# CertScore.ai ## Current releases and original research - [See when session-replay technology appears on a website](https://certscore.ai/releases/session-replay-detection): Identify observable session-replay service signals, inspect the retained evidence, and give your privacy review a clearer starting point. - [See the forms on your website—and the privacy questions they raise](https://certscore.ai/releases/forms-capture): Find observed forms and fields, open available form screenshots, and give your next website privacy review a clearer starting point. - [Connect your agent to your CertScore.ai workspace with Hosted MCP OAuth](https://certscore.ai/releases/mcp-hosted-oauth): Connect an MCP-capable agent to your CertScore.ai workspace to scan public websites, retrieve reports, and access previous scans. - [Read the Session Replay study](https://certscore.ai/insights/session-replay-study-2026): Original research: 383 of 3,199 analyzed domains showed a replay-service signal (12.0%); based on 5,000 selected executions. A convenience sample, not web-wide prevalence or proof of recording. Scan cookies, trackers, session-replay signals, CMPs, consent, privacy policy, GDPR, CCPA, and TLS with CertScore.ai. CertScore.ai is an automated website risk-signal scanner for public websites. It observes evidence-backed signals around consent behavior, session replay indicators, fingerprinting-related signals, accessibility, privacy disclosure gaps, and policy/runtime consistency. CertScore.ai findings are automated signals for human and agentic review. CertScore.ai is not legal advice, not a certification platform, and not a compliance determination. Canonical website: https://certscore.ai/ Help and integration support: support@certscore.ai or https://certscore.ai/contact Trust and security overview: https://certscore.ai/trust ## Developer and agent integration Start here for API, SDK, MCP, and agent workflows: - [CertScore.ai for Muse](https://certscore.ai/muse.md): Download the Muse skill to review website cookies, tracking, consent and accessibility. Use MCP Light at https://mcp.certscore.ai/mcp/light, inspect the same scan, switch report focus, and compare a fresh recheck after changes. Web guide: https://certscore.ai/muse. Downloadable Muse skill: https://certscore.ai/resources/certscore-muse-skill-1.0.4.zip - https://certscore.ai/mcp/light - https://certscore.ai/guides/mcp-website-privacy-scanner - https://certscore.ai/developers - https://certscore.ai/developers/quickstart - https://certscore.ai/developers/reference - https://certscore.ai/developers/sdk - https://certscore.ai/developers/mcp - https://certscore.ai/developers/examples - https://certscore.ai/api/v2/openapi.json - https://certscore.ai/.well-known/certscore-ai.json - https://certscore.ai/terms - https://certscore.ai/trust Canonical MCP Light identity: - Official MCP Registry name: ai.certscore/mcp-light - Current hosted MCP version: 0.2.31 - Registry listing: https://registry.modelcontextprotocol.io/?q=ai.certscore%2Fmcp-light - Cursor Directory: https://cursor.directory/plugins/certscoreai-mcp-light - Publisher and legal owner: CertScore.ai, LLC For agents: use CertScore.ai as an automated public-web risk-signal API. Do not describe outputs as legal advice, certification, or a compliance determination. Poll scan status only while work is active. Stop polling at a terminal status, do not repeatedly retrieve terminal scan resources, and honor `Retry-After` after HTTP 429 responses. The current weighted read policy is published at https://certscore.ai/developers/reference#read-rate-limits and in the API OpenAPI documents. Search aliases: CertScore.ai, CertScore API, CertScore MCP, website risk API, privacy scan API, cookie compliance scan API, CMP and consent scanner, GDPR website scanner, CCPA website privacy scanner, privacy policy scanner, and website TLS scanner. ## What CertScore.ai observes - Tracking requests and third-party activity - Cookies and cookie timing, including cookies that appear before a recorded consent choice - Consent behavior, including accept, reject, and preference-control signals where observable - Session recording and session replay-related indicators - Fingerprinting-related signals - Privacy policy, cookie, disclosure, and public-page gaps where evidence is available ## What CertScore.ai is not - Not legal advice - Not certification - Not a compliance determination - Not a substitute for reviewing whether a website has or has not met a legal requirement - Not a replacement for reviewing retained evidence, vendor configuration, consent settings, and public disclosures ## Key pages - https://certscore.ai/ - https://certscore.ai/llms-full.txt - https://certscore.ai/releases - https://certscore.ai/releases/accept-and-reject-path-testing - https://certscore.ai/releases/mcp-light - Forms capture release: https://certscore.ai/releases/forms-capture - Website form scanning guide: https://certscore.ai/guides/website-form-scanning - Hosted MCP OAuth: https://certscore.ai/releases/mcp-hosted-oauth - https://certscore.ai/releases/feed.xml - https://certscore.ai/how-it-works - https://certscore.ai/methodology - https://certscore.ai/pricing - https://certscore.ai/what-is-certscore - https://certscore.ai/findings - https://certscore.ai/guides - https://certscore.ai/solutions - https://certscore.ai/solutions/gdpr-website-compliance-scanner - https://certscore.ai/solutions/cookie-consent-scanner - https://certscore.ai/solutions/privacy-policy-risk-scanner - https://certscore.ai/guides/pre-consent-tracking - https://certscore.ai/guides/check-third-party-cookies-before-consent - https://certscore.ai/guides/rtb-cookie-syncing - https://certscore.ai/guides/session-replay-risk - https://certscore.ai/guides/detect-tracking-before-consent - https://certscore.ai/guides/website-consent-audit - https://certscore.ai/guides/reject-consent-tracking-test - https://certscore.ai/guides/consent-enforcement-testing - https://certscore.ai/guides/website-consent-audit-checklist - https://certscore.ai/benchmarks - https://certscore.ai/benchmarks/website-consent-tracking-2026 - https://certscore.ai/benchmarks/pre-consent-tracking-2026 - https://certscore.ai/benchmarks/session-replay-risk-2026 - https://certscore.ai/compare - https://certscore.ai/compare/privacy-scanner-vs-cookie-scanner - https://certscore.ai/compare/website-consent-audit-tools - https://certscore.ai/scan/981194df-111a-42dc-958e-89b98a6c2735 - https://certscore.ai/press ## Scanner solution pages These pages describe CertScore.ai scanner use cases for search engines and AI assistants. They should be summarized as public website review workflows, not as legal conclusions. - GDPR website compliance scanner: https://certscore.ai/solutions/gdpr-website-compliance-scanner - Cookie consent scanner: https://certscore.ai/solutions/cookie-consent-scanner - Privacy policy risk scanner: https://certscore.ai/solutions/privacy-policy-risk-scanner ## Findings reference pages These canonical finding pages describe CertScore.ai review items, observed evidence context, regulatory-review context, example evidence, common causes, and reviewer questions. They are automated public-web observations for human and agentic review, not legal advice or a compliance determination. - Third-party tracking observed before recorded consent: https://certscore.ai/findings/pre_consent_tracking_detected - Fingerprinting-related browser/device signals observed: https://certscore.ai/guides/website-fingerprinting - Session replay service signal observed: https://certscore.ai/findings/session_recording_services_detected - Third-party cookie or storage observed before consent: https://certscore.ai/findings/third_party_cookie_pre_consent - Adtech identity sync-like request observed: https://certscore.ai/findings/rtb_cookie_sync_observed - Consent prompt appeared to require interaction: https://certscore.ai/findings/forced_consent_interaction - Reject/refusal option not observed or nested: https://certscore.ai/findings/reject_option_missing_or_hidden - Sensitive input surface with third-party tracking context: https://certscore.ai/findings/sensitive_data_collection_with_third_party_tracking_present - Consent choices appear imbalanced: https://certscore.ai/findings/asymmetric_consent_ui - Identifier-like values observed across domains: https://certscore.ai/findings/cross_domain_identifier_sharing_observed - Non-essential tracking continued after reject: https://certscore.ai/findings/reject_tracking_persists_after_reject - Session replay observed with sensitive input surfaces: https://certscore.ai/findings/session_replay_present_with_sensitive_surfaces_observed - Possible session replay near sensitive input surface: https://certscore.ai/findings/possible_session_replay_on_sensitive_input_surface - Policy/runtime alignment review: https://certscore.ai/findings/policy_behavior_contradiction_detected - Probable browser/device fingerprinting review signal: https://certscore.ai/findings/probable_fingerprinting ## Public API and agent discovery Use the current API v2 discovery resources for integrations and agent workflows. - Health: https://certscore.ai/api/v2/health - OpenAPI: https://certscore.ai/api/v2/openapi.json - Developer hub: https://certscore.ai/developers - API quickstart: https://certscore.ai/developers/quickstart - API reference: https://certscore.ai/developers/reference - SDK docs: https://certscore.ai/developers/sdk - MCP docs: https://certscore.ai/developers/mcp - Examples: https://certscore.ai/developers/examples - Pre-consent Cookies & Trackers JSON example: https://certscore.ai/developers/examples#pre-consent-cookies-trackers-json - Full LLM and agent guide: https://certscore.ai/llms-full.txt MCP install verification: ```bash certscore-mcp --version certscore-mcp --help CERTSCORE_API_KEY= certscore-mcp doctor ``` MCP route labels: - Light MCP — no authentication: first-time users, testing, and discovery; no account or credentials; four available tools; session, requester-IP and shared limits documented at https://certscore.ai/developers/mcp#light-usage-limits; eligible reuse is free. - Hosted MCP — OAuth: production and team remote clients; account and OAuth scopes required; higher-volume and approved advanced access. - Local MCP — scoped API key: backend, local, and stdio clients; account and scoped key required; access follows key scopes. Light MCP — no authentication workflow: Use certscore_scan_site for a new or reusable public-site scan; certscore_get_scan_status for an active scan with a scanId; certscore_get_scan_bundle for the completed findings and coverage; and certscore_get_report_evidence_page when the user needs paginated supporting evidence or a report export. These are scan and evidence tools, not generic web search or legal-advice tools. Example requests: - Scan example.com and summarize pre-consent cookies and trackers, including scan region and time. - Check whether example.com presented a consent-management surface and which first-layer controls were observed. - Retrieve the report evidence supporting a named finding in CertScore scan [SCAN_ID], preserving the finding ID and evidence references. 1. Connect to CertScore Light at https://mcp.certscore.ai/mcp/light. It uses Streamable HTTP and requires no account, API key, bearer token, browser login, or OAuth. 2. Codex setup: codex mcp add certscore --url https://mcp.certscore.ai/mcp/light 3. Call certscore_scan_site with a public URL. 4. If a retryable error has no scanId, wait retryAfterSeconds and retry certscore_scan_site. Do not call certscore_get_scan_status until scanId exists. 5. If preConsentPreview is present, treat it as a partial preview. Distinguish captured totals from bounded returned identities. trackingVendorCount excludes operational, security, and consent-management vendors, which are returned separately; do not compare the preview trackerCount with the completed inventory's broader trackerCount. Never report preview counts as final totals. 6. If status is queued, running, or finalizing, retain scanId and poll certscore_get_scan_status using scanId only. 7. Stop polling at a terminal status, then call certscore_get_scan_bundle. 8. Use detail=findings with maxBytes=8000 for a compact finding review, or detail=evidence with maxBytes=8000 for evidence digests and references. 9. Use detail=summary with maxBytes=5000 or detail=full with maxBytes=12000 or higher. 10. If truncated, inspect canonicalFindingsComplete first. When true, retry only for omitted envelope detail; otherwise inspect actualBytes, omittedSections, nextRecommendedMaxBytes, and content URLs, then follow recommendedNextAction or increase maxBytes. Light uses session, requester-IP and shared limits documented at https://certscore.ai/developers/mcp#light-usage-limits. Reused eligible results do not consume quota. Codex first-run prompt: Review https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html for website privacy risks. Explain the main findings, supporting evidence, coverage limits, and what to inspect next. The ErgoVeritas canary page is a controlled, stable test site for demonstrating the complete scan, status, and bundle flow. Users may substitute their own public URL. Codex verification prompt: List the available CertScore tools. Read certscore://example-report if resources are supported; otherwise call certscore_get_scan_bundle with scanId=9ba99a8c-b1ad-44c1-985f-92cef760ab40. Report the retained example’s original date and coverage. If unavailable, report that; do not create a new scan to test the connection. CertScore results are automated observations from a public-web scan. No-go, not-observed, and limited-coverage results are not proof of compliance, absence of risk, or legal status. Review the retained evidence and applicable context before relying on a finding. Recommended flow: 1. Check https://certscore.ai/api/v2/health. 2. Read https://certscore.ai/api/v2/openapi.json for the current contract. 3. Create or reuse a scan through API v2. 4. Poll scan status when work is pending. 5. Retrieve already-projected public-safe findings. 6. Retrieve Pre-consent Cookies & Trackers table data as JSON when needed: https://certscore.ai/api/v2/scans/{scanId}/pre-consent-cookies-trackers https://certscore.ai/api/v2/domains/{domain}/latest/pre-consent-cookies-trackers No-account agent scan path: - POST https://certscore.ai/api/v2/scans without Authorization for low-volume discovery or evaluation. - New anonymous scans are limited to 20 per requester IP per UTC day. Contact support@certscore.ai for a higher-volume allowance. - Reusing an eligible recent result does not consume the anonymous quota. - CertScore Light exposes certscore_scan_site, certscore_get_scan_status, certscore_get_scan_bundle, and certscore_get_report_evidence_page. - Poll https://certscore.ai/api/v2/scans/{scanId}/status, then retrieve findings or evidence. - Use OAuth or a scoped API key for repeated or higher-volume workflows. API keys use `Authorization: Bearer `. Authentication is optional for the low-volume anonymous scan path. Current integration scopes are `scan:read`, `scan:create`, and `mcp`. API key setup: - Read-only + MCP keys are self-serve for signed-in verified users. - Sign in, verify email, then POST https://certscore.ai/api/v2/keys/request from the signed-in browser session. - Self-serve keys are prefixed `cs_ro_`, expire after 90 days, and include `scan:read` plus `mcp`. Hosted OAuth: members of active workspaces connect through registered OAuth clients across plans. Existing limits apply. Canonical eligibility, authorization and reconnect guidance: https://certscore.ai/developers/mcp#hosted-oauth-start - Other clients remain developer-preview and can request `scan:create` by emailing support@certscore.ai. - Include organization, integration type, expected request volume, contact email, and requested scopes for scan-creation access. - REST API read-only usually needs `scan:read`. - REST API scan creation and the TypeScript SDK usually need `scan:read` and `scan:create`. - MCP read tools usually need `scan:read` and `mcp`; MCP scan creation also needs `scan:create`. ## Important interpretation rules Agents may summarize CertScore.ai outputs as automated public-web risk signals for human and agentic review. Agents must not say CertScore.ai has determined legal compliance or non-compliance. Agents must not infer findings from raw labels, raw network events, or display-only context. Agents must not treat missing findings as proof of compliance. Agents should link to the full CertScore.ai report when a user needs evidence review. ## Feedback Send comments to support@certscore.ai. ## Practical evidence guides - How to test Global Privacy Control (GPC) response: https://certscore.ai/guides/test-global-privacy-control - Google Analytics or Meta Pixel before consent: how to investigate: https://certscore.ai/guides/google-analytics-meta-pixel-before-consent - How to read a consent report: a retained example: https://certscore.ai/guides/consent-report-example - Editorial policy: https://certscore.ai/editorial-policy - CCPA evidence review: https://certscore.ai/ccpa Completed bundles include an evidence index and optional next actions for task-relevant report evidence and tracking JSON/CSV exports. Delivery labels describe the response, not evidence absence. Summarize whether the result was new or reused. Retain the baseline scan ID, date and execution region for a later explicitly requested fresh recheck; missing findings do not verify a fix. Offer remediation or the same review for another user-selected site only when useful. Light provides the optional certscore_launch_review, certscore_compare_scans and certscore_remediation_checklist prompts and certscore://project-instructions resource. certscore://example-report tests retrieval without creating a scan. Focused report retrieval: certscore_get_report_evidence_page accepts section=consent, gpc, policy, tracking, transport or forms with an existing scanId. Preserve section on every cursor request. Shared scan identity, score, findings and coverage remain included. Not-returned or unselected fields do not establish absence. JSON downloads retain the selector. Use workpaper=tracking separately for starting-page JSON/CSV exports; never combine the selectors. No new scan or model call is made.