Coredash Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Coredash Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Real User Monitoring for Core Web Vitals. Query LCP, INP, and CLS field data from real visitors through the Model Context Protocol.
The MCP server is hosted at https://app.coredash.app/api/mcp. This repo holds the public connector docs and registry manifest. You do not need to install or run a server. You connect your MCP client directly to the hosted endpoint.
CoreDash is a Real User Monitoring platform built around Core Web Vitals. It collects LCP, INP, and CLS from real visitors and lets you segment by page template, country, device, browser, OS, and 20 plus other dimensions. Data is stored in the EU. The product runs without consent banners. Paid plans start at $19 per month. More at coredash.app.
| Tool | Purpose |
|---|---|
get_metrics | Current performance scores at p75. Filter and group by any dimension. Use for "what is" questions. |
get_timeseries | Metric over time with an improving, stable, or regressing summary. Use for regressions and trends. |
get_histogram | Distribution shape of a single metric across roughly 40 buckets. Use to see whether traffic is bimodal, long tailed, or evenly slow. |
All three tools return rated buckets (good, improve, poor) matching the Core Web Vitals thresholds. Filter dimensions include device (d), country (cc), page path (ff), URL (u), browser, OS, and the LCP / INP / CLS attribution element selectors.
The server supports two methods:
WWW-Authenticate discovery flow and publishes /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource.Authorization: Bearer cdk_YOUR_API_KEY.Anonymous calls succeed for initialize (so clients can introspect server capabilities) and fail for any tool call.
Add the server, then authenticate in the browser:
claude mcp add --transport http coredash https://app.coredash.app/api/mcpRun /mcp inside Claude Code, select coredash, and complete the OAuth sign-in.
To use an API key instead (e.g. in CI), pass it as a header:
claude mcp add --transport http coredash https://app.coredash.app/api/mcp \
--header "Authorization: Bearer cdk_YOUR_API_KEY"Add to ~/.cursor/mcp.json, then click Login on the server in Cursor's MCP settings to complete OAuth:
{
"mcpServers": {
"coredash": {
"url": "https://app.coredash.app/api/mcp"
}
}
}To use an API key instead, add a "headers" block with "Authorization": "Bearer cdk_YOUR_API_KEY".
Add to .vscode/mcp.json in your workspace (or the user config via the MCP: Open User Configuration command). VS Code prompts you to sign in on first use:
{
"servers": {
"coredash": {
"type": "http",
"url": "https://app.coredash.app/api/mcp"
}
}
}To use an API key instead, add a "headers" block with "Authorization": "Bearer cdk_YOUR_API_KEY".
Same JSON shape as Cursor, in the Windsurf MCP settings.
Point it at https://app.coredash.app/api/mcp with the streamable-http transport. Clients that support OAuth discover the flow via the WWW-Authenticate header; otherwise pass an Authorization: Bearer cdk_YOUR_API_KEY header.
Why is LCP slow on mobile in Germany this week?
Has INP regressed on the product detail template in the last 24 hours?
Show me the LCP distribution on /checkout/* in the US.This server is published on the Official MCP Registry as io.github.corewebvitals/coredash. From there it propagates to PulseMCP, Smithery, Glama, and Windsurf.
The registry manifest is in server.json. To publish a new version, edit the file and run mcp-publisher publish.
cwv-superpowers. Skills package for Claude Code, Cursor, and Gemini that drives this MCP server to diagnose and fix Core Web Vitals issues.MIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.