Horizontal

WorksSearch and the webSecurity

Relvato

Website monitoring: uptime, checkout, SEO (Search Console, Bing), security, speed, DNS, compliance.

Addresshttps://app.relvato.com/api/mcp
Claude Codeclaude mcp add --transport http relvato https://app.relvato.com/api/mcp
For Cursor and other clients
{
  "mcpServers": {
    "relvato": {
      "type": "http",
      "url": "https://app.relvato.com/api/mcp"
    }
  }
}

It asks for: Authorization

Watch out

Has tools that change things: 12 of them

The server itself marks these tools as deleting or overwriting data (destructiveHint): have the agent ask you before it calls them.

Test
Works: Handshake succeeded
Tools
58 tools
Handshake
2.3 s
Transport
streamable-http · 2025-06-18
Tested
6 November 2026
Registry name
com.relvato/relvato v3.5.1
Listed
24 October 2026
Updated
24 October 2026
Website
www.relvato.com/developers
Source
github.com/Relvato/relvato-mcp
The last 1 tests
WhenResultTime
2026-11-06 12:19 UTCHandshake succeeded2.3 s

The 58 tools it listed

"Read only" and "Changes data" are the server's own marks. Underlined parameters are required.

  1. accept_structure_changeChanges data

    Accept a structure change

    The structure monitor found a page whose layout changed on purpose: adopt this run's structure as the new baseline for that page (pageKey), or for every changed page on the run (all: true). Undo with undo_structure_review.

    runId pageKey all

  2. accept_visual_changeChanges data

    Accept a visual change

    The visual monitor found a page that changed on purpose (a redesign, new content): make this run's screenshot the new baseline for that page, device and browser. Undo with undo_visual_review. Only when the user confirms the change is intended.

    comparisonId

  3. add_checks

    Add monitors

    Add monitors to a site by key (from list_checks). Each key reports added / exists / rejected with the reason (plan, active-monitor limit, needs the WordPress plugin). Once the site's ownership is proven, new monitors get a daily schedule on plans that run daily (Pro and up) and a weekly one on Free, plus a re-run when the site changes on Pro and up (WordPress plugin updates, or pushes via the GitHub App). Before proof they're added but only run when trigger_scan starts them (scheduleStarts).

    siteId keys

  4. add_custom_check

    Create a custom monitor

    Describe in plain words what to verify on a page (e.g. "the Pro plan shows a price", "search for 'shoes' returns results") and Relvato's AI writes a monitor for it, in a minute or two. Follow it with get_check: status goes authoring → proposed (show the user its rationale and steps, then approve_custom_check) or needs-input (answer with reauthor_custom_check) or failed (with advice). Read-only by default; interactive: true lets it click and type (search, filters, forms). Plan-gated; counts toward the active-monitor limit.

    siteId url goal name authenticated interactive

  5. add_heartbeat

    Add a heartbeat

    Create a heartbeat for a job the user runs (cron job, backup script, scheduled task, CI job). Returns its ping URL: the job requests it when it succeeds (e.g. `your-job && curl -fsS -m 10 --retry 3 <pingUrl>`), and `<pingUrl>/fail` to report a failure (a POST body is kept with the ping). No ping within period + grace, or a failure, alerts the user at once; a new heartbeat waits for its first ping and never alerts before it. Adds the site's Heartbeats monitor with the first one. Plan limits per account: Free 2, Pro 20, Business 100, Agency 500.

    siteId name periodSec cron tz graceSec

  6. add_site

    Add a site

    Start monitoring a website. Returns the site and its setup: until the owner proves ownership (connect the WordPress plugin, or verify the domain — the only option for non-WordPress sites), trigger_scan can run the public monitors by hand 3 times a day (setup.manualRuns); scheduled runs, alerts, update/deploy runs and the monitors that act on the site need the proof (setup.nextStep); setup.afterProof says what proof adds for this site on its plan. If the account already has a site on the same domain, that site is returned instead of a duplicate. How ownership is proven: https://www.relvato.com/docs/verify-site-ownership

    url name platform

  7. apply_fixChanges data

    Apply a run's proposed fix

    WordPress sites: apply the one-click fix a run proposes (get_run proposedFix: e.g. clear a stuck maintenance file, turn indexing back on, roll back the plugin update that broke it) through the Relvato plugin, then re-run the monitor to confirm. Only that exact fix can be applied. Tell the user what it changes (proposedFix.why and undo) and get their go-ahead first. undo: true reverts the last fix applied on the site. With Relvato plugin 1.77.0+ Relvato never changes the site remotely: the answer is applyInWordPress, a link where an administrator applies it in WordPress — give it to the user.

    runId undo

  8. approve_custom_check

    Approve a custom monitor

    Approve a custom monitor's proposed recipe (status proposed) so it runs and alerts from now on. Show the user its rationale and steps first (get_check). A recipe in interactive mode clicks or types on the live site: approve it only after the user agrees, with ack: true.

    checkId ack

  9. bring_back_run

    Bring back a set-aside failure

    Relvato AI triage (a site on level "aside") set this failed run aside as likely noise — get_run shows aiTriage.setAside. Make it count as a failure again: in the bell, the digest and site health. No alert is re-sent. Use it when the user says the failure is real.

    runId

  10. calibrate_site

    Re-read the store

    WordPress / WooCommerce: have Relvato read the store again (a product to buy, checkout type, guest checkout, currency) after the store changed. Runs in the background.

    siteId

  11. cancel_queued_runsChanges data

    Cancel queued runs

    Stop a site's runs that are queued but haven't started (after a big trigger_scan, or before maintenance). Cancelled runs can't be brought back: start them again with trigger_scan. The run that's already going finishes; nothing already recorded is deleted. Get the user's go-ahead first.

    siteId

  12. dismiss_recommendation

    Dismiss a recommended monitor

    Stop recommending a monitor for a site (list_checks marks recommendations), or bring every dismissed recommendation back with restoreAll.

    siteId key restoreAll

  13. edit_custom_checkChanges data

    Change a custom monitor

    Give a custom monitor a new goal, page, name or mode. Its current recipe is dropped and the AI writes a new one, which needs approving again before the monitor runs.

    checkId url goal name authenticated interactive

  14. extend_quarantine

    Extend quarantine mode

    Keep quarantine mode on for another 48 hours from now.

    siteId

  15. flag_visual_change_as_problem

    Flag a visual change as a problem

    The AI review let a visual change pass, but it's actually broken: mark it a failure. The run counts as failed in Relvato and shows as needing attention (notifications, Monitors passing); no message is sent.

    comparisonId

  16. get_activity_logRead only

    Get the WordPress activity log

    WordPress sites: who did what — sign-ins and failed sign-ins (with the network, not the full address), accounts and roles, application passwords, plugin / theme / core updates, setting and file edits, PHP errors and failed emails — newest first, within the plan's history (7 to 365 days).

    siteId filter search days limit

  17. get_alert_settingsRead only

    Get alert settings

    Who is told about what: how often (instant, daily / weekly digest), the minimum severity, each channel (email, Slack, webhook — whether the plan includes it, whether it's set up, paused, and `on` = alerts actually go out on it), which sites are muted and which monitor types go to which channel (only channels that are on). Never includes webhook URLs or secrets. Changing them is done by the user in Alert settings.

  18. get_checkRead only

    Get a monitor's settings

    One monitor in full: on/off, when it runs (schedule, time zone, re-runs on WordPress updates, random extra runs, and whether the plan allows them), its own settings (the visual monitor's pages with their keys, masks, devices, browsers and threshold; the checkout's product, coupon, shipping and field answers; extra pages to scan; …), which settings sections update_check_settings accepts for it, the findings the user ignored, an AI-authored monitor's goal, status, question and recipe steps, and its latest run.

    checkId

  19. get_fix_promptRead only

    Get the fix brief for a run

    For a run that failed or found a problem: the same brief Relvato's own AI answers when the user clicks "Suggest a fix" — the site's detected stack, what the monitor verifies, what changed on the site just before, the exact error and findings, whether it was already failing earlier, and for Google / Bing Search the evidence that rules causes out. Use it as context to explain the likely cause and fixes; applying a fix stays with the user.

    runId

  20. get_notificationsRead only

    Get notifications

    The dashboard's notifications: failing monitors, a disconnected or outdated WordPress plugin, a silent real-user beacon, domain and ownership problems, safe updates that need a look, paused Slack or webhook alerts, and billing.

  21. get_performanceRead only

    Get a site's performance

    A site's speed: the performance summary, lab Core Web Vitals, real visitors' LCP / INP / CLS (p75, last 7 days against the 28 before, per page type and device), what slows it (the elements, images and scripts behind slow visits) and the top fixes with steps.

    siteId

  22. get_quarantineRead only

    Get quarantine mode

    Quarantine mode (WordPress, paid plans): 48 hours of hourly security runs after a cleanup, with plugin updates paused. Whether it's available, on, until when, every change it saw (expected or not), which monitors it watches, the runs it would use, and past sessions.

    siteId

  23. get_runRead only

    Get run details

    One run in detail: status, error and warnings (each with its key for ignore_finding; ignored ones marked; one Relvato never fixes carries noFix — why, and what to do instead), each step, visual comparisons (each with its comparisonId, links to the screenshot, the baseline and the diff that work for 10 minutes, and whether a decision on it can be undone), metrics, the one-click fix the run proposes if any, and Relvato AI's suggestion once requested. Large metrics are compacted, never the findings: daily series become summaries and what was left out is listed in metricsTrimmed.

    runId

  24. get_safe_updateRead only

    Get a safe update's progress

    Follow a safe update or deactivation: applying → verifying → passed, or reverted with the monitors that broke.

    changeId

  25. get_site_healthRead only

    Get a site's health over time

    How a site has been doing: the share of monitors passing now (the Overview's "Monitors passing") and each of the last 30 days, the trend over 28, 90 or 182 days, each monitoring group's briefing (what needs attention, its likely cause and fix), and — on paid plans — uptime from Relvato's own probes (availability % and incidents over 30 days).

    siteId range

  26. get_site_settingsRead only

    Get a site's settings

    A site's Settings tab as values: what update_site_settings may change (name, request pacing, spacing between runs, firewall retry delay, flaky-monitor recovery streak, plugin rollback, counting Relvato's own visits in real-user data), what only the dashboard changes (browser identity, proxy, firewall allowlist token — never its value — GitHub, Google / Bing connections), the WordPress plugin's version, and the real-user beacon snippet.

    siteId

  27. get_status_pagesRead only

    Get status pages and client reports

    Public status pages (title, public link, sites, on/off) and monthly client reports per site (on/off, how many recipients, last sent), plus the report branding. Never a report's private link or recipients' addresses. Edited in the dashboard's Agency page.

  28. get_updatesRead only

    Get a site's WordPress updates

    WordPress sites: the safe auto-update policy and its recent windows (what was updated, rolled back or skipped, and why), plugin versions held back after a rollback, safe updates or deactivations Relvato made and their outcome, and the hardening settings that are on.

    siteId

  29. ignore_findingChanges data

    Ignore a finding

    Stop a finding (a warning on a run, by its key from get_run) from counting on this monitor: it stays on the run, marked ignored, but no longer alerts or fails later runs. Undo with unignore_finding. Only do this when the user says the finding is expected.

    runId key

  30. ignore_structure_changeChanges data

    Ignore a structure change

    Ignore specific element changes on a page from now on (signatures from get_run metrics.pages[].added / removed / countChanges[].sig), e.g. a widget that comes and goes. Undo with undo_structure_review.

    runId pageKey signatures

  31. ignore_visual_changeChanges data

    Ignore a changed area

    Ignore the area that changed on this comparison from now on (a clock, a rotating banner): it's added to the baseline's ignored regions. Undo with undo_visual_review. A mask (update_visual_monitor) is often the better fix.

    comparisonId

  32. list_checksRead only

    List available monitors

    The monitors that can be added to a site: key, what it catches, whether the current plan allows it, whether it's recommended for this site, and whether it's already added. Before the site's ownership is proven, runsNow says which can run now (started by hand) and which after proof; for a site added as "other", withWordPressPlugin lists what the WordPress plugin adds.

    siteId

  33. list_heartbeatsRead only

    List a site's heartbeats

    A site's heartbeats — cron jobs, backups and scheduled tasks that check in by requesting their own URL: each one's state (new = waiting for its first ping, up, down), schedule (period + grace, in seconds), last ping, when the next is due at the latest, whether the plan covers it, recent missed or failed check-ins and pings, plus the account's heartbeats used / allowed. Full-access connections also get each ping URL (it's what the job requests; anyone with it can send pings).

    siteId

  34. list_runsRead only

    List runs

    Recent runs, newest first, optionally for one site, one monitor or one status. Each has the monitor (checkId, checkName, and its key in `journey`), status, trigger, timing and its error / warning; get_run has the detail. For older runs pass `before` (the startedAt of the last run you got).

    siteId checkId status before limit

  35. list_sitesRead only

    List sites

    List the websites in this Relvato account, with whether each is ready to run monitors.

  36. pause_monitor_group

    Pause a monitoring group

    Pause one monitoring group on a site for 1 hour, 24 hours or until resumed (maintenance, a redesign, a migration). The group's monitors that are on are switched off and remembered; when the time is up, or with resume_monitor_group, exactly those are switched back on, as far as the plan allows. Pausing a group that's already paused changes when it resumes. Pausing Security while the site is in quarantine stays in the dashboard. Tell the user which monitors stop watching and for how long, and get their go-ahead first. site_overview lists paused groups.

    siteId group duration

  37. reauthor_custom_checkChanges data

    Rewrite a custom monitor's recipe

    Have the AI write a custom monitor's recipe again: answer its question (status needs-input) with `answer`, or retry after it failed or went stale. The monitor stops running until the new recipe is approved.

    checkId answer

  38. report_false_positive

    Report a false positive

    Tell Relvato's team a run's result is wrong (it failed or warned about something that's fine). Sends the run's details and your note to Relvato's support team; it changes nothing on the run. To stop being told about a finding, use ignore_finding.

    runId note

  39. request_ai_fix

    Ask Relvato AI for a fix

    Ask Relvato's AI to suggest a fix for a run that failed or found a problem (the dashboard's "Suggest a fix"). It answers in a minute or two: read it as aiFix on get_run. Plan-gated. get_fix_prompt gives the same brief for you to reason with yourself, without waiting.

    runId

  40. resume_monitor_group

    Resume a monitoring group

    Resume a paused monitoring group now: the monitors its pause switched off go back on (a monitor the plan no longer allows stays off, with the reason in keptOff). A group that isn't paused is left as it is.

    siteId group

  41. resume_webhook

    Resume webhook alerts

    Turn webhook alerts back on after Relvato paused them for repeated failed deliveries (fix the endpoint first; send_test_alert checks it).

  42. send_test_alert

    Send a test alert

    Send a test alert on one channel (email, slack or webhook) to check it arrives. Slack and webhooks are on paid plans and must be set up in the dashboard.

    channel

  43. site_overviewRead only

    Site overview

    Plain-language health verdict for a site: what needs attention (real issues vs likely false positives), each monitor with its latest run and schedule, setup state, recommended monitors not yet added, and the account's run usage. On WordPress 6.9+ it also lists the site's AI abilities (WordPress Abilities API) from the latest exposure scan: which plugin registered each, whether AI assistants (MCP Adapter) or REST clients can use it, which ones anyone can run without signing in, and which can delete data.

    siteId

  44. start_monitoring_for_goals

    Set up monitors for goals

    The onboarding shortcut: pick what matters and Relvato adds the monitors that cover it on the current plan (plus uptime, SSL, errors, maintenance mode and structure). Goals: flows (checkout and sign-in), security, search, design, compliance (law compliance — accessibility today), speed, domain, custom, ai. Before the site's ownership is proven the monitors are added but don't run on their schedule yet (scheduleStarts).

    siteId goals

  45. start_quarantine

    Start quarantine mode

    After a hack or a cleanup (WordPress, paid plans): run the security monitors every hour for 48 hours, pause plugin updates (with Relvato plugin 1.77.0+ that pause is a tick box in WordPress → Relvato), and alert on every unexpected change. Uses runs (get_quarantine says how many). Stopping it early stays in the dashboard.

    siteId

  46. start_safe_updateChanges data

    Safely update or deactivate a plugin

    WordPress sites: for a vulnerable or outdated plugin a run found (get_run warnings with a plugin), update it (or deactivate it) through the Relvato plugin, re-run the monitors that were passing, and undo it if any of them breaks. Counts as runs. Follow it with get_safe_update. Get the user's go-ahead first. With Relvato plugin 1.77.0+ the change is made in WordPress by an administrator (answer: applyInWordPress, a link to give the user); Relvato verifies it, and if it breaks a monitor Relvato alerts the user to undo it there.

    runId plugin action

  47. trigger_scan

    Run monitors now

    Run a site's enabled monitors now — or one group of them (group), or one monitor with checkId, even if it's turned off. Each run counts toward the monthly run quota. Runs go one at a time and take from seconds to a few minutes each, so all of a site's monitors usually take several minutes: the result's estimatedMinutes and tellUser say how long, so tell the user to expect a wait. Returns the runIds to follow with get_run or list_runs; cancel_queued_runs stops the ones that haven't started.

    siteId checkId group

  48. undo_structure_review

    Undo a structure decision

    Undo the last accept or ignore on a page of the structure monitor.

    runId pageKey

  49. undo_visual_review

    Undo a visual decision

    Undo the last accept or ignore on this page, device and browser: the earlier baseline comes back.

    comparisonId

  50. unignore_finding

    Stop ignoring a finding

    Make an ignored finding count again (get_check lists a monitor's ignored findings with their keys; get_run marks them on a run).

    checkId key runId

  51. update_alert_settings

    Change alert timing and severity

    Change how often alerts are sent (instant and/or a daily or weekly digest), when the digest goes out, the minimum severity, and whether every run is emailed. Only the fields you pass change. Who gets alerts (the address, Slack, webhooks), muting sites or monitor types, and turning email alerts off stay in the dashboard.

    frequency digestTime digestWeekday timezone minSeverity everyRun

  52. update_check

    Update a monitor

    Turn a monitor on or off, or change when it runs: its schedule (up to weekly on Free, daily on Pro, hourly on Business, every 15 minutes on Agency), re-runs when the WordPress site changes (plugin, theme, core or WooCommerce updates; Pro and up) and random extra runs (Business and up). Only the fields you pass change. Its own settings (pages, URLs, checkout details) are changed with update_check_settings or update_visual_monitor.

    checkId enabled schedule at tz dow events random

  53. update_check_settingsChanges data

    Change a monitor's settings

    Change a monitor's own settings. Each monitor takes only its sections (get_check lists them as editable.sections): checkout (checkout monitors), devices (flow and page monitors), errorScan, brokenLinks, accessibilityPages (accessibility), uptime (the URL, text that must / must not appear, accepted statuses, timeout, alert after N minutes, maintenance windows, an API endpoint's method / body / JSON rules), aiOutput, browseUrl (storefront), shopUrl / productUrl (prices), dkimSelectors (email authentication), structurePages (structure drift), webVitalsDevices (Core Web Vitals). Every address must be a full URL on the site's own domain. A section you pass replaces that section; the rest stays. Turning it on or off and its schedule: update_check. The visual monitor: update_visual_monitor.

    checkId checkout devices errorScan brokenLinks uptime accessibilityPages aiOutput browseUrl shopUrl productUrl dkimSelectors structurePages webVitalsDevices

  54. update_heartbeat

    Update a heartbeat

    Rename a heartbeat, change its period or grace, or pause / resume it. Only the fields you pass change. Paused: pings are still recorded but nothing is judged or alerted (an open outage ends without a "back" alert); resumed, it waits for its next ping. Deleting a heartbeat stays in the dashboard.

    heartbeatId name periodSec cron tz graceSec paused

  55. update_site_settings

    Change a site's settings

    Change a site's operational settings. Only the fields you pass change. Browser identity, the proxy, the firewall token, GitHub and search-engine connections, and deleting the site stay in the dashboard.

    siteId name pacingMs jobSpacingMs challengeRetryMs recoverStreak pluginRollback rumIncludeOwnChecks aiTriage

  56. update_visual_monitorChanges data

    Change the visual monitor's pages

    Edit the visual regression monitor: add pages (a built-in one by key, or a page of your own by its address on the site, e.g. "/pricing"; up to 10 of your own), rename or re-point a page of your own, change any page's masks (CSS selectors painted over before comparing, for clocks, carousels, ads), remove pages, and set devices, browsers, full-page capture, the change threshold (percent) and the AI review. A page whose masks or address change gets a new baseline: its next run captures one for the user to approve. At most 40 screenshots a run (pages × devices × browsers). get_check lists the current pages and their keys.

    checkId add update remove devices browsers fullPage thresholdPercent aiReview

  57. verify_site

    Verify site setup

    Check whether the site's ownership is proven: probes the WordPress plugin connection and/or looks for the domain-verification DNS TXT record / meta tag, or (method gsc / bing) asks Google Search Console / Bing Webmaster Tools. Returns the updated setup state. Docs: https://www.relvato.com/docs/verify-site-ownership

    siteId method

  58. verify_vitals_beacon

    Verify the real-user beacon

    Check that the real-user Web Vitals beacon is on the site (its homepage, or data already arriving). get_site_settings has the snippet to install.

    siteId

Is this yours?

Claim it to hear the moment it breaks, correct this page and add your own ways to use it.

A test is the handshake and the tool list: no tool was called. Names and descriptions are as listed by whoever registered the server; we haven't checked them.

Back to Tested MCP Servers