/ mcp
Hand the compliance failures to the agent that wrote them.
Syrcha runs a hosted MCP server. Your coding agent can list your sites, read exactly which rules are failing and why, pull the evidence, and trigger a rescan once the fix ships.
Free on every tier - including the tiers where our REST API is not.
- Transport
- Streamable HTTP
- Auth
- OAuth 2.1
- Tools
- 5
- Destructive verbs
- None
- Install
- Nothing to install
- Price
- Free, all tiers
ccpa-012 · weight 9
No "Do Not Sell or Share My Personal Information" link on 4 pages
fix: add the link to the global footer, label matched verbatim
gdpr-004 · declaration-blocked
Jurisdiction not declared - cannot be fixed in code
/ the loop
Find it, fix it, prove it - without leaving the editor.
01
Ask what is failing
One entry per failing rule, ordered by weight so the agent starts where the score actually moves. Not one row per rule per page - a missing consent banner on twenty pages is one fix, not twenty.
02
Read the evidence
The selector, the snippet and the reason behind a finding, so the agent edits the right element instead of guessing from a rule name.
03
Ship the fix
The part we stay out of. Your agent works in your codebase, with your review process.
04
Trigger the rescan
Returns immediately with a scan id rather than blocking for minutes. Every later read states its own freshness, so the agent knows whether it is looking at the fix or at the run before it.
Findings that cannot be fixed in code come back tagged as such. GDPR applicability is something you declare, never something we infer from your pages - so an agent handed that row untagged would try to fix it by editing files, forever. It is marked declaration-blocked instead, and pointed at the setting that resolves it.
/ tools
Five tools. No resources, no prompts.
The tool list is a deliberate subset of our REST API rather than a mirror of it. Everything an agent needs to close the loop, and nothing it needs to be trusted with.
list_websitesreadThe sites on your account, with their verification state.
get_failing_rulesreadFailing and undetermined rules for the latest completed scan, weight-ordered, each with remediation guidance and an affected-page count.
get_rule_evidencereadThe captured evidence behind one finding - selector, snippet, context.
trigger_scanwriteQueue a rescan. Returns a scan id immediately; never blocks.
create_websitewriteAdd a site and return the verification TXT record to publish.
/ the fence
What it deliberately cannot do.
Pointing an autonomous agent at a service that holds your account is a real decision, and the honest way to make it easier is to narrow what the credential can reach rather than to reassure you about it.
There is no delete verb, no billing surface, no user administration and no way to reach the rest of the API through this connection. A rescan and a new site are the only writes that exist, because those are the two the loop genuinely needs.
Every tool call is one audited request with its own request id, exactly like an API call - so if you ever want to know what your agent did, the log is the same log.
Out of scope
- Deleting anything
- Reading or changing billing
- Managing users or tokens
- MCP resources and prompts
- The wider REST API
/ connect
A browser click, not a pasted secret.
The server is hosted, so there is nothing to install and nothing to keep up to date. Your client registers itself and you approve the connection in the browser - no token ever passes through your clipboard.
01
Open Agent (MCP)
In your Syrcha dashboard. It shows the endpoint and the clients that are connected.
02
Add it to your client
Claude, Cursor, or anything else speaking MCP over streamable HTTP.
03
Approve in the browser
The grant becomes a scoped connection you can revoke from the same panel.
Your agent broke it. Let it read the finding.
Free tier, one domain, weekly scans, no card. The MCP server is included at every tier.