prufa-dev/prufa-mcp

**Vibe-coded apps ship faster than anyone can review them.** In June 2026 we
audited 49 fresh Show HN launches —
**38 had a critical bug on day one**: a broken signup, a silent console error,
analytics that never fired, a consent banner that did nothing.
Prufa is the agent that catches those before your users do. Point it at a URL
and it audits the things humans skip when they're moving fast — broken flows,
JS console errors, missing tracking, consent violations, security headers,
mobile tap targets, accessibility — and hands back machine-verified findings,
graded A–F. This repo is the open-source MCP server that wires that audit
straight into your coding agent.
30-second demo
What an audit gives you
Ask your agent to audit https://yourapp.com and prufa_run_audit returns one
JSON report. Findings are grouped into graded sections, each finding carries a
severity, the **impact** (why it matters), and a **fix hint**. Real output,
trimmed:
report_url is a shareable HTML version of the same report. The full payload
also includes tracking, consent, seo/aeo, a11y, forms, and detected
user flows — see the OSS surface below.
Install
The package is on PyPI. Install it
globally with pipx (recommended — isolated venv, exposes the prufa-mcp
binary on your PATH) or into a project venv with pip:
You also need a free Prufa API key. **The first audit is free, no card required.**
1. Sign in at prufa.dev (Google OAuth)
2. Create an API key from the dashboard
Wire into your agent
The MCP server runs as a stdio subprocess, spawned by your agent on first use.
The cleanest way to register it is claude mcp add (Claude Code's built-in
command — it writes the config to ~/.claude.json correctly, which the
~/.claude/mcp.json path does NOT).
Claude Code (recommended path)
Restart Claude Code (config is read at startup), then verify:
You should see prufa listed as **Connected**, with prufa_run_audit and
prufa_get_report as available tools.
Cursor / Cline / Continue (hand-edit .mcp.json)
In your project root or in ~/.config/Claude/ etc.:
Restart the host app. The command path must be the absolute binary path
(not ~, not $()) — those don't expand in MCP config.
> Prefer config files to env vars? Drop your token in
> ~/.config/prufa/mcp.json instead — see ADVANCED.md.
Use it
In your agent:
prufa_run_audit with wait=true (the default) **blocks** until the audit
completes and returns the JSON report directly — typically 25–60s for a public
page. If you set wait=false, the call returns immediately with the queued
state plus a share_token you can poll with prufa_get_report.
What you get — the full agent surface
prufa-mcp exposes **the whole product** over MCP (44 tools). Point your agent
at Prufa and it can audit pages, drive multi-step flows, watch for regressions,
run chaos tests, run full-auto discovery, and manage the workspace + billing —
no dashboard round-trip. Free/anonymous tools need no card; Pro tools return the
API's 402 with a checkout link when you're not on a plan (the tool is visible,
the paywall is server-side).
Audit & reports
| Tool | What it does |
|---|---|
| prufa_run_audit(url, wait=true) | One-shot public-page audit; blocks and returns findings JSON. |
| prufa_get_report(run_id?, share_token?) | Fetch a report by UUID or /r/ slug. |
| prufa_get_run(run_id) | Poll a run's status. |
| prufa_list_runs(limit) | Recent runs in the workspace. |
| prufa_get_finding(run_id, finding_key?) | Persisted findings, machine-readable. |
| prufa_list_alerts() | Alert ledger (newest first, incl. suppressions). |