CertScore website risk-signal tools for scans, findings, evidence, and latest-domain lookups.
CertScore (certscore.ai) is a production-minded MVP for scanning public websites for potential accessibility, privacy, cookie, policy, and disclosure risk signals. It is a risk signal and monitoring product, not a legal certification platform.
website-signal-risk-scanner/
├─ apps/
│ ├─ web/
│ └─ validation-worker/
├─ packages/
│ ├─ shared/
│ ├─ web-bot-auth/
│ ├─ db/
│ └─ ui/
├─ docs/
├─ .env.example
├─ turbo.json
├─ package.json
└─ pnpm-workspace.yaml
apps/web: product-facing web app and control-plane workflowsapps/validation-worker: active validation runtime owned by WC01packages/shared: shared constants, types, validators, scoring config, and scheduling helperspackages/web-bot-auth: server-only Web Bot Auth signing and key-directory helperspackages/db: PostgreSQL query helpers, migrations, seed SQL, and env helperspackages/ui: reusable UI primitivesWC01 is now the product/control-plane repo.
WS01WS01CertScore.ai MCP Light is the free, no-auth, hosted three-tool integration for public website privacy scans. It detects evidence-backed privacy, cookie, tracker, consent, policy, regulatory-review, HTTPS/TLS, and eligible Reject Path post-refusal signals. Results include a CertScore score and supporting evidence for human and agentic review; they are not legal advice, certification, or a compliance determination.
Add CertScore to Cursor · MCP Light landing page · Cursor Directory listing · Agent installation guide · Full installation reference · MCP package guide
Try it with: Use CertScore.ai to review [PUBLIC URL] before launch. Report the CertScore score, evidence-backed findings, Reject Path observations when available, coverage limitations, and the report URL.
This monorepo should use apps/web/.env.local as the single local development runtime env:
Use .env.example only as a reference template for shared keys. Do not rely on a root .env.local for app runtime configuration.
Recommended environment split inside WC01:
Do not point localhost at the production database or production auth credentials unless you are intentionally testing production behavior.
Required for the web app:
NEXT_PUBLIC_APP_URLDATABASE_URLBETTER_AUTH_SECRETGOOGLE_CLIENT_IDGOOGLE_CLIENT_SECRETS3_BUCKETS3_REGIONS3_ACCESS_KEY_IDS3_SECRET_ACCESS_KEYRequired for the validation runtime in WC01:
DATABASE_URLOPENAI_API_KEYOptional but recommended:
WORKER_CONCURRENCYPLAYWRIGHT_BROWSERS_PATHVALIDATION_OPENAI_MODELVALIDATION_NANO_MODELWEB_BOT_AUTH_ENABLEDWEB_BOT_AUTH_PRIVATE_KEY_PEMWEB_BOT_AUTH_SIGNATURE_AGENT_URLUse Node 22, 23, or 24 for local development. Node 20 is below the workspace engine floor, and Node 25 is not supported because it can fail DNS resolution for app routes and external service calls on localhost.
pnpm installcp apps/web/.env.example apps/web/.env.localhttp://localhost:3000/api/auth/callback/googlehttp://127.0.0.1:3000/api/auth/callback/googlehttps://certscore.ai/api/auth/callback/google/auth/callback is only an app alias route; it is not the redirect URI Better Auth initiates with GoogleNEXT_PUBLIC_APP_URL should be http://localhost:3000S3_BUCKET.pnpm --filter @website-signal-risk-scanner/validation-worker exec playwright install chromiumpnpm dev:validationpnpm --filter @website-signal-risk-scanner/web devWS01 when you need the standalone scanner locally.localhost:3000:pnpm dev:scanner:localWC01:pnpm dev:allpnpm dev:validation:schedulerUse these commands before shipping changes:
pnpm turbo run typecheckpnpm turbo run buildValidation-specific checks:
pnpm --filter @website-signal-risk-scanner/validation-worker typecheckpnpm test:scan-pipelineThe scan pipeline test is deterministic and runs locally from apps/validation-worker/src/validation/pipeline.test.ts.
The normalized concern lifecycle in WC01 is documented in docs/normalized-concern-pipeline.md.
GitHub Actions workflow: .github/workflows/accessibility-validation.yml
worker-scan-pipeline-tests runs on pushes to main, pull requests, and manual dispatch. It installs Chromium, typechecks validation-worker, and runs pnpm test:scan-pipeline.live-validation-smoke runs after the deterministic job and executes pnpm --filter @website-signal-risk-scanner/validation-worker smoke:validation only when the runtime secrets are configured.Use these lightweight checks before first deployment validation:
pnpm dev:storage:localpnpm --filter @website-signal-risk-scanner/web check-envpnpm check-env:validationpnpm --filter @website-signal-risk-scanner/validation-worker check-envpnpm --filter @website-signal-risk-scanner/validation-worker check-runtimeFor local validation runs, pnpm dev:storage:local starts MinIO against the apps/web/.env.local S3 settings and creates the configured bucket when needed.
Run it alongside pnpm dev:scanner:local and pnpm dev:validation:worker.
Use this runtime smoke helper:
pnpm --filter @website-signal-risk-scanner/validation-worker schedulerThe full runtime QA sequence is documented in docs/runtime-validation.md. The validation pipeline design and deployment shape are documented in docs/validation-pipeline-plan.md. The validation crawler deployment and VM runbook is documented in docs/validation-ops-runbook.md. Cloudflare Verified Bot setup is documented in docs/cloudflare-web-bot-auth.md.
ConsentCheck can expose a signed HTTP Message Signatures key directory and sign outbound HTTP crawler requests for Cloudflare Verified Bot workflows.
Required configuration:
WEB_BOT_AUTH_ENABLEDWEB_BOT_AUTH_PRIVATE_KEY_PEMWEB_BOT_AUTH_SIGNATURE_AGENT_URLWEB_BOT_AUTH_EXPIRES_SECONDSWEB_BOT_AUTH_INCLUDE_NONCECommon commands:
pnpm web-bot-auth:generatepnpm web-bot-auth:printpnpm web-bot-auth:test-requestpnpm test:web-bot-authcertscore.aiconsentcheck.site is owned outside WC01 and must not be deployed by this repomain deploys through .github/workflows/web-aws-ecs-deploy.ymlpnpm ops:check:deploy before or after topology changes to catch stale local assumptionspnpm ops:check:live against the public hosts to verify runtime target and revision alignment after deployWC01 for the primary scanner deploy pathWS01 for scanner runtime deploymentWC01 deployment guidance scoped to web and validation onlyWC01 validation runtime changesS3_BUCKETRecommended production trigger:
Command:
pnpm dev:validation:schedulerThe primary scanner scheduler now lives in WS01.
After deployment, validate in this order:
WS01 owns crawl, auditing, scoring, reporting, PDF generation, and scheduled sweep logic.Source-derived launch command. Check the maintainer’s required arguments and credentials before running:
npx -y @certscore/mcpMerge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.
{
"mcpServers": {
"ai-certscore-mcp": {
"command": "npx",
"args": [
"-y",
"@certscore/mcp"
]
}
}
}Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.
Claude Desktop setup reference@certscore/mcpnpmCertScore MCP works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.
~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.~/.cursor/mcp.jsonRestart Cursor for changes to take effect..vscode/mcp.jsonReload VS Code window for changes to take effect.~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect..mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.