MCP server

Connect Claude, Cursor or any MCP client to Seolyticize, by signing in or with an API key.

Embed
Preview of the card
<a href="https://seolyticize.com/docs/mcp-server"><img src="https://seolyticize.com/docs/_api/public/orgs/71cb2b7a-a719-4003-b3ea-6321dc1db8ab/spaces/3bf2dbf7-3faa-473c-ba3b-30588f5f8de4/pages/8e9414b3-aecb-4950-b85b-6c30844aebe9/social-card.svg?v=3e7ae33eec8b" alt="MCP server" width="600" height="315"></a>

The same tools are served over the Model Context Protocol, so an AI assistant can research keywords, read rankings, audit a site and draft a client report using your agency's data.

https://seolyticize.com/api/mcp

The server speaks Streamable HTTP and is stateless: every request carries its own credential, so there is no session to lose when a server restarts, and a revoked credential stops working on its very next message. An assistant is shown only the tools its credential may run, and each tool is marked read-only or not, so the host knows which ones to confirm with you first.

There are two ways to connect.

Sign in (OAuth)

Clients that support MCP sign-in need no key. The first time a tool is used, the client opens a browser; you sign in to Seolyticize and choose:

  • the agency it may act for;

  • what it may do — a role, at most your own (client_viewer, analyst, manager or admin);

  • which clients — every client, or just one. An admin connection is always agency-wide.

The connection then appears under Settings → Connected apps, where you can disconnect it at any time.

claude mcp add --transport http seolyticize https://seolyticize.com/api/mcp

Claude Code signs in through the browser the first time a Seolyticize tool runs.

What happens underneath, for anyone writing their own client:

Step

Detail

Discovery

An unauthenticated request gets 401 with WWW-Authenticate naming the protected-resource metadata (RFC 9728), which names the authorization server (RFC 8414).

Registration

Dynamic client registration at /oauth/register (RFC 7591). Public clients only: token_endpoint_auth_method: none.

Authorization

Authorization code flow with PKCE S256 required, at /oauth/authorize; tokens from /oauth/token. Scope: mcp.

Tokens

Access tokens last one hour. Refresh tokens last 30 days and rotate: each use returns a new pair and retires the old one.

If the person who approved a connection loses access to the agency, or their role falls below what they granted, the connection stops working at its next token exchange.

API key

Clients without MCP sign-in send an API key as a bearer token instead. Make the key under Settings → API keys; pin it to one client if the assistant only works for one customer.

claude mcp add --transport http seolyticize https://seolyticize.com/api/mcp \
  --header "Authorization: Bearer $SEOLYTICIZE_API_KEY"

Limits and costs

MCP calls share the key's rate limit with REST — 600 requests a minute per key — and follow the same rules on spending. A well-behaved assistant quotes a paid call with estimate_cost before making it and passes the quote as maxCostMicros; see Costs and spending limits.

Running it over stdio (self-hosted)

For people running Seolyticize themselves: a checkout of the repository can serve the same tools as a local stdio server. It connects directly to the database and services named in the repository's .env, so it only works where those are reachable — everyone else should use the hosted endpoint above.

SEOLYTICIZE_API_KEY=sk_seo_… pnpm --filter @seolyticize/web mcp
{
  "mcpServers": {
    "seolyticize": {
      "command": "pnpm",
      "args": ["--filter", "@seolyticize/web", "mcp"],
      "env": { "SEOLYTICIZE_API_KEY": "sk_seo_..." }
    }
  }
}

The key decides the whole session's reach: a key pinned to one client exposes exactly that client.

Next

Once connected, the Agent playbooks walk an assistant through the whole job, from setting up the agency to the weekly pass over each client.

Updated