Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Krawlup

REMOTE · API.KRAWLUP.COM

SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics — via MCP.

Available components

78 Trust /100

Last scanned (19 hours ago)

Scores higher than 76% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security89
Transport & Reachability100
Schema Quality & AI Usability77
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2572 tokens (~98/item across 26 items; 26 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1
    • Tool “get_website_analytics” rewrote its description, which is the text the model reads security
    • Stability: unverified → 0.03 ▲ functional
  • 4 Nov 26 77

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://api.krawlup.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=api.krawlup.com CN=YR2,O=Let's Encrypt,C=US 19 Oct 2026 17 Jan 2027 RSA 4096 SHA256-RSA 57f55c03cfcead5b73286d41bf0c4e44955
SANs: api.krawlup.com
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of api.krawlup.com. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
com. DS published 19718 13 Verified
krawlup.com. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://api.krawlup.com/.well-known/oauth-protected-resource/mcp"

Bearer resource_metadata="https://api.krawlup.com/.well-known/oauth-protected-resource/mcp"

Protected resource metadata

Document https://api.krawlup.com/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://api.krawlup.com/mcp
Authorisation server https://api.krawlup.com

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.krawlup.com/mcp Verified 200
http (plaintext) http://api.krawlup.com/mcp HTTPS enforced 302 https://api.krawlup.com/mcp
MCP tools · 26 exposed · ~2,572 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_product ~213

Add a product from just its URL: krawlup scrapes the site (name, tagline, description, icons) and adds it to the founder's dashboard. Every other field is optional — explicit values override the scrape. Adding NEVER publishes — the product is private until the founder (or set_product_public) publishes it. Requires the submit permission.

NameTypeReqDescription
categoriesarray–Up to three category ids (or slugs/names) from check_launch_readiness. Optional — the founder can tag the product later.
descriptionstring–Short description (max 600 characters). Omit to use the scraped description.
namestring–Product name (max 40 characters). Omit to use the scraped site title.
taglinestring–One-line tagline (max 120 characters). Omit to use the scraped site description.
twitterUsernamestring–The product's X/Twitter handle (bare handle or profile URL)
urlstringyesThe product website URL

No output schema declared.

No examples provided.

add_tracked_keywords ~110

Adds keywords to a product's rank-tracking board (max KEYWORD_TRACK_CAP per product). Tracked keywords are re-checked by the scanner on its scan passes and their top-10 positions become the rank history get_keyword_ranks reads. Requires a key with the rescan scope

NameTypeReqDescription
keywordsarrayyesThe keywords to track — normalized (trimmed, lowercased, deduped) before storage
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

check_launch_readiness ~60

Audit a URL before adding it to krawlup: bans, blocked platforms, whether the product already exists (and who owns it), plus the optional category list. Run this before add_product.

NameTypeReqDescription
urlstringyesThe product website URL

No output schema declared.

No examples provided.

compare_products ~261

All your products side by side — lifetime or windowed (today / 7d / 30d / 90d) unique visitors, views, revenue totals with refunds netted, average revenue per conversion, revenue per visitor, and scan scores, sorted by any of them. Windowed numbers are computed exactly the way the dashboard computes them (same events, same windows), so they match the product page; lifetime visitors are the leaderboard's HLL estimate (~1.6%) and lifetime revenue comes from the payments ledger. Products and scores are always included; visitor columns and windowed revenue need the website_analytics subscription facility, revenue columns need analytics_conversion — gated columns come back null with a note instead of failing the call.

NameTypeReqDescription
limitinteger–Max products returned. Default 50.
orderstring–Sort direction. Default: desc (biggest / newest first).
rangestring–Metric window. lifetime = all-time totals; the others are ROLLING windows over the last N UTC days ending today (each includes today so far) — like the dashboard, they are not calendar-day buckets.
sortBystring–Column to sort by. Products missing the chosen metric sort last. Default: visitors.

No output schema declared.

No examples provided.

get_analytics_snippet ~110

The exact <script> tag that installs krawlup first-party analytics on a product's own website (visitors, sessions, pages, referrers, countries, conversion goals). The returned snippet already embeds the site token at data-site="…" — insert BOTH lines yourself; never ask the founder to paste the token. After installing, confirm data appears in the dashboard Website tab within a minute of the first visit

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_analytics_token ~109

The raw analytics site token for one product — the data-site value inside the krawlup analytics tag. The token is not a secret (it travels in the tagged page source by design) and is already embedded inside the snippet returned by get_analytics_snippet — never ask the founder to paste the token. Use this for hand-written tags, the @krawlup/analytics-tag npm package, or custom integrations

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_bottleneck ~59

The stored AI bottleneck analysis for one product (THE one edit to make, with why/impact/steps and the agent prompt), or null if not run yet

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_fix_cards ~54

All stored AI fix cards for one product (what/why/steps/agent prompt per issue). Requires a plan with the ai_fix_cards facility

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_insights ~122

Full latest insights for one product — everything the dashboard renders: overall + per-plane scorecards, failing audits, Core Web Vitals metrics, conversion (CRO) checks, the mobile layout test, AI-readiness facts (llms.txt, AI-crawler robots, structured data), trust/security checks, CrUX field data, Domain Rating + OpenPageRank, the SEO crawl, the recommended First Edit, and unresolved AI fix cards (fix cards require the ai_fix_cards plan facility)

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_keyword_ideas ~115

The stored keyword research for one product: intent-clustered keyword ideas with volume/difficulty estimates (exact volume + CPC when a Keywords Everywhere key is configured), prioritized content actions, and a per-keyword verdict (own/push/hard/skip). A new run can be triggered from here with run_keyword_research; ideas worth watching can be added to rank tracking with add_tracked_keywords. Requires a plan with the keyword_research facility

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_keyword_ranks ~139

Rank history for a product's tracked keywords, as checked by the scanner on its scan passes: per keyword the latest position (null = checked and not in the top-10), best position, and the series of stored checks. Only positions actually checked are returned — never interpolated. searchConfigured=false means no SERP source (Treg/Tavily) is configured and the scanner skips checks, so the board stays empty until the admin configures one. Requires a plan with the keyword_research facility

NameTypeReqDescription
keywordstring–Limit to one tracked keyword
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_my_products_status ~25

Your products with their directory visibility (public/private) — most recent first.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_my_subscription ~85

The founder's current subscription: plan name and price, status (active / trial / in the 3-day renewal grace / expired read-only), the plan's abilities and limits (a limit of 0 means unlimited), usage against this period's meters, and a can-do summary. Call this FIRST to check which features the founder's plan actually allows before using any other tool.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_product ~45

The full public listing for one product, by slug or key.

NameTypeReqDescription
identifierstringyesThe product slug (e.g. "acme-app") or key (its domain)

No output schema declared.

No examples provided.

get_scan_history ~69

Score-over-time series for one product (last 100 scans, chronological): performance, AEO, CRO, SEO crawl, scorecards, CrUX, openRank, and issue counts — plus per-run source and timestamp

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

get_site_report ~102

The free public site report for any website (the /site-report tool): performance, AEO, CRO, SEO crawl, CrUX, OpenPageRank, scorecards and the named checks behind them — the same data the public site-report page renders. Cached read, never generates; if hasReport is false, call run_site_report and poll this tool until scanStage clears.

NameTypeReqDescription
domainstringyesThe website domain, e.g. "example.com"

No output schema declared.

No examples provided.

get_website_analytics ~123

First-party website analytics for one product: visitors, sessions, bounce, avg. duration, pages per session, pageviews, daily series, entry/exit pages, top pages/referrers, acquisition channels, UTM sources, countries/devices, AI crawler visits (AI answers / indexing / training, with a partial flag when a crawler query failed), and conversion events + goals when the plan carries the analytics_conversion facility

NameTypeReqDescription
productKeystringyesThe product key (see list_products)
rangestring–Defaults to 7d

No output schema declared.

No examples provided.

list_products ~21

List your products on krawlup with their latest scan scores

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

remove_tracked_keywords ~67

Removes keywords from a product's rank-tracking board. Their stored rank-check history is deleted with them. Requires a key with the rescan scope

NameTypeReqDescription
keywordsarrayyesThe keywords to stop tracking
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

run_keyword_research ~127

Runs one keyword research for a product: a Google-autocomplete sweep clustered by a model into intent groups with volume/difficulty estimates and prioritized content actions (Jev-scored fit/demand/competition when the TypeSafe key is bound). Spends one of the founder's monthly keyword-research runs — check first with get_keyword_ideas whether the stored research still serves. Requires a key with the rescan scope

NameTypeReqDescription
productKeystringyesThe product key (see list_products)
seedstring–Seed keyword; defaults to the product's target keyword or name

No output schema declared.

No examples provided.

run_site_report ~99

Start the free public scan for any website and return immediately. Authenticated agents get 2 full scans per calendar month per credential; anonymous callers share a per-IP monthly budget with every other surface. Poll get_site_report for the domain until scanStage clears to read the finished report. Domains already listed as krawlup products are refused — scan those from the dashboard.

NameTypeReqDescription
domainstringyesThe website domain, e.g. "example.com"

No output schema declared.

No examples provided.

search_products ~63

Search the public catalog of launched products in plain language (min 2 characters).

NameTypeReqDescription
limitinteger–How many results (default 20, max 50)
querystringyesWhat to search for: product names, taglines, descriptions, domains

No output schema declared.

No examples provided.

set_excluded_pages ~166

Replace the per-product Excluded pages board — paths whose visits are discarded at intake (never stored, never counted). DESTRUCTIVE: it changes what the site's analytics records. MCP clients should prompt the site owner before calling; regardless, set confirm=true ONLY after the owner explicitly approved the exact list in the conversation. An empty array removes all exclusions. Requires a key with the submit scope

NameTypeReqDescription
confirmbooleanyesMust be true, and may only be true after the site owner approved this exact list in the conversation
pathsarrayyesFULL replacement list of absolute paths (e.g. /admin also covers /admin/settings; max 25) — an empty array clears the board
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

set_product_private ~47

Remove one of your products from the public directory (always allowed, any plan).

NameTypeReqDescription
productKeystringyesThe product key (domain) as returned by add_product or list_products

No output schema declared.

No examples provided.

set_product_public ~85

Make one of your products public in the krawlup directory. Publishing requires an active paid subscription (no trial) OR an admin-approved publishing grant covering this exact product; the 403 message names which. Unpublishing is set_product_private. Requires the submit permission.

NameTypeReqDescription
productKeystringyesThe product key (domain) as returned by add_product or list_products

No output schema declared.

No examples provided.

trigger_rescan ~96

Starts a fresh full analysis of one product in the background — spends one of the founder's full-analysis allowances for the current billing period (per product, and across all their products), plus one page speed check. Returns immediately; poll get_insights for this product until scanPending is false to read the fresh numbers. Requires a key with the rescan scope.

NameTypeReqDescription
productKeystringyesThe product key (see list_products)

No output schema declared.

No examples provided.

Install

How do I install the Krawlup MCP server?

Krawlup is a hosted endpoint at https://api.krawlup.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · api.krawlup.com

# add to Claude Code
claude mcp add --transport http com-krawlup-krawlup 'https://api.krawlup.com/mcp'
Common questions

What is the Krawlup MCP server?

Krawlup is an MCP server listed in the public MCP registry as com.krawlup/krawlup. SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics, via MCP. This page covers its hosted endpoint (https://api.krawlup.com/mcp).

Is the Krawlup MCP server safe to use?

Krawlup scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Krawlup MCP server expose?

Krawlup exposes 26 tools: search_products, get_product, check_launch_readiness, get_site_report, run_site_report, and 21 more. Their descriptions and schemas cost roughly 2,572 tokens of context every time the server is loaded.

Does the Krawlup MCP server require authentication?

Yes. Krawlup asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Krawlup MCP server still maintained?

Krawlup is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the Krawlup MCP server?

VerifyMCP ran 13 checks on Krawlup, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.