Fireshift MCP server

By the Fireshift team · Updated 2026-11-05

Your assistant calls scan_site. We read the site's public tags and send back the same score as the website.

In one line

Run the Fireshift scan from Claude, Cursor or any other MCP client. You get the same Leak Score and findings as the website, free, with no account and no API key.

The server URL

MCP server URL

https://mcp.fireshift.ai/mcp

Streamable HTTP. Add it, then ask: "scan yoursite.com and tell me what to fix first".

Two tools

scan_site takes {"domain": "yoursite.com"} and returns the Leak Score (0 to 100), grade, each finding with its points and proof, and a report link. Same rules as the scan page, so the score matches.

get_stats takes nothing and returns totals: scans, sites, last 7 days, top findings, grade mix. No domain names.

What a scan looks like

A real scan_site call, 5 Nov 2026, B2B SaaS site, domain and container masked, evidence lines cut. A scan takes 2 to 20 seconds.

scan_site result

b2b-saas.example: Leak Score 44/100, grade D (scanned 2026-11-05).
Google Ads conversions: 27 (0 send a value). GA4 properties: 0. Containers: GTM-••••.
- [login, -20] 1 conversion fires on login. Returning users get counted as new conversions.
- [click, -10] 12 Google Ads conversions fire on a button or link click. The click counts even when the form after it is never sent.
- [duplicates, -10] 2 conversions are set up more than once, so one action can count twice.
- [too_many, -8] 27 Google Ads conversions are live. Past about 8, bidding spreads across steps that don't make money.
- [no_values, -8] 27 of 27 Google Ads conversions send no value. Bidding can't tell a $10 lead from a $10,000 one.
Primary vs secondary status of Ads conversions isn't visible from outside. A conversion set to secondary doesn't drive bidding.
Full report: https://fireshift.ai/scan/?d=b2b-saas.example

Set it up

Claude Code, one command:

Claude Code

claude mcp add --transport http fireshift https://mcp.fireshift.ai/mcp

Claude Desktop and claude.ai. Customize, Connectors, Add custom connector. Name it Fireshift, paste the URL, no sign-in. Free plan: one connector.

Claude Desktop stdio bridge, Cursor, VS Code, Windsurf

Claude Desktop without a free connector slot: the stdio bridge in claude_desktop_config.json (needs Node.js)

claude_desktop_config.json

{
  "mcpServers": {
    "fireshift": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.fireshift.ai/mcp"]
    }
  }
}

Cursor (~/.cursor/mcp.json or .cursor/mcp.json)

Cursor mcp.json

{"mcpServers": {"fireshift": {"url": "https://mcp.fireshift.ai/mcp"}}}

VS Code (.vscode/mcp.json)

VS Code mcp.json

{"servers": {"fireshift": {"type": "http", "url": "https://mcp.fireshift.ai/mcp"}}}

Windsurf (~/.codeium/windsurf/mcp_config.json, then refresh the MCP list in Cascade)

Windsurf mcp_config.json

{"mcpServers": {"fireshift": {"serverUrl": "https://mcp.fireshift.ai/mcp"}}}

Any other client takes the URL as is. From a terminal:

curl

curl -s https://mcp.fireshift.ai/mcp \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"scan_site","arguments":{"domain":"yoursite.com"}}}'

Limits

10 tool calls a minute per IP, one domain per call. Past that, wait a minute.
A daily cap on fresh homepage reads, shared with the website.
Public tags only. We never log in, fill a form or click. Server-side tags and tags behind consent are out of reach.

What we store

Same as a website scan: the domain and its result (score, grade, finding codes, first and last scan, count, via MCP). No IP, no email. Kept 12 months after the last scan. Privacy policy.

FAQ

Do I need an account or an API key?

No. The server is free and open. Paste the URL into your client and call the tools.

Check your own site, free.

Fireshift reads what your site tells Google Ads, GA4 and Meta from the outside. No install, no account access.

See a sample report Or have us fix it: Fix Sprint, €1,500