Store Canary

io.github.erikras/store-canaryVersion 1.1.0

Free read-only WooCommerce checks: store, SSL, exposure, SEO, speed, products, policies + 3 prompts

Status

Responds226 msNov 14, 2026, 14:50 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:50 UTC
Latency: 226 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://mcp.storecanary.app/mcpResponds226 msNov 14, 2026, 14:50 UTC

No sign-in

Claude Code

claude mcp add --transport http store-canary https://mcp.storecanary.app/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: store-canary
Remote MCP server URL: https://mcp.storecanary.app/mcp

Cursor

{
  "mcpServers": {
    "store-canary": {
      "url": "https://mcp.storecanary.app/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"store-canary","type":"http","url":"https://mcp.storecanary.app/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

8 tools

Tools of Store Canary
	Description		Read-only	Idempotent	Open world
`check_exposure`Flag WordPress, WooCommerce, plugin and PHP versions a store shows publicly (generator tags, asset ?ver= values, X-Powered-By), a public /readme.html and a readable /wp-content/debug.log. Log contents are never returned or kept. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Flag WordPress, WooCommerce, plugin and PHP versions a store shows publicly (generator tags, asset ?ver= values, X-Powered-By), a public /readme.html and a readable /wp-content/debug.log. Log contents are never returned or kept. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_policies`Check that the homepage links to privacy, terms, shipping and returns/refunds pages, and that each linked page on the same site loads. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Check that the homepage links to privacy, terms, shipping and returns/refunds pages, and that each linked page on the same site loads. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_products`Read up to 10 published products from the public WooCommerce Store API and flag missing prices, missing images and out-of-stock items. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Read up to 10 published products from the public WooCommerce Store API and flag missing prices, missing images and out-of-stock items. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_seo_basics`Check a store's robots.txt (and whether it blocks the whole site), its XML sitemap, the homepage title and meta description, and noindex on the homepage. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Check a store's robots.txt (and whether it blocks the whole site), its XML sitemap, the homepage title and meta description, and noindex on the homepage. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_speed`Time one download each of a store's homepage, one product page and the cart from Cloudflare's network. One sample per page, not a lab test or an average. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Time one download each of a store's homepage, one product page and the cart from Cloudflare's network. One sample per page, not a lab test or an average. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_ssl`Check that a store's HTTPS certificate is accepted, http:// permanently redirects to https://, the redirect chain is short and stays on HTTPS, and an HSTS header is set. The exact certificate expiry date isn't visible to an outside fetch. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	Check that a store's HTTPS certificate is accepted, http:// permanently redirects to https://, the redirect chain is short and stays on HTTPS, and an HSTS header is set. The exact certificate expiry date isn't visible to an outside fetch. Read-only: one run of GET requests only; never logs in, adds to cart or submits forms. Nothing is monitored or saved. A bare hostname is fine; URL paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`check_store`Check a public WooCommerce store from the outside: is it reachable, is HTTPS valid and are redirects sane, is WooCommerce detected, do /cart/ and /checkout/ load, and are payment markers visible on checkout. Read-only: GET requests only, never adds to cart, logs in or submits forms. Returns pass/warn/fail findings. Pass a bare hostname or URL; paths are ignored and the host's homepage is checked.	Check a public WooCommerce store from the outside: is it reachable, is HTTPS valid and are redirects sane, is WooCommerce detected, do /cart/ and /checkout/ load, and are payment markers visible on checkout. Read-only: GET requests only, never adds to cart, logs in or submits forms. Returns pass/warn/fail findings. Pass a bare hostname or URL; paths are ignored and the host's homepage is checked.	No	Yes	Yes	Yes
`explain_finding`Explain a finding code returned by any Store Canary tool (for example ssl_hsts or exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.	Explain a finding code returned by any Store Canary tool (for example ssl_hsts or exposure_debug_log) in plain words, with a suggested fix. Makes no network requests.	No	Yes	Yes	No

Details

Registry status: Active
Published: Oct 30, 2026
Updated: Oct 30, 2026
Website: https://storecanary.app/mcp⁠ (opens in a new tab)
Repository: https://github.com/erikras/store-canary-mcp⁠ (opens in a new tab)
Categories (suggested): E-commerceSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing