Introducing the Webperf MCP server for your own AI
In June we wrote that if you want to point an AI at your web data, you should be the one holding the reins. Bring your own AI, on your terms. That was the principle. This is the door it opens.
The Webperf MCP server connects an AI assistant to your Webperf data. Once it's installed, you can ask, in an ordinary chat window, which of my sites lost accessibility points since spring?
and get an answer built from your own test results, by a model you picked, without the data taking a detour through anyone's black box.
It's free, it's open source, and if you have API access it works with the key you already have.
What MCP is, in plain words
MCP stands for Model Context Protocol. It's an open standard for connecting AI assistants to outside tools and data. Without something like it, an assistant knows only what it was trained on plus whatever you paste into the chat. With it, the assistant can call a defined set of tools and read live data.
The word doing the work there is defined. An MCP server doesn't hand a model the keys to your account. It publishes a specific list of things it is able to do, and the model gets that list and nothing more. Ours publishes four:
list_my_sites, the sites your key can see.get_latest_results, the most recent results for one of them, across accessibility, performance, standards and security.get_test_history, the monthly score history for a site, which is what you want for trends.list_test_types, the catalogue of test types, so the numeric ids in your results read as names.
That is the entire surface. There is no tool for starting a test, changing a setting, or deleting anything, because we didn't write one. Version one reads. If a model gets confused, or you ask it something careless, the worst it can do is read something you were already allowed to read.
Installing it in Claude takes about a minute
Download webperf-mcp-0.1.0.mcpb from the latest release and double-click it. Claude Desktop asks for your API key, and you're finished.
There's no configuration file to hand-edit, no terminal, and nothing to install first. You don't need Python on your machine, because the bundle tells Claude Desktop which runtime it needs and Desktop fetches it. If you use a different MCP client, the README has the manual route.
Then you can ask things like:
- Which of my sites has the worst accessibility score right now?
- Has anything regressed since last month?
- Summarise the security findings across my portfolio.
- Chart the performance trend for site 3843 over the past year.
The interesting ones are the questions you'd never file a ticket for. The ones that are worth thirty seconds of curiosity but not twenty minutes of clicking through dashboards. Those questions mostly go unasked, and the answers are sitting in your data already.
Where your key lives
This part is worth reading slowly, because it's the part most integrations get wrong.
Your API key goes into your operating system's keychain, the same place your other passwords live. It doesn't sit in a configuration file in cleartext, it isn't uploaded to us, and it isn't sent anywhere except to api.webperf.se, over HTTPS, as the header it has always been.
The server runs on your own machine. There is nothing hosted, no middleman service, no account to create. It talks to the same public API you could call yourself with curl.
And it's worth being precise about what the AI sees. The assistant sees the results of the four tools above, in the same way it would see a spreadsheet you pasted in. Which model that is, and what it does with those results, is your decision. If your organisation has rules about which assistants may touch your data, those rules apply here unchanged, and you're the one applying them.
It cannot show you what your key couldn't already fetch
The MCP server has no privileges of its own. That sentence is the whole security model, but it's worth unpacking.
Every request it makes carries your personal key, and api.webperf.se decides what that key may see, exactly as it does when you log in to Webperf Cloud. The permission check happens on our server, not in the tool on your laptop. So the MCP server can't be talked into showing you a site you don't have access to, because it isn't the thing deciding. Ask it for someone else's data and the API returns a 403, the same as it would for any other client.
Revoking works the same way. Rotate or revoke the key in your account and access stops on the next request. There's no cached copy to expire and no session to hunt down.
That's not a claim you have to take on faith. It's a consequence of the design, and the source is right there if you'd like to check. About two hundred lines, MIT licensed. It's a thin client over an API you can already read.
Why we built it this way
We could have built the other thing. A hosted service, your data flowing to our servers, a model we picked, insights we chose to surface. It would have demoed well.
But we've been fairly rude about that pattern, and it would be strange to ship it ourselves the moment it got convenient. The point of owning your data is that you get to decide what you think about it. A tool that reads your numbers and hands them to a model you selected, running under your control, with your key, is the version of AI assistance that leaves the judgment where it belongs.
The open-source foundation is the same argument at a different layer. You can read the engine that produces the scores, and now you can read the doorway your assistant walks through to reach them. Neither is a black box, and neither is a lock-in.
Who can use it
Anyone with a Webperf API key, which comes with the Standard and Agency tiers. It's the same key you find in Webperf Cloud, so there's nothing new to request or generate. On Agency, where one key reaches your whole portfolio, the MCP server reaches your whole portfolio too, which makes questions across clients rather than one at a time possible.
If you're on Starter and this is the thing that interests you, API access is what you'd be upgrading for.
The server is free and MIT licensed on GitHub. You need an API key, which comes with Standard and Agency. Tell us what you'd like the assistant to answer at hello@webperf.cloud.