passive security & quality audit for sites built with ai

About Plat.one

Server racks in a data center, representing the backend infrastructure Plat.one audits

Plat.one is a free tool built and operated by Semalt, an SEO company founded in 2013 and headquartered in Kyiv, Ukraine, with offices in the UK, Georgia, and Uruguay. Semalt runs AutoSEO and FullSEO campaigns, Search Console and SERP analytics, and AI-visibility tracking for 25,000+ active clients — this tool applies the same technical-audit rigor we use for client sites to the wave of apps shipped with Lovable, Bolt, Replit, v0, and similar AI builders.

Founded 2013
Twelve years building SEO and content-audit products, not a one-off script.
120+ team members
Dedicated SEO, engineering, and data teams behind the platform this tool runs on.
25,000+ clients
The same audit rigor this tool applies for free feeds our paid SEO campaigns.

How it works

Every check is a passive, unauthenticated GET request to what a site already serves publicly — headers, TLS, common sensitive file paths, and same-origin CSS/JS it links to — plus one layer of real headless-Chromium rendering (via Playwright, sandbox on) for contrast, Core Web Vitals, and keyboard-focus visibility. Detected JS libraries are matched against OSV.dev's public vulnerability database. Full breakdown of all 54 checks is on the homepage; each finding on a report links straight to the fix.

Data handling

The URL you submit and the findings we generate are processed to build your report and kept so the report page stays reachable later, at a private, unguessable link — we don't list scanned URLs or report links anywhere on the site. Report pages are marked noindex so search engines don't index them either. Still, treat the link itself as sensitive if the findings would be: anyone who has it can open the report. Secret-looking strings we detect are shown masked (first/last few characters only), never in full. We don't use cookies, accounts, or analytics trackers on Plat.one. Want a report taken down? See Contact below.

MCP server

Plat.one is also an MCP (Model Context Protocol) server, free, no API key — call audit_url straight from Cursor or Claude Code instead of opening a browser. The endpoint is a Streamable-HTTP MCP connection, not a browsable page, so it won't load if you click it directly — add it to your client's MCP config instead:

{
  "mcpServers": {
    "plat-one": { "url": "https://plat.one/mcp" }
  }
}

Contact

Company

Semalt LP
Suite 4023 Mitchell House, 5 Mitchell Street, Edinburgh, Scotland, EH6 7BD