# Lotus — AI Citation Intelligence (remote · lotus.clicon.app)

Measure how AI assistants cite your brand. Returns measured data and ready-to-apply fixes.

- Trust score: 66/100 (medium)
- Change this week: +12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- remote · `lotus.clicon.app`: 66/100 (this document), [markdown](https://verifymcp.io/servers/app-clicon-lotus/lotus.md), [page](https://verifymcp.io/servers/app-clicon-lotus/lotus)

## Channel facts

- Endpoint: `https://lotus.clicon.app/mcp/`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.27.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (regenerate_artifacts).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 837 tokens (~69/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http app-clicon-lotus https://lotus.clicon.app/mcp/
```

### Codex

```toml
[mcp_servers.app-clicon-lotus]
url = "https://lotus.clicon.app/mcp/"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-clicon-lotus": {
      "type": "remote",
      "url": "https://lotus.clicon.app/mcp/",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-clicon-lotus --url https://lotus.clicon.app/mcp/ --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-clicon-lotus:
    url: "https://lotus.clicon.app/mcp/"
```

### Other

```json
{
  "mcpServers": {
    "app-clicon-lotus": {
      "type": "http",
      "url": "https://lotus.clicon.app/mcp/"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 64, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 61, +6)

- [security] Tool “generate_share_link” rewrote its description, which is the text the model reads
- [security] Tool “get_artifact” rewrote its description, which is the text the model reads
- [security] Tool “get_bleed_model” rewrote its description, which is the text the model reads
- [security] Tool “get_bot_activity” rewrote its description, which is the text the model reads
- [security] Tool “get_citation_verdict” rewrote its description, which is the text the model reads
- [security] Tool “get_quick_win_code” rewrote its description, which is the text the model reads
- [security] Tool “get_quick_wins” rewrote its description, which is the text the model reads
- [security] Tool “mark_applied” rewrote its description, which is the text the model reads
- [security] Tool “regenerate_artifacts” rewrote its description, which is the text the model reads
- [security] Tool “verify_installation” rewrote its description, which is the text the model reads
- [security] Tool “get_competitor_actions” rewrote its description, which is the text the model reads
- [security] Tool “analyze_geo” rewrote its description, which is the text the model reads
- [functional] Schema quality: fair → good

### 2026-07-29 (score 55, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 54, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 53)

First indexed and scored.

## MCP tools (12)

### `analyze_geo` (~73 tokens)

Analyze a domain's visibility across AI-generated answers.
    Without an API key: returns a limited preview (1/day per IP, 3/week).
    With a valid API key: returns the full analysis including measured
    metrics, revenue-at-risk estimates and scenario simulations.

Input parameters:

- `domain` (string, required)

### `get_quick_wins` (~44 tokens)

Return pending and applied quick wins for a domain.
    Requires a valid API key (pro, growth or agency).

Input parameters:

- `domain` (string, required)

### `get_quick_win_code` (~59 tokens)

Generate ready-to-install code for a quick win, identified by its hash.
    Only available for structured_data quick wins.
    Requires a valid API key.

Input parameters:

- `domain` (string)
- `hash` (string, required)

### `mark_applied` (~90 tokens)

Verify-before-mark: checks that the expected schema is actually present
    in the live DOM of the site before marking the quick win as applied.
    Only marks it if the expected @type is found among the schemas detected
    on the domain (best-effort, fails safe).
    Requires a valid API key.

Input parameters:

- `domain` (string)
- `hash` (string, required)

### `get_competitor_actions` (~44 tokens)

Return pending and completed competitor actions for a domain.
    Requires a valid API key (pro, growth or agency).

Input parameters:

- `domain` (string, required)

### `get_artifact` (~82 tokens)

Return the most recent artifact (llms_txt or json_ld) for the
    authenticated client: content, version, generated_at and status.
    Use when an agent needs to read the generated llms.txt or JSON-LD.
    artifact_type must be "llms_txt" or "json_ld".

Input parameters:

- `artifact_type` (string, required)

### `get_bot_activity` (~71 tokens)

Return AI crawler activity for the authenticated client's domain:
    total hits, breakdown per bot, most recent hits and last-seen per bot.
    Use when an agent needs to assess how frequently AI crawlers visit
    a site over the last N days.

Input parameters:

- `days` (integer)

### `get_bleed_model` (~64 tokens)

Return the traffic erosion model for the authenticated client:
    cascading metrics with their *_source provenance labels, plus the
    resulting revenue-at-risk calculation.
    Use when an agent needs to assess the economic impact of losing
    traffic to AI-generated answers.

### `verify_installation` (~83 tokens)

Check live whether llms.txt and JSON-LD are correctly installed on the
    authenticated client's domain. Returns an overall status
    (fully_deployed / partially_deployed / not_deployed) plus the detailed
    result for each artifact.
    Use when an agent needs to confirm that GEO artifacts are serving
    correctly on the client's site.

### `get_citation_verdict` (~83 tokens)

Return the most recent citation score for the authenticated client,
    along with the measurements from that same week (safe fields only).
    Raw data — no healthy/critical classification applied.
    Use when an agent needs to audit how generative engines cite a client:
    citation rate, average position, sentiment, competitors mentioned and
    entity fidelity.

### `generate_share_link` (~68 tokens)

Generate a public report link for the authenticated client and persist
    it. Returns {report_url, slug}.
    Use when an agent needs to create a shareable report covering the
    client's full visibility status: crawler activity, revenue at risk,
    competitive intelligence and competitors.

### `regenerate_artifacts` (~76 tokens)

Regenerate the GEO artifacts (llms_txt, json_ld and supporting schema
    nodes) for the authenticated client. Respects a 6h cooldown and the
    daily generation budget.
    Use when an agent needs to force regeneration after changes to the
    site or to the competitor/advantage configuration.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-clicon-lotus/lotus#diagnostics

## Score history

- 2026-08-04: 66
- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 64
- 2026-07-31: 64
- 2026-07-30: 61
- 2026-07-29: 55
- 2026-07-28: 54
- 2026-07-27: 54
- 2026-07-26: 53

## Links

- Remote endpoint: https://lotus.clicon.app/mcp/
- Authorisation metadata: https://lotus.clicon.app/.well-known/oauth-protected-resource/mcp
- Repository: https://github.com/martinendara/lotus-mcp
- Website: https://clicon.app/
- Changelog RSS feed: https://verifymcp.io/servers/app-clicon-lotus/lotus/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-clicon-lotus/lotus/changelog.json
- HTML version of this page: https://verifymcp.io/servers/app-clicon-lotus/lotus