Vergate is an all-in-one platform for vibecoders that combines security scanning (passive + active ZAP), performance analysis (Lighthouse), SEO/AEO optimization, accessibility audits (axe-core), technology profiling, uptime monitoring, and MCP integration — all in a single dashboard.

How fast is Vergate's passive scanning?

Vergate runs 50+ security checks including headers, CORS, cookies, server disclosures, exposed files, and technology profiling in under 5 seconds. Results are instant.

Does Vergate support active scanning?

Yes. Vergate integrates OWASP ZAP in isolated ephemeral containers for full active crawling and automated security checking — SQL injection, XSS, open redirects, and more. Containers are destroyed after each scan.

What is MCP and how does Vergate use it?

MCP (Model Context Protocol) lets AI coding assistants like Claude Code, Cursor, and Windsurf talk directly to Vergate. Our MCP server ships with 17 tools covering scans, profiling, performance, SEO, accessibility, deliverability, integrations, and badges — available via stdio or HTTP transport.

Does Vergate check SEO and accessibility?

Yes. Vergate runs SEO analysis with Playwright rendering for JS-heavy SPAs, AEO (Answer Engine Optimization) checks for AI search engines like GPTBot and ClaudeBot, and WCAG 2.1 AA accessibility audits using axe-core. All results include AI-powered fix suggestions.

What integrations does Vergate support?

Vergate connects to 10 providers: GitHub, Vercel, Netlify, Supabase, Cloudflare, Firebase, Railway, Stripe, Fly.io, and Render. Each integration runs provider-specific security analysis — checking branch protection, SSL modes, env var exposure, API key hygiene, and more.

Coming Q3 2026 — Beta Open Soon

Security, performance & SEO
all in one place. Built for vibecoders.

Scan for vulnerabilities, measure Core Web Vitals, optimize for AI search engines, audit accessibility, profile your stack, and monitor uptime — all from a single dashboard. Passive checks in seconds. MCP integration included.

app.vergate.dev/project/demo/dashboard

Project: api.vergate.dev

Last scan: 2 minutes ago

All Modules Complete

Security Checks

118

Performance

SEO Score

Accessibility

[SYSTEM] Initializing scan engine for api.vergate.dev...

[PASSIVE] CORS check: OK. Access-Control-Allow-Origin restricted.

[PASSIVE] HSTS header verified: max-age=63072000

[PERF] Lighthouse desktop: Performance 92, LCP 1.2s, CLS 0.01

[SEO] 18/20 checks passed. Structured data valid.

[A11y] axe-core: 0 critical, 0 serious violations

[TECH] Profiled: Next.js, Vercel, React, Stripe, PostHog

[WARN] Server header leaks version: nginx/1.24.0

Scan Run History (Last 30 Days) 100% Passed

Everything your site needs.
One platform.

Security scanning, performance monitoring, SEO optimization, accessibility audits, and more — all built for the vibecoder workflow.

Passive Scanning

50+ security checks — headers, CORS, cookies, exposed files, server disclosures, information leaks — all in under 5 seconds.

Active ZAP Scanning

SQL injection, XSS, open redirects — OWASP ZAP runs in isolated ephemeral containers. Destroyed after each scan. Zero state leakage.

OpenAPI Discovery

Auto-discovers your OpenAPI spec, parses endpoints, and injects ZAP requestor jobs. No manual config needed.

Technology Profiling

50 built-in detectors plus WhatWeb with 1,800+ plugins. Identifies frameworks, hosting, CDN, analytics, auth, payments, and UI libraries.

Performance Analysis

Lighthouse-powered Core Web Vitals (LCP, TBT, CLS, FCP, SI) plus 11 HTTP resource quality checks. AI-powered fix suggestions for every failing metric.

SEO & AEO Analysis

20+ SEO checks with Playwright rendering for JS-heavy SPAs. 26 AEO checks for AI search engines — GPTBot, ClaudeBot, PerplexityBot access, structured data, citation quality.

Accessibility Audits

WCAG 2.1 AA compliance via axe-core and Playwright. Color contrast, ARIA, semantic HTML, keyboard navigation — grouped by impact with CSS selectors.

Email Deliverability

9 DNS checks — SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, DNSSEC, BIMI, DANE. Weighted scoring with pass/fail/warn for each record.

10 Integrations

GitHub, Vercel, Netlify, Supabase, Cloudflare, Firebase, Railway, Stripe, Fly.io, Render — each with provider-specific security analysis.

Integration Security

Scans your connected providers for misconfigurations — branch protection, SSL modes, env var exposure, API key hygiene, WAF rules, and more.

MCP Integration

17 tools for AI coding assistants — Claude Code, Cursor, Windsurf. Scan, profile, analyze, and verify directly from your editor. Stdio + HTTP transports.

Uptime Monitoring

60-second health checks, response time tracking, downtime alerts. Passive re-scans detect regressions. Exposure checks for git, ports, and subdomain drift.

Built for the modern API terminal.

Run scans from your shell, integrate with CI/CD, or connect via MCP — 17 tools for AI coding assistants.

curl -X POST https://api.vergate.dev/api/v1/scan \
  -H "Authorization: Bearer pk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourtarget.com", "max_depth": 2}'

Calm, reliable infrastructure.

Isolated scan containers. Background workers via RabbitMQ. PostgreSQL-backed results. Sentry error tracking. Check our live status below.

All services operational

99.98% overall uptime

Scan API Gateway 99.99%

Isolated ZAP Scan Workers 99.96%

MCP Server (stdio + HTTP) 99.99%

Security, performance & SEOall in one place. Built for vibecoders.