AthenaHQ
REMOTE · API.ATHENAHQ.AI
Track how AI assistants mention, cite, and rank your brand and competitors in AI search.
Available components
Last scanned (12 hours ago)
Scores higher than 52% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (add_brand_facts). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability34
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 19329 tokens (~169/item across 114 items; 113 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
- Stability check failed: schema churn in the 20 days we've observed: 4 tool removals, 0 breaking changes, 0 auth/transport breaks, 14 additions. See how to fix → Fail
Tool Coverage77
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 21% of tool parameters carry a description.Partial
- Structured output schemas are declared (99% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 10 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 114 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
- “query_metrics” reworded the description of “compare” cosmetic
1 cosmetic change on this day. Switch on “Show cosmetic changes” to see it.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 49 to 53.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 39 to 43.
- 29 Oct 26 0
- New tool “remove_competitors”, which the server declares destructive security
- New tool “add_competitors” functional
- 28 Oct 26 +1
- New tool “list_api_keys” functional
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 26 to 29.
- 24 Oct 26 0
- Tool “query_metrics” rewrote its description, which is the text the model reads security
- Tool “query_rows” rewrote its description, which is the text the model reads security
- Schema quality: 144 → 169 ▼ functional
- “query_metrics” reworded the description of “from” cosmetic
- “query_rows” reworded the description of “from” cosmetic
- 23 Oct 26 +1
- Tool “start_prompt_discovery” rewrote its description, which is the text the model reads security
- New tool “find_more_prompt_discovery” functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://api.athenahq.ai/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.athenahq.ai | CN=YR1,O=Let's Encrypt,C=US | 29 Sept 2026 | 28 Dec 2026 | RSA 2048 | SHA256-RSA | 516d4f595351327c9abd9e2769a6d064ae1 |
| SANs: api.athenahq.ai | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.athenahq.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 1814, 3799 | 8, 8 | Verified |
| athenahq.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| content-security-policy | default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.athenahq.ai/api/mcp | Verified | 200 | |
| http (plaintext) | http://api.athenahq.ai/api/mcp | HTTPS enforced | 308 | https://api.athenahq.ai/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
source_tags__delete ~170
Permanently delete a custom source tag and all its pattern assignments; retain source records. Built-in tags and Owned/Competitor cannot be deleted; remove patterns from a built-in tag instead. Read the listing first and pass the tag's revision as expected-revision. Obtain explicit user confirmation identifying the tag and its patterns before calling. MCP executes immediately after authorization; Athena AI chat presents an approval card. If the tag changed, read again. Never retry a declined proposal unless asked. A false analytics-refresh result means the tag was deleted but filtered analytics may still be cached.
| Name | Type | Req | Description |
|---|---|---|---|
| expected_revision | string | yes | Revision returned by the source-tag listing tool for this tag. |
| tag_id | string | yes | Custom source tag ID returned by the source-tag listing tool. |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| analytics_refreshed | boolean | – | – |
| color | string | – | – |
| deletable | boolean | – | – |
| editable | boolean | – | – |
| icon | string|null | – | – |
| id | string | – | – |
| kind | string | – | – |
| name | string | – | – |
| patterns | array | – | – |
| removed_patterns | array | – | – |
| revision | string | – | – |
No examples provided.
source_tags__get_sources ~241
List cited domains by tag coverage, most cited first with citation counts: either the domains one custom source tag matches (tag ID), or, with untagged true, the domains no tag covers at all. Built-in tags (platform) and Owned/Competitor (entity) are refused as tag IDs: their membership is automatic and not listable; add or remove patterns on them instead. Start from untagged when asked which domains still need tags or which new tags to suggest.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look-back window in days, default 90. |
| limit | integer | – | – |
| offset | integer | – | – |
| tag_id | string | – | Custom tag ID from the listing tool. Built-in tags are refused. Omit and set untagged to list sources no tag covers. |
| untagged | boolean | – | true lists cited domains that carry no tag at all: not Owned, not Competitor, no built-in tag, no custom tag. Use this to find what still needs tagging; then propose adding hosts to a built-in tag or… |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| has_more | boolean | – | – |
| sources | array | – | – |
| total | number | – | – |
No examples provided.
source_tags__list ~277
Read every source tag this website sees: Owned and Competitor (entity), the built-in classes AthenaHQ classifies automatically (platform: Media, Social, Government, E-Commerce, Review sites, PR Wire, Academic and research, Wiki) and the website's custom tags. Built-in tags list only what this website added or removed, never the platform's own patterns; custom tags list their patterns. Read this before proposing, creating, editing or deleting tags, and prefer adding hosts to a built-in tag over creating a near-duplicate. To find sources no tag covers, call source_tags__get_sources with untagged true. Filter by name substring or tag ID; page tags with offset, page one tag's patterns with tag ID and pattern offset.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Tags per page: 1 through 50, default 20. Use offset for the next page. |
| offset | integer | – | – |
| pattern_limit | integer | – | Patterns per tag: 1 through 500, default 50. |
| pattern_offset | integer | – | – |
| query | string | – | Optional tag-name substring. Omit to list all names. |
| tag_id | string | – | Actual UUID returned by this tool. Omit to list all tags; never use a placeholder. |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| has_more | boolean | – | – |
| tags | array | – | – |
| total | number | – | – |
No examples provided.
source_tags__update ~281
Edit a source tag. Custom tag: rename, add patterns, remove exact patterns from the listing. Built-in tag (platform): add patterns to this website's copy so they carry the tag here, or remove patterns so they stop carrying it here; a removal is accepted only for a pattern the tag currently applies to (by a platform rule, by automatic classification, or by your own addition), and an addition is accepted only when the pattern does not already carry the tag. Owned and Competitor cannot be edited here; their patterns live in Brand Profile and Competitors. Read the listing first and pass the tag's revision as expected-revision. Obtain explicit user confirmation of the exact changes before calling; MCP executes immediately after authorization; Athena AI chat presents an approval card. If the tag changed, read again. Never retry a declined proposal unless asked. Up to 500 additions and 500 removals. A false analytics-refresh result means the edit saved but filtered analytics may still be cached.
| Name | Type | Req | Description |
|---|---|---|---|
| add_patterns | array | – | – |
| expected_revision | string | yes | – |
| name | string | – | Custom tag name. Names of built-in tags (Media, Social, Government, …) and of Owned and Competitor are reserved. |
| remove_patterns | array | – | – |
| tag_id | string | yes | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| added | array | – | – |
| analytics_refreshed | boolean | – | – |
| before | object | – | – |
| color | string | – | – |
| deletable | boolean | – | – |
| editable | boolean | – | – |
| icon | string|null | – | – |
| id | string | – | – |
| kind | string | – | – |
| name | string | – | – |
| patterns | array | – | – |
| removed | array | – | – |
| removed_patterns | array | – | – |
| revision | string | – | – |
No examples provided.
start_prompt_discovery ~327
Start a Discover study to find evidence-grounded, untracked prompt opportunities for a website. Invoke after explicit user intent to start research and review the sources, country, language, requested prompt count and custom instructions with the user. This launches asynchronous external research and model calls; the prompt count is a target, not a guaranteed yield. Sources: website_analysis (website), social (market discussions), search_console (connected Search Console), keyword_gaps (plan-gated keyword opportunities), competitive_landscape (plan-gated category questions and comparisons researched from the website's tracked competitors; requires at least one tracked competitor), brand_guidelines (requires custom instructions). Returns the run ID and version when startup succeeds. Prompts are not automatically added to tracking. Poll the discovery history/progress tool with the returned run ID; do not start another study to check status. Requires prompt-management permission and source entitlements. Candidate results can be reviewed in the application's Discover page.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Country name or ISO code; defaults to United States. |
| custom_instructions | string | – | Required when brand_guidelines (Custom instructions) is selected. Focus discovery on the customer's requested topics. |
| language | string | – | Supported locale, for example en-US. Defaults to en-US. |
| name | string | yes | – |
| prompt_count_range | object | – | Supported min/max targets: 25/50 (default), 50/75, 75/100, 100/150, or 150/200. |
| sources | array | yes | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | – | – |
| version | string | – | – |
No examples provided.
start_response_streaming ~359
Run tracked prompts against external AI providers to collect new responses for a website. Sends prompt text to the selected providers, stores their responses in AthenaHQ, and consumes response credits. Starts immediately; use only for a user-requested run. Returns a workflow_id; poll get_response_streaming_status over MCP or GET /api/v1/response-streaming/status over the API for progress.
| Name | Type | Req | Description |
|---|---|---|---|
| only_locations | boolean | – | – |
| prompt_ids | array | – | Specific tracked prompt UUIDs to run, from 1 to 1,000. Overrides schedule prompt selectors when supplied. Omit to use schedule_id selectors, or every active prompt when schedule_id is also omitted. P… |
| prompt_variations | integer | – | – |
| schedule_id | string | – | Schedule UUID to attribute this run to and take prompt selectors from. A nonempty prompt_ids selection overrides those selectors. Omit to attribute the run to Default and run every active prompt unle… |
| selected_models | object | – | Map of model id to enabled flag, e.g. { "chatgpt": true, "ai_overview": true, "ai_mode": false }. Model ids: chatgpt, ai_overview (Google AI Overviews; google_ai_overview is also accepted), perplexit… |
| use_locations | boolean | – | – |
| use_personas | boolean | – | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | – |
| workflow_id | string | – | – |
No examples provided.
track_content_urls ~418
Register existing pages or third-party URLs as tracked Content Hub items so Athena attributes citations and mentions to them. Creates external content rows from bare URLs with no generation and no credit cost. Tracking starts immediately: the normalized URL becomes the citation/metric join key, so pages cited in the website's monitored AI responses accrue metrics with no publish step (use it for guest posts, partner placements, or any page Athena did not generate). Idempotent per URL: a URL already present on the website (any content type) is not duplicated; the response lists it under skipped with the existing content_id and type. Check that type before chaining destructive calls (a skip can resolve to first-party generated content that shares the URL). Rows are created without page text, which citation tracking does not need; the body can be filled from the app later. Duplicate URLs within one call (including tracking-param variants of the same page) collapse to one row, first occurrence wins. Optional sheet_id files rows under a Content Hub tab; view-type tabs resolve to the main pool (null), echoed per row. Optional per-URL fields set the customer's own Content Hub columns on the created row, addressed by column name as shown on the destination tab (text, number, date, checkbox, link, and multi-select columns; unknown multi-select options are created). An unknown column name or a value that does not fit the column type rejects the whole call and nothing is tracked; skipped URLs keep their existing values. If the user names a destination tab, resolve its id with get_content_hub_sheets before tracking. Omitting sheet_id uses the shared pool, not the user's currently open tab. After the call, report created_count and skipped_count separately, name the returned destination_name, and share content_hub_url so the user can open each item. Skipped rows keep their existing tab: use their returned destination and never describe them as newly added or moved.
| Name | Type | Req | Description |
|---|---|---|---|
| sheet_id | – | – | – |
| urls | array | yes | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| created | array | – | – |
| created_count | number | – | – |
| skipped | array | – | – |
| skipped_count | number | – | – |
| success | boolean | – | – |
No examples provided.
update_brand_fact ~145
Update one brand fact's text, source URL, or confidence in the Knowledge Base. Only provided fields change; pass source_url: "" to clear the source. Changing the text creates a new fact (new id) and archives the current one; the new fact keeps the current review status and the response carries it. Source URL and confidence edits update the fact in place. Duplicates across other facts are not rejected here (Knowledge Base dedup owns those). Does not change review status.
| Name | Type | Req | Description |
|---|---|---|---|
| confidence | string | – | – |
| fact_id | string | yes | – |
| source_url | string | – | – |
| text | string | – | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| before | object | – | – |
| fact | object | – | – |
No examples provided.
update_identifiers ~207
Add or remove identifiers on the website's brand, or on one competitor, under the same rules as the Competitors page. Call get_identifiers first. The name and domain cannot be removed. An identifier that is already listed, or that another tracked brand or competitor on this website already uses, is refused, and nothing is saved. New AI responses use the change right away. Past responses are reanalyzed only when someone runs the backfill on the Competitors page, which costs credits; this tool never starts it. changes_awaiting_backfill counts the edits waiting for it, not responses.
| Name | Type | Req | Description |
|---|---|---|---|
| add | array | – | Identifiers to add, exactly as they should match (trimmed). |
| competitor_id | string | – | The competitor to read or edit, from get_competitors. Omit it for the website's own brand. |
| remove | array | – | Identifiers to remove, exactly as get_identifiers lists them. |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| added | array | – | – |
| case_sensitive | boolean | – | – |
| changes_awaiting_backfill | integer | – | How many edits on this website, from anyone, wait for the backfill on the Competitors page. A count of edits, not of responses. |
| default_identifiers | array | – | – |
| entity | object | – | – |
| identifiers | array | – | – |
| removed | array | – | – |
No examples provided.
update_location ~53
Update a location for a website
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | – |
| location | string | – | – |
| location_id | string | yes | – |
| prompt_ids | array | – | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| before | object | – | – |
| country | string|null | – | – |
| id | string | – | – |
| location | string | – | – |
No examples provided.
update_outreach_contact ~268
Edit a cited page's Outreach contact: author name, email, LinkedIn, or the draft's subject and body. Creates the contact when the page has none. Supply at least one field; only the fields supplied change, and null clears a field. A changed email is labeled as entered manually. Each change is recorded in the contact's activity history. Obtain user confirmation of the new values before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| author_name | – | – | Author name. Null clears it; omit to keep it. |
| – | – | Email to pitch. Null clears it; omit to keep it. | |
| – | – | Author LinkedIn URL. Null clears it; omit to keep it. | |
| message | – | – | Draft body. Null clears it; omit to keep it. |
| subject | – | – | Draft subject. Null clears it; omit to keep it. |
| url | string | yes | Cited page URL, e.g. "example.com/blog/best-tools". A contact already saved under this exact URL (for example one the Outreach page saved for a query variant its URL rules list separately) is used fi… |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| contact | object | – | – |
| created | boolean | – | True when this call created the page's contact. |
No examples provided.
update_pillar ~131
Update a Knowledge Base pillar's name, description, or status. At least one of name, description, or status must be provided; only provided fields change, and description: "" clears the stored description. Renaming fails with a conflict when another pillar already uses the name. Status accepts published or archived: archiving hides the pillar from get_pillars and stops its facts feeding content generation, while keeping the facts stored.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| name | string | – | – |
| pillar_id | string | yes | – |
| status | string | – | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| before | object | – | – |
| pillar | object | – | – |
No examples provided.
update_prompt ~88
Update a prompt's metadata (text, type, topic, geography)
| Name | Type | Req | Description |
|---|---|---|---|
| countries | array | – | – |
| location_ids | array | – | – |
| primary_country | string|null | – | – |
| prompt | string | – | – |
| prompt_id | string | yes | – |
| topic_id | – | – | – |
| type | – | – | – |
| volume | string|null | – | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| before | object | – | – |
| countries | array | – | – |
| id | string | – | – |
| locations | array | – | – |
| text | string | – | – |
| topic_id | string|null | – | – |
| type | string|null | – | – |
| volume | string|null | – | – |
No examples provided.
update_topic ~44
Update a topic's name or description
| Name | Type | Req | Description |
|---|---|---|---|
| description | – | – | – |
| name | string | – | – |
| topic_id | string | yes | – |
| website_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| before | object | – | – |
| description | string|null | – | – |
| id | string | – | – |
| name | string | – | – |
No examples provided.
How do I install the AthenaHQ MCP server?
AthenaHQ is a hosted endpoint at https://api.athenahq.ai/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.athenahq.ai
claude mcp add --transport http ai-athenahq-mcp 'https://api.athenahq.ai/api/mcp'
What is the AthenaHQ MCP server?
AthenaHQ is an MCP server listed in the public MCP registry as ai.athenahq/mcp. Track how AI assistants mention, cite, and rank your brand and competitors in AI search. This page covers its hosted endpoint (https://api.athenahq.ai/api/mcp).
Is the AthenaHQ MCP server safe to use?
AthenaHQ scores 66 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AthenaHQ MCP server expose?
AthenaHQ exposes 113 tools: open_ai_access, check_public_ai_access, get_prompt_schedules, get_ai_search_value, get_prompts, and 108 more. Their descriptions and schemas cost roughly 19,324 tokens of context every time the server is loaded.
Does the AthenaHQ MCP server require authentication?
No. We connected to AthenaHQ without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the AthenaHQ MCP server still maintained?
AthenaHQ is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.