeed.ts          ✅ Google API
│   │   ├── webpagetest.ts        ✅ Playwright automation
│   │   └── gtmetrix.ts           ✅ GTmetrix API
│   ├── accessibility/
│   │   ├── axe.ts                ✅ Playwright + axe-core
│   │   └── wave.ts               ✅ WAVE API
│   ├── security/
│   │   ├── mozilla-observatory.ts ✅ Mozilla API
│   │   └── ssl-labs.ts           ✅ SSL Labs API + polling
│   ├── shared/
│   │   └── browser-utils.ts      ✅ Playwright utilities
│   └── orchestrator/
│       └── run-all.ts            ✅ All orchestrators
├── dist/                         # Compiled JavaScript
├── index.ts                      # Main MCP server entry
├── package.json
└── README.md

Usage Examples

Quick WebPageTest (instant response)

validate_performance_webpagetest("https://example.com")
// Returns test ID immediately, check results later at provided URL

Complete WebPageTest (wait for results)

validate_performance_webpagetest("https://example.com", {
  waitForResults: true,
  timeout: 300000  // 5 minutes
})
// Waits for test completion, returns full metrics

Run all performance tests

validate_all_performance("https://example.com", {
  webpagetestEnabled: true,        // Enable browser automation
  webpagetestWaitForResults: false // Get test ID instantly
})
// Returns: PageSpeed + WebPageTest results

Comprehensive validation

validate_comprehensive("https://example.com", {
  email: "your@email.com",         // For SSL Labs
  categories: ["performance", "security"],
  webpagetestEnabled: true
})
// Returns: Full analysis with overall health score

License

MIT