MCP1 by Appwrite: One URL for every MCP server

No active Strict-Transport-Security max-age was observed.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Add HSTS (e.g. max-age=63072000; includeSubDomains) so browsers never even try HTTP after the first visit.

A CSP is present but its script or object restrictions need review.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Restrict script origins, use nonces or hashes for inline scripts, avoid unsafe evaluation, and set object-src 'none'.

No explicit restriction on sensitive browser features was observed.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. It is there, but weaker than this check expects.

Disable unused camera, microphone, or geolocation access using Permissions-Policy.

No enabled, named password inputs in sampled HTML.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. This check does not apply to the features observed in this sample.

Review authentication forms separately when applicable.

Site serves over HTTPS.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

http:// permanently redirects to https://./

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

Response headers restrict cross-origin framing (frame-ancestors 'none').

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

Referrer-Policy is strict-origin-when-cross-origin.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

nosniff is set.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No insecure subresources detected.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

No X-Powered-By disclosure.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

3 declared form(s) submit over HTTPS to this site. Runtime submission behavior is untested.

HTTPS protects what visitors send you, and response headers limit what a hostile page can do in their browser. The inspected source provides this signal.

Nothing to do here.

Entity identity is inconsistent: Organization url https://appwrite.io/ and Organization @id https://appwrite.io/ point to a different site than mcp1.com.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Use one name for the site everywhere it is declared (Organization/WebSite schema, og:site_name, the title) and point identity URLs at this site.

• https://mcp1.com/

Article schema exists but lacks author/datePublished.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Fill in author and datePublished so readers and retrieval systems can inspect provenance. This audit does not measure or guarantee citations.

Only 5% of 61 H2/H3 headings are question-shaped.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Phrase key subheadings as the questions users actually ask ("How much does X cost?"). This improves the measured question-heading signal; the audit does not guarantee citations.

The opening paragraph doesn't define what the site/topic is: "The MCP gateway for teams…"

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

"X is a Y that does Z for W" in the first paragraph gives answer engines a liftable definition of you. Write it once, benefit everywhere.

No dateModified schema or visible 'updated' dates found.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

For content where dates matter, show the actual update date and mirror it in dateModified. Do not invent dates or change them without a substantive update. Missing dates alone do not prove stale content.

2/3 question-shaped heading(s) have a 20–500 character paragraph immediately after them.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Put a direct 20–500 character answer paragraph immediately after each question heading so retrieval systems can quote it cleanly.

• https://mcp1.com/docs

Only 3 of 4 provenance signal types were found: author, contact, date.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Add the missing author, date, breadcrumb, or contact signal so machines can identify provenance and site structure.

• https://mcp1.com/
• https://mcp1.com/contact
• https://mcp1.com/servers
• https://mcp1.com/docs
• https://mcp1.com/blog
• https://mcp1.com/login
• https://mcp1.com/signup
• https://mcp1.com/changelog
• https://mcp1.com/assets

3 of 3 markdown URLs answered 200 but returned HTML, not markdown.

This is what an AI assistant relies on when deciding whether it can quote your page. It is there, but weaker than this check expects.

Either serve real markdown at those URLs or return 404. A 200 that hands back the HTML page wastes a retrieval and can be cached as the markdown copy.

• https://mcp1.com/index.md
• https://mcp1.com/contact.md
• https://mcp1.com/index.html.md

No /llms-full.txt.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Optional companion to llms.txt containing your full content as one markdown file — useful for sites whose pages are JS-heavy.

141 concrete figures across 1954 words.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Good — keep facts specific and current, and date-stamp them.

The homepage answered Accept: text/markdown with text/html; charset=utf-8.

This is what an AI assistant relies on when deciding whether it can quote your page. This check does not apply to the features observed in this sample.

Optional: return a stripped markdown body when the request asks for text/markdown. Some hosts and CDNs do this for you; a plain HTML answer is not a defect.

No OpenAPI interface was advertised by sampled HTML.

This is what an AI assistant relies on when deciding whether it can quote your page. This check does not apply to the features observed in this sample.

An API is optional. Add a service-desc link if you already publish a machine-readable API specification.

llms.txt exists (29669 chars of markdown).

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

The audited URL is allowed for evaluated answer-search crawlers.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

FAQ/QA schema found.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Semantic structure present: main×1, section×12, nav×2, header×1, footer×1, aside×1.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Paragraphs get to the point without preamble.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Paragraphs average 10 words, lists present, tables present — chunk-friendly.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

56 outbound reference(s) across crawled pages.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Brand declared: og:site_name "MCP1 by Appwrite" + identity schema.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

Meta description works as a standalone summary.

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

llms.txt contains 179 same-origin Markdown link(s).

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

llms.txt has an H1, a summary, 8 section(s) and 179 link(s).

This is what an AI assistant relies on when deciding whether it can quote your page. The inspected source provides this signal.

Nothing to do here.

No privacy policy page is linked or crawlable.

A publisher review looks for this before it accepts a site. Right now the sampled pages don't provide it.

Publish an accessible privacy policy that discloses cookies and data use by Google and other third-party ad vendors.

3/8 editorial pages expose fewer than 250 publisher words; those 8 pages hold 7211 publisher words in total. 1 of the 9 sampled pages is a support or tool page and was excluded from this check.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Review whether each page fully serves its purpose. Expand incomplete editorial content with useful information; keep concise navigation and tool pages when they help visitors.

• https://mcp1.com/blog
• https://mcp1.com/login
• https://mcp1.com/signup

No terms of use page found.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Consider adding terms that identify the service rules and publisher. This is a transparency heuristic, not an AdSense requirement.

No about page found.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Add an About page that identifies the publisher, site purpose, and relevant experience. This supports content transparency but is not a standalone AdSense requirement.

2/9 tool-style screen(s) expose fewer than 80 publisher words. Google publishes no minimum word count; this is an audit heuristic.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Explain the tool's purpose, inputs, method, limitations, and result interpretation in source HTML. Add useful material, not filler.

• https://mcp1.com/login
• https://mcp1.com/signup

1/9 crawled pages don't link to the privacy policy.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Place the privacy link in shared navigation or footer markup so users can reach disclosures from any sampled entry page.

• https://mcp1.com/login

Contact email does not align with mcp1.com: matej@moonbase.dev.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Use an address on the publisher's domain when practical so readers can verify the publisher identity. This is a practitioner trust heuristic, not an AdSense requirement.

2/2 attributed editorial pages provide no discoverable author or publisher background.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Link the byline to an author profile or About page, or add truthful structured author details. This is a transparency heuristic, not an AdSense approval rule.

• https://mcp1.com/docs
• https://mcp1.com/blog

ads.txt exists but contains no google.com pub- line.

A publisher review looks for this before it accepts a site. It is there, but weaker than this check expects.

Add your AdSense publisher line exactly as shown in your AdSense account.

A privacy page was not present in the crawl sample, so its disclosures could not be verified.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Confirm the policy explains cookies or similar storage, Google or advertising vendors, and third-party data use.

No cookie-consent banner or CMP script detected.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Before serving Google ads in the EEA, UK, or Switzerland, implement a Google-certified consent management platform that integrates with the IAB TCF.

Domain age isn't visible from the site itself.

This observation could not be established from the available evidence. Resolve the collection limit or inspect the relevant source before deciding whether a change is needed.

Do not use age as a content-quality proxy. Verify ownership and account eligibility in AdSense; Google's general eligibility page publishes no domain-age threshold.

Contact page found: https://mcp1.com/contact

A publisher review looks for this before it accepts a site. The inspected source provides this signal.

Nothing to do here.

6/8 editorial pages clear the audit's publisher-content triage threshold. 1 of the 9 sampled pages is a support or tool page and was excluded from this check.

A publisher review looks for this before it accepts a site. The inspected source provides this signal.

Nothing to do here.

No Google ad code detected on sampled non-content screens.

A publisher review looks for this before it accepts a site. The inspected source provides this signal.