SEO Monster MCP Server

Findings (12)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  cryptography@48.0.0: 4 known vulnerabilities

  PYSEC-2026-3552, PYSEC-2026-3553, PYSEC-2026-3554, GHSA-537c-gmf6-5ccf

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  httplib2@0.31.2: 1 known vulnerability

  PYSEC-2026-3444

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  mcp@1.27.1: 7 known vulnerabilities

  PYSEC-2026-3481, PYSEC-2026-3482, PYSEC-2026-3483, GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv +2 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  oauthlib@3.3.1: 4 known vulnerabilities

  PYSEC-2026-4113, PYSEC-2026-4114, GHSA-3jp2-3mrg-2vxc, GHSA-7984-qgvg-3j9c

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  pyasn1@0.6.3: 7 known vulnerabilities

  PYSEC-2026-3455, PYSEC-2026-3456, PYSEC-2026-3457, GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39 +2 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  python-multipart@0.0.29: 4 known vulnerabilities

  PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3040, PYSEC-2026-3041

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  starlette@1.1.0: 2 known vulnerabilities

  PYSEC-2026-248, PYSEC-2026-249

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  urllib3@2.7.0: 3 known vulnerabilities

  PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  pydantic-settings@2.14.1: 1 known vulnerability

  GHSA-4xgf-cpjx-pc3j

  uv.lock

Network activity

Tools exposed (70)

• system_status

  Report which SEO services are configured and reachable, the Google auth method and scopes, whether destructive mode is enabled, and the full catalog of available tools grouped by service. Call this first if unsure what is set up. Pass probe=true to confirm credentials work via one cheap live call pe

• gsc_list_properties

  List every Search Console property the configured credentials can see, with each property's permission level. Use this to discover valid site_url values.

• gsc_search_analytics

  Query Search Console search analytics (clicks, impressions, CTR, position) for a property, with dimensions, a date range, optional dimension filters, and data_state. The workhorse GSC tool.

• gsc_top_queries

  Convenience wrapper: top queries for a property over the last N days by clicks. Equivalent to gsc_search_analytics with dimensions=["query"]. Uses the configured data_state (default 'all'; 'final' lags 2-3 days behind the dashboard).

• gsc_top_pages

  Convenience wrapper: top pages for a property over the last N days by clicks. Equivalent to gsc_search_analytics with dimensions=["page"]. Uses the configured data_state (default 'all'; 'final' lags 2-3 days behind the dashboard).

• gsc_compare_periods

  Compare two equal-length time windows (current vs prior) and return per-key deltas in clicks, impressions, CTR, and position, plus keys present in only one window. v0.2.0: optional sort_by / sort_dir / min_delta_* filters and an anomalies_only z-score gate so the same tool covers 'biggest gainers',

• gsc_inspect_url

  Inspect a single URL via the URL Inspection API: index verdict, coverage state, crawl info, canonicals, and mobile/rich-results summaries when present.

• gsc_batch_inspect_urls

  Inspect several URLs in one call (capped at 25). Returns a result per URL plus a list of per-URL failures. Rate-limit and transient errors are reported per URL without failing the whole batch.

• gsc_list_sitemaps

  List the sitemaps Google knows about for a property, with submission and indexing status.

• gsc_submit_sitemap

  Submit a sitemap to Search Console. Requires the writable webmasters scope. Available by default (a routine SEO task; not gated). Accepts either `sitemap_url` (preferred, friendly name) or `feedpath` (the raw API field name; kept for back-compat).

• gsc_request_indexing

  Ask Google to (re)crawl one or more URLs via the Indexing API (URL_UPDATED). Requires the indexing scope. Available by default. Accepts a single `url` (string) or `urls` (array up to 100). A scope or disabled-API error stops the batch and is returned with remediation; per-URL errors are collected. `

• gsc_query_opportunities

  Queries already ranking in the top N positions but with below-target CTR. These are title and meta-description optimization candidates. Returns rows sorted by impressions desc (the bigger the impression volume, the more clicks a CTR lift unlocks).

• gsc_query_gaps

  Queries that drive impressions but very few clicks. These are content opportunity signals: a page is being shown for the query, the click experience is not landing. Returns rows sorted by impressions desc.

• gsc_new_queries

  Queries that have impressions in the current window but had no impressions in the prior comparison window. Useful for spotting emerging topics or pages that just started ranking.

• gsc_top_pages_by_query

  Which pages rank for a specific query. The classic cannibalization audit input: if multiple pages rank for the same query, you typically want to consolidate or differentiate them. Filters search_analytics by an exact query match and returns rows by page dimension.

• gsc_portfolio_summary

  Multi-property fleet view. Lists every property the credentials can see and returns a one-row summary per property (total clicks, impressions, average CTR, average position) for the last N days. The single fastest answer to 'how is the portfolio doing?' across agency or multi-brand setups. Honors th

• gsc_trending_pages

  Pages whose impressions grew most over the last N days vs the prior N days. Equivalent to `gsc_compare_periods` with `dimensions=["page"]`, `sort_by="delta_impressions"`, `sort_dir="desc"`. Use this for lifecycle triage (find pages to invest in or rescue).

• gsc_decaying_pages

  Pages whose impressions fell most over the last N days vs the prior N days. Equivalent to `gsc_compare_periods` with `dimensions=["page"]`, `sort_by="delta_impressions"`, `sort_dir="asc"`. Use this for lifecycle triage (find pages to invest in or rescue).

• gsc_coverage_audit

  Heuristic coverage audit. The GSC Index Coverage report is NOT exposed in the public API, so this tool takes a user-supplied URL list (typically pulled from a sitemap) and bulk-inspects each, then rolls up the verdicts (PASS / PARTIAL / FAIL plus coverage_state frequencies). Honest substitute for th

• ga4_run_report

  Run a GA4 report (Analytics Data API runReport) with arbitrary dimensions, metrics, a date range, an optional dimension filter, and ordering. The workhorse GA4 tool. Dates accept ISO (YYYY-MM-DD) or GA4 relatives like '28daysAgo' and 'today'.

• ga4_top_landing_pages

  Top landing pages by sessions over the last N days, with engagement rate and conversions. Filtered to organic search by default (the SEO view). Convenience wrapper over ga4_run_report.

• ga4_traffic_by_channel

  Sessions, engaged sessions, and conversions broken down by default channel group over the last N days. Separates organic from paid / referral / direct at a glance. Convenience wrapper over ga4_run_report.

• ga4_organic_search_overview

  Organic-search health over the last N days: window totals (sessions, engaged sessions, engagement rate, average session duration, conversions) plus a day-by-day trend of the same metrics. Two GA4 reports under the hood.

• ga4_setup_audit

  Audit a GA4 property's configuration for SEO-measurement readiness (read-only): is a web data stream present, are key events / conversions defined, is data retention long enough for year-over-year analysis, are content-group custom dimensions set, and (via v1alpha) is enhanced measurement on and wha

• ga4_site_search

  Internal site-search terms over the last N days: what visitors typed into the on-site search box (GA4 'searchTerm'), by event count and sessions. A direct content-gap signal. If the property has no site-search data (no search box, or enhanced-measurement site search is off), the tool says so honestl

• ga4_landing_page_conversions

  Landing pages with their conversions / key events over the last N days, broken down by channel group and sorted by conversions descending. Filtered to organic search by default (the SEO view) so you see which entry pages actually drive organic outcomes. Convenience wrapper over ga4_run_report.

• psi_analyze

  Run PageSpeed Insights on a URL and return Lighthouse category scores, lab Core Web Vitals (synthetic), and field Core Web Vitals (real-user CrUX) when available. Defaults to the mobile strategy (Google ranks on mobile).

• psi_opportunities

  Run PageSpeed Insights and return the actionable Lighthouse opportunity audits (estimated load-time savings) plus the Lighthouse SEO-category audits graded by severity (critical/high/medium/low). Lab data only; does not use field/CrUX data (use crux_snapshot / crux_history for real-user metrics). De

• cf_list_zones

  List the Cloudflare zones the API token can see, with status, plan, and id.

• cf_zone_info

  Zone overview for a hostname: status, plan, paused, name servers, created/modified.

• cf_list_dns

  List DNS records for a zone (read-only). Useful for verifying the canonical host, CNAME flattening, and TXT verification records during SEO migrations.

• cf_web_analytics

  Read-only Cloudflare Web Analytics (edge RUM). With no argument, lists the account's Web Analytics sites; with host_or_tag, returns one site's detail. Edge-measured traffic complements GA4 (it sees visits GA4's JS tag may miss). Create/delete are intentionally not exposed.

• cf_purge_cache

  Purge specific URLs from the Cloudflare cache so crawlers refetch updated content. Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true.

• cf_purge_cache_all

  Purge the entire Cloudflare cache for a zone (affects all visitors). Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true AND a confirm value equal to the resolved zone hostname, so a full purge cannot fire ambiguously.

• cf_settings_audit

  Audit a Cloudflare zone's settings for SEO and crawl/index safety (read-only): SSL/TLS mode, Always Use HTTPS, HSTS, Automatic HTTPS Rewrites, Brotli, and browser cache TTL. Findings are severity-graded with the reason and a benign exception each. Cloudflare cannot see the origin, so the SSL and Alw

• cf_list_redirects

  List a zone's single (dynamic) redirect rules (source, target, status code, rule id) plus the account's Bulk Redirect lists (read-only). Call this before cf_create_redirect / cf_delete_redirect / cf_bulk_redirect_upsert so writes never clobber existing rules. Pairs with redirect_chain_audit and the

• cf_create_redirect

  Create one single (dynamic) redirect at the Cloudflare edge (e.g. a 301 for a renamed/migrated URL). Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true. Validates the target is reachable (no redirecting to a dead URL), refuses loops and duplicates, and supports dry_run to preview the rule first.

• cf_delete_redirect

  Delete one single (dynamic) redirect rule by its id (the rollback path for cf_create_redirect). Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true. Get the rule id from cf_list_redirects.

• cf_bulk_redirect_upsert

  Create or append many redirects at once via an account-level Bulk Redirect List (for site migrations). Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true AND a confirm value equal to list_name. Validates every item locally first and rejects the whole batch on any bad item (never half-applies); supports

• cf_settings_update

  Write the SEO/crawl/security Cloudflare zone settings that cf_settings_audit grades, to close the audit -> remediate loop. Gated: requires SEO_MCP_ALLOW_DESTRUCTIVE=true. Changing ssl_mode, or any HSTS change that raises protection, additionally requires confirm=<zone> (HSTS also requires acknowledg

• cf_managed_robots

  Get / configure / disable Cloudflare's managed robots.txt and Content-Signals policy on a zone (rides on the Bot Management config). action='get' reads the current state (read-only, un-gated). action='configure' enables/sets the managed robots.txt (managed_robots), the Content-Signals variant (cf_ro

• indexnow_submit

  Submit a single URL to IndexNow (Bing + Yandex + Naver + Seznam + Yep). Complements gsc_request_indexing for the non-Google engines. Requires SEO_MCP_INDEXNOW_KEY plus a key-verification file at https://<host>/<key>.txt.

• indexnow_bulk_submit

  Submit multiple URLs to IndexNow in one batched request. All URLs must share the same host (IndexNow rejects mixed-host batches with HTTP 422). Cap: 10000 URLs per call (IndexNow's documented limit).

• inspect_meta

  Fetch a single URL and return its on-page SEO surface: title, meta description, meta robots, canonical, Open Graph + Twitter Card tags, hreflang list, and the H1 count. Read-only HTTP GET.

• check_canonical

  Fetch a URL and analyse its canonical link tag: report whether it is self-referential, cross-host, protocol-mismatched, or trailing-slash drift; flag missing canonical, and follow one canonical hop to confirm it itself returns 2xx.

• mixed_content_check

  Fetch an HTTPS page and report any sub-resource references that use plain http:// (img/script/iframe/form action/anchor href). Mixed content blocks browsers from running scripts and triggers warnings on user-facing pages. No-op for http:// pages (returns 'not_https').

• redirect_chain_audit

  Walk the redirect chain for a URL without auto-following 3xx. Returns every hop (status, location, elapsed_ms) and flags issues: chain longer than 1, mixed-protocol hops (https -> http), loops, or non-2xx terminus. Cap defaults to 10 hops.

• robots_txt_validate

  Fetch /robots.txt for a site, parse user-agent groups + Allow/Disallow + Crawl-delay + Sitemap, and return the structured ruleset. Optionally probe a list of (user_agent, url) pairs and return per-probe allow/deny verdicts using RFC 9309 longest-match.

• robots_ai_posture

  Recommend a Content-Signals posture (search / ai-input / ai-train) from a business goal and emit a ready-to-apply artifact: the Content-Signal directive line plus a full suggested robots.txt. Read-only, offline, deterministic - no network, no writes. Always returns the trade-off alternatives and the

• sitemap_validate

  Fetch a sitemap or sitemap-index URL, validate its XML structure, count entries, and flag oversize (>50,000 URLs or >50 MiB), missing <lastmod>, and entries whose host does not match the sitemap host. Handles .gz transparently.

• sitemap_health

  Sample N URLs from a sitemap (or one level deep in a sitemap index) and HEAD-check each. Aggregates a status-code histogram and lists the first few non-2xx URLs so you can triage broken entries fast.

• crux_history

  Return the last 25 weekly collection periods of Core Web Vitals at p75 (LCP, INP, CLS, etc.) for a URL or origin via the Chrome UX Report History API. Complements psi_analyze with the trend axis.

• crux_snapshot

  Return the CURRENT (latest 28-day) p75 Core Web Vitals snapshot (LCP, INP, CLS, FCP, TTFB) for a URL or origin via the Chrome UX Report queryRecord API, with each metric's GOOD/NEEDS_IMPROVEMENT/POOR category and an overall verdict. Use crux_history for the 25-week trend. Small pages/origins legitim

• inspect_schema

  Extract every JSON-LD block from a page and report the schema.org @type counts plus a sample entity per type. Discovery tool: tells you what structured data exists. Pair with validate_schema to check required-field compliance.

• validate_schema

  Validate every JSON-LD block on a page against the Google Rich Results required-field set. Per-entity verdict (pass/fail) and a list of missing required + recommended fields. Covers Article, NewsArticle, BlogPosting, Product, FAQPage, BreadcrumbList, Organization, LocalBusiness, Event, Review, Recip

• hreflang_consistency_check

  Validate hreflang link tags across a set of URLs. Checks: missing reciprocity, broken target URLs, duplicate hreflang on one page, missing self-link, missing x-default when there are 3+ language variants. Returns per-URL findings and a global findings list.

• internal_link_graph

  Small BFS crawl from a starting URL within the same host. Returns per-page in-degree + out-degree, orphan pages (zero in-degree), broken internal links (4xx/5xx), and depth distribution. Hard caps: max_depth ≤ 4, max_pages ≤ 200. Not a replacement for a full crawler; sized for in-session triage.

• lighthouse_budget

  Run PageSpeed Insights on a URL and verdict the results against a performance budget. Valid budget keys: higher-is-better Lighthouse scores on a 0-100 scale ('performance', 'accessibility', 'best-practices', 'seo'); lower-is-better latency in milliseconds ('LCP_ms', 'FCP_ms', 'TBT_ms', 'TTI_ms', 'sp

• content_opportunities

  Rank data-grounded content/blog topics from your own Search Console data. Fuses CTR-vs-expected gap, striking-distance position, demand volume, and momentum into a transparent opportunity score, flags cannibalization, and reports the click upside plus the score's components. Read-only. It prioritize

• ai_citation_readiness

  Score whether a page is structured to be extracted and cited by LLM answer engines (ChatGPT, Perplexity, Claude, Google AI Overviews). Leads with a render-blindness check (AI crawlers do not run JS, so a client-rendered SPA is invisible to them), then scores evidence-backed signals: statistics, quot

• ai_referral_overview

  First-party view of AI traffic: (1) referral sessions from AI apps (ChatGPT, Perplexity, Gemini, Copilot, Claude, ...) via GA4, detected by both the native ai-assistant channel and a source-host regex; and (2) AI-crawler coverage -- whether robots.txt lets GPTBot, ClaudeBot, PerplexityBot, etc. reac

• gsc_keyword_expand

  Ground LLM-brainstormed keyword candidates against your own Search Console data to find net-new terms you have no current footprint on. YOU (the host) supply `candidates` -- brainstorm them from the site's winning queries first (call gsc_top_queries). For each candidate this returns a footprint verd

• internal_link_recommend

  Recommend specific internal links (source page -> target page, with anchor text) from high-authority pages to striking-distance pages. Crawls from start_url for the internal link graph (authority + existing links) and uses GSC to find striking-distance targets (default position 8-20 with real impres

• rank_change_attribution

  Estimate whether an on-site change moved a page's clicks, using difference-in-differences against a control group of untouched pages (never a naked before/after). Returns an estimated lift with a 95% confidence interval and a three-state verdict (likely_positive / likely_negative / inconclusive), pl

• topic_cluster_map

  Map a content cluster from your own Search Console data and surface missing subtopics. Define the cluster by cluster_path (a URL path prefix) or pillar_url. For each query the cluster's pages show for, classifies it into defend / optimize / create / monitor by demand and best position, flags canniba

• content_brief_data

  Gather the hard evidence for a content brief: fetch the competitor pages and return their heading union, median word count (a FLOOR, not a target), schema types, and entity coverage, plus the 2026 GEO writing directives and validation rules. Pass competitor_urls (e.g. the top SERP results) for a tru

• serp_adjacency_expand

  Expand seed terms into adjacent terms from SERP signals. FREE core: Google Autocomplete (no key). Optional PAA + related-searches via DataForSEO if configured. Pass your winning queries as `seeds` (seed from gsc_top_queries). Returns per-seed suggestions plus the aggregated net-new terms (suggestion

• keyword_universe

  External keyword data (optional, paid). Its core value is the COMPETITOR keyword GAP: keywords competitors rank for that you don't (DataForSEO Domain Intersection; no Google equivalent). Optionally returns search volume/difficulty/intent for a keyword list via a provider chain (DataForSEO, else Goog

• onpage_serp_gap

  Find the headings, entities and schema the top SERP results have that a target page lacks, and turn them into on-page actions. Pass competitor_urls (free), or a query with DataForSEO configured to auto-fetch the SERP. When the SERP is auto-fetched, also returns winnability signals (AI-Overview prese

• ai_citation_track

  Track brand mention + citation share-of-voice across AI answer engines (Perplexity/OpenAI/Anthropic/Gemini via their APIs, Google AI Overviews via DataForSEO) for a managed prompt set, vs competitors. Samples each prompt N times (default 7) and reports visibility with a 95% confidence interval, shar