ObservePoint launches an MCP server to audit websites from Claude

Ask "what audits do I have running right now?" and get the answer without opening the ObservePoint dashboard. That is the example the company uses to present its MCP server, whose launch was reported by MarTech Cube on 12 October. The server is available at `https://mcp.observepoint.ai/v1` and connects the platform to assistants compatible with the Model Context Protocol.

For those unfamiliar with it, ObservePoint is a web governance tool. It checks that analytics tags fire correctly, that cookies and tracking scripts match what the privacy policy declares, that the consent banner blocks tracking when the visitor opts out and that pages meet accessibility criteria. This is work for analytics, marketing and compliance teams, not for AI developers.

What it lets you do

According to the connection documentation, the server exposes a closed set of tools:

Query running audits and review their results and rules.
Review Journey results, the automated flows that simulate a user's navigation.
Analyse HAR files, up to 15 per request and 300 MB each.
Create, run or delete scans, always with user confirmation.
Manage users, only from accounts with an admin role.
Pull paginated reports of between 10 and 10,000 rows per page; large results are truncated.

The guide lists Claude Code, Claude.ai, Cursor, VS Code, Codex and ChatGPT as example clients. It is worth remembering that running a full audit from the assistant consumes the same scan quota as doing it from the web app.

Security: what is well handled

Authentication follows the path you would expect today from a serious remote MCP server: OAuth 2.1 with PKCE and Dynamic Client Registration. The ObservePoint password never passes through the AI client, and access tokens are short lived and refresh automatically.

The security and trust page adds two relevant points. First, every request is authenticated as a specific user and inherits that user's role permissions, so the assistant cannot do anything that person could not already do on the web. Second, the server introduces no new subprocessors: it runs on the same AWS infrastructure and calls the existing API.

There is one nuance ObservePoint itself puts in writing, and it deserves emphasis. Whatever the assistant receives falls under the AI vendor's data processing agreement, not ObservePoint's. If an audit returns internal URLs, cookie names or client configuration data, that information travels to Anthropic, OpenAI or whoever applies. For a tool whose value is precisely privacy compliance, that is not a minor detail.

Why it matters

What is interesting is not that another SaaS platform has an MCP server, which by now is almost expected. What is interesting is the type of task. Working out why a conversion tag stopped firing after a deployment, or whether the consent banner still blocks what it should, usually means jumping between the audit dashboard, an exported HAR and the tag manager documentation. With the server connected to Claude Code, that investigation can happen in the same session where the site's code is being edited, cross-checking the audit result against the repository.

It also fits a pattern we see in other martech tools: the assistant does not replace the dashboard, it reduces how often you need to open it for one-off questions.

Who it is useful for

Analytics and measurement teams that already use ObservePoint and want to query audits without switching tools.
Agencies that manage tagging for several clients and need to diagnose issues quickly after each deployment.
* Privacy leads who want to check consent behaviour with specific questions, as long as they are clear about where the data goes.

For anyone without an ObservePoint account, the server adds nothing. It is a door into a paid platform, not a standalone tool.

Our take

As an agency that reviews tracking and consent every day, we see this as a sensible integration with well designed permissions. Before connecting it to an assistant, we would check which client accounts end up exposed and under which data agreement, because that is where the real risk lies.