mcp-pagespeed-insightsSAFE
Google PageSpeed Insights — runs Lighthouse against any public URL and returns the performance scores, the real-user field data, and the ranked list of fixes.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Google's PageSpeed Insights — runs Lighthouse against any public URL on Google's own infrastructure and returns the performance/accessibility/best-practices/SEO scores, the lab timing metrics behind them, and the ranked list of specific fixes with the milliseconds or bytes each would save; plus the real-user Chrome UX Report data for that page and its origin.
Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.
Tools
pagespeed_audit(url, strategy?, categories?, max_opportunities?, locale?)—
the lab run and its ranked opportunities.
pagespeed_field_metrics(url, strategy?)— real-user Core Web Vitals for the
page and its origin, with Google's pass/fail verdict.
Auth
BYO with platform fallback: _apiKey, or PLATFORM_GOOGLE_API_KEY when that secret is set on the gateway.
The documented keyless path exists but is unusable. Unkeyed requests are billed to a single shared Google anonymous consumer project whose daily quota is exhausted — three consecutive unkeyed calls returned HTTP 429, "Quota exceeded ... for consumer 'project_number:583797351490'" (verified live 2026-09-17). That project number is the same for every anonymous caller on the internet, so the quota is not ours to nurse and retrying does not help. The pack tries keyless first and refuses with wording that says a key is required.
A key is free, instant and needs no billing account: create one at and enable the PageSpeed Insights API at . Quota is 25,000 requests/day, 240/minute. The same key serves the chrome-ux-report pack.
Relationship to the chrome-ux-report pack
chrome-ux-report reports what real visitors experienced; it cannot tell you why, because field data carries no diagnostics. This pack runs the page and names the causes. Use crux for "
e407ec636aa0OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-pagespeed-insights -- npx -y @pipeworx/[email protected]
{
"mcpServers": {
"mcp-pagespeed-insights": {
"command": "npx",
"args": [
"-y",
"@pipeworx/[email protected]"
]
}
}
}Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
pagespeed_audit | write | Run Google |
pagespeed_field_metrics | read | Real-user Core Web Vitals for a page AND for its whole origin in one call, from Google |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
e407ec636aa0full audit observations/trust-audit/mcp-server/pipeworx-io__mcp-pagespeed-insights.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | e407ec636aa0 | SAFE | B | 89 | first audit |
Questions
What is the mcp-pagespeed-insights MCP server?
Google PageSpeed Insights — runs Lighthouse against any public URL and returns the performance scores, the real-user field data, and the ranked list of fixes.
What tools does mcp-pagespeed-insights expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-pagespeed-insights safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-pagespeed-insights need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-pagespeed-insights run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-pagespeed-insights at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (e407ec636aa0), read on 2026-10-11. The repository is watched and re-audited when it changes.