Prodpoke Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Prodpoke Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A QA tester inside your AI. Chat with ProdPoke from Claude, Cursor, or any MCP client. It launches real Playwright browsers, finds real bugs, and remembers what you talked about across turns.
Hosted, not installed. Just paste a config into your MCP client and go.
Landing page · Get an API key · Pricing · ProdPoke
<p align="center"> <img src="assets/demo.gif" alt="ProdPoke MCP demo — scanning a site from Claude Desktop" width="720" /> </p>
ProdPoke is a remote, stateful MCP server that runs real-browser QA for any website. You describe what you want in plain English; ProdPoke spins up a headless Playwright session, navigates the site, and streams back structured findings — accessibility, SEO, performance, user-flow bugs, visual regressions, broken CTAs, and more.
Unlike local tools, everything runs on ProdPoke infrastructure. No Chromium to install, no browser containers to manage, no cleanup.
| Tool | Description | Parameters |
|---|---|---|
chat | Talk to ProdPoke like a QA tester — scan a URL, test a flow, investigate findings, set session preferences. Stateful via session_id. | message (required), session_id (optional) |
get_credit_balance | Check your remaining scan credits. | — |
chat response{
"session_id": "a1b2c3d4-...",
"response": "Found 3 issues on https://example.com...",
"findings": [
{
"severity": "high",
"category": "accessibility",
"title": "Missing alt text on 4 images",
"description": "Images in the hero section lack alt attributes..."
},
{
"severity": "medium",
"category": "seo",
"title": "Missing meta description",
"description": "The page has no meta description tag..."
}
],
"session_context": {
"url_being_tested": "https://example.com",
"message_count": 2,
"has_findings": true
}
}includes 500 credits, enough for a first scan.
it later, but you can revoke and re-mint).
Keys look like pp_ followed by 64 hex characters.
<details open> <summary><strong>Claude Desktop / Cursor / Claude Code</strong> (streamable HTTP — recommended)</summary>
{
"mcpServers": {
"prodpoke": {
"type": "streamable-http",
"url": "https://prodpoke.com/v1/mcp",
"headers": {
"Authorization": "Bearer pp_YOUR_KEY_HERE"
}
}
}
}Config file locations:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json.mcp.json in your project rootFully restart the client after editing.
</details>
<details> <summary><strong>Clients that only support stdio</strong> (via <code>mcp-remote</code> bridge)</summary>
{
"mcpServers": {
"prodpoke": {
"command": "npx",
"args": [
"mcp-remote",
"https://prodpoke.com/v1/mcp",
"--header",
"Authorization: Bearer ${PRODPOKE_API_KEY}"
],
"env": {
"PRODPOKE_API_KEY": "pp_YOUR_KEY_HERE"
}
}
}
}Uses mcp-remote to proxy stdio ↔ streamable HTTP.
</details>
Try any of these:
The chat tool is stateful. Each response includes a session_id; pass it back to continue the conversation with full context:
chat("Scan https://mysite.com") — starts a session, runs the scan, returns session_id + findings.chat("Dig deeper into the accessibility issues", session_id="...") — builds on the prior scan.chat("Now test the checkout flow", session_id="...") — runs a targeted test, knows about the earlier findings.chat("What should I fix first?", session_id="...") — answers from the accumulated session context.Sessions persist across MCP client restarts for the lifetime of the key.
Your MCP client ──Authorization: Bearer pp_...──▶ https://prodpoke.com/v1/mcp
│
▼
Orchestrator classifies intent
│
▼
Playwright worker on ProdPoke
infrastructure runs the scan
│
▼
Findings streamed back as a
structured `chat` responseNothing is installed on your machine. Scans run on our servers. You pay per scan in credits (see below).
| Plan | Credits | Price |
|---|---|---|
| Free tier | 500 credits | $0 |
| Watch | 10,000 / month | $15 / month |
| Watch Pro | 50,000 / month | $49 / month |
| Top-up packs | 1,000 – 50,000 | From $3 |
A standard scan costs roughly 10 credits. Deeper workflows — full user-flow tests, competitor comparisons — run 400–500 credits. See full pricing →
The error message when you're out of credits is explicit: "Insufficient credits. You need N but have M.", so your AI client can surface it clearly.
Authorizationheader. Double-check the config (the key goes in headers, not env, for streamable HTTP).
needs a URL to launch a browser; it won't guess.
flows should be split into multiple chat turns using session_id.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.