Krawlup
REMOTE · API.KRAWLUP.COM
SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics — via MCP.
Available components
Last scanned (19 hours ago)
Scores higher than 76% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability77
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2572 tokens (~98/item across 26 items; 26 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Tool “get_website_analytics” rewrote its description, which is the text the model reads security
- Stability: unverified → 0.03 ▲ functional
- 4 Nov 26 77
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://api.krawlup.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.krawlup.com | CN=YR2,O=Let's Encrypt,C=US | 19 Oct 2026 | 17 Jan 2027 | RSA 4096 | SHA256-RSA | 57f55c03cfcead5b73286d41bf0c4e44955 |
| SANs: api.krawlup.com | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.krawlup.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| com. | DS published | 19718 | 13 | Verified |
| krawlup.com. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://api.krawlup.com/.well-known/oauth-protected-resource/mcp"
Bearer resource_metadata="https://api.krawlup.com/.well-known/oauth-protected-resource/mcp" Protected resource metadata
| Document | https://api.krawlup.com/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://api.krawlup.com/mcp |
| Authorisation server | https://api.krawlup.com |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.krawlup.com/mcp | Verified | 200 | |
| http (plaintext) | http://api.krawlup.com/mcp | HTTPS enforced | 302 | https://api.krawlup.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_product ~213
Add a product from just its URL: krawlup scrapes the site (name, tagline, description, icons) and adds it to the founder's dashboard. Every other field is optional — explicit values override the scrape. Adding NEVER publishes — the product is private until the founder (or set_product_public) publishes it. Requires the submit permission.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | Up to three category ids (or slugs/names) from check_launch_readiness. Optional — the founder can tag the product later. |
| description | string | – | Short description (max 600 characters). Omit to use the scraped description. |
| name | string | – | Product name (max 40 characters). Omit to use the scraped site title. |
| tagline | string | – | One-line tagline (max 120 characters). Omit to use the scraped site description. |
| twitterUsername | string | – | The product's X/Twitter handle (bare handle or profile URL) |
| url | string | yes | The product website URL |
No output schema declared.
No examples provided.
add_tracked_keywords ~110
Adds keywords to a product's rank-tracking board (max KEYWORD_TRACK_CAP per product). Tracked keywords are re-checked by the scanner on its scan passes and their top-10 positions become the rank history get_keyword_ranks reads. Requires a key with the rescan scope
| Name | Type | Req | Description |
|---|---|---|---|
| keywords | array | yes | The keywords to track — normalized (trimmed, lowercased, deduped) before storage |
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
check_launch_readiness ~60
Audit a URL before adding it to krawlup: bans, blocked platforms, whether the product already exists (and who owns it), plus the optional category list. Run this before add_product.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The product website URL |
No output schema declared.
No examples provided.
compare_products ~261
All your products side by side — lifetime or windowed (today / 7d / 30d / 90d) unique visitors, views, revenue totals with refunds netted, average revenue per conversion, revenue per visitor, and scan scores, sorted by any of them. Windowed numbers are computed exactly the way the dashboard computes them (same events, same windows), so they match the product page; lifetime visitors are the leaderboard's HLL estimate (~1.6%) and lifetime revenue comes from the payments ledger. Products and scores are always included; visitor columns and windowed revenue need the website_analytics subscription facility, revenue columns need analytics_conversion — gated columns come back null with a note instead of failing the call.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max products returned. Default 50. |
| order | string | – | Sort direction. Default: desc (biggest / newest first). |
| range | string | – | Metric window. lifetime = all-time totals; the others are ROLLING windows over the last N UTC days ending today (each includes today so far) — like the dashboard, they are not calendar-day buckets. |
| sortBy | string | – | Column to sort by. Products missing the chosen metric sort last. Default: visitors. |
No output schema declared.
No examples provided.
get_analytics_snippet ~110
The exact <script> tag that installs krawlup first-party analytics on a product's own website (visitors, sessions, pages, referrers, countries, conversion goals). The returned snippet already embeds the site token at data-site="…" — insert BOTH lines yourself; never ask the founder to paste the token. After installing, confirm data appears in the dashboard Website tab within a minute of the first visit
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_analytics_token ~109
The raw analytics site token for one product — the data-site value inside the krawlup analytics tag. The token is not a secret (it travels in the tagged page source by design) and is already embedded inside the snippet returned by get_analytics_snippet — never ask the founder to paste the token. Use this for hand-written tags, the @krawlup/analytics-tag npm package, or custom integrations
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_bottleneck ~59
The stored AI bottleneck analysis for one product (THE one edit to make, with why/impact/steps and the agent prompt), or null if not run yet
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_fix_cards ~54
All stored AI fix cards for one product (what/why/steps/agent prompt per issue). Requires a plan with the ai_fix_cards facility
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_insights ~122
Full latest insights for one product — everything the dashboard renders: overall + per-plane scorecards, failing audits, Core Web Vitals metrics, conversion (CRO) checks, the mobile layout test, AI-readiness facts (llms.txt, AI-crawler robots, structured data), trust/security checks, CrUX field data, Domain Rating + OpenPageRank, the SEO crawl, the recommended First Edit, and unresolved AI fix cards (fix cards require the ai_fix_cards plan facility)
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_keyword_ideas ~115
The stored keyword research for one product: intent-clustered keyword ideas with volume/difficulty estimates (exact volume + CPC when a Keywords Everywhere key is configured), prioritized content actions, and a per-keyword verdict (own/push/hard/skip). A new run can be triggered from here with run_keyword_research; ideas worth watching can be added to rank tracking with add_tracked_keywords. Requires a plan with the keyword_research facility
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_keyword_ranks ~139
Rank history for a product's tracked keywords, as checked by the scanner on its scan passes: per keyword the latest position (null = checked and not in the top-10), best position, and the series of stored checks. Only positions actually checked are returned — never interpolated. searchConfigured=false means no SERP source (Treg/Tavily) is configured and the scanner skips checks, so the board stays empty until the admin configures one. Requires a plan with the keyword_research facility
| Name | Type | Req | Description |
|---|---|---|---|
| keyword | string | – | Limit to one tracked keyword |
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_my_products_status ~25
Your products with their directory visibility (public/private) — most recent first.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_my_subscription ~85
The founder's current subscription: plan name and price, status (active / trial / in the 3-day renewal grace / expired read-only), the plan's abilities and limits (a limit of 0 means unlimited), usage against this period's meters, and a can-do summary. Call this FIRST to check which features the founder's plan actually allows before using any other tool.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_product ~45
The full public listing for one product, by slug or key.
| Name | Type | Req | Description |
|---|---|---|---|
| identifier | string | yes | The product slug (e.g. "acme-app") or key (its domain) |
No output schema declared.
No examples provided.
get_scan_history ~69
Score-over-time series for one product (last 100 scans, chronological): performance, AEO, CRO, SEO crawl, scorecards, CrUX, openRank, and issue counts — plus per-run source and timestamp
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
get_site_report ~102
The free public site report for any website (the /site-report tool): performance, AEO, CRO, SEO crawl, CrUX, OpenPageRank, scorecards and the named checks behind them — the same data the public site-report page renders. Cached read, never generates; if hasReport is false, call run_site_report and poll this tool until scanStage clears.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The website domain, e.g. "example.com" |
No output schema declared.
No examples provided.
get_website_analytics ~123
First-party website analytics for one product: visitors, sessions, bounce, avg. duration, pages per session, pageviews, daily series, entry/exit pages, top pages/referrers, acquisition channels, UTM sources, countries/devices, AI crawler visits (AI answers / indexing / training, with a partial flag when a crawler query failed), and conversion events + goals when the plan carries the analytics_conversion facility
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
| range | string | – | Defaults to 7d |
No output schema declared.
No examples provided.
list_products ~21
List your products on krawlup with their latest scan scores
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
remove_tracked_keywords ~67
Removes keywords from a product's rank-tracking board. Their stored rank-check history is deleted with them. Requires a key with the rescan scope
| Name | Type | Req | Description |
|---|---|---|---|
| keywords | array | yes | The keywords to stop tracking |
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
run_keyword_research ~127
Runs one keyword research for a product: a Google-autocomplete sweep clustered by a model into intent groups with volume/difficulty estimates and prioritized content actions (Jev-scored fit/demand/competition when the TypeSafe key is bound). Spends one of the founder's monthly keyword-research runs — check first with get_keyword_ideas whether the stored research still serves. Requires a key with the rescan scope
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
| seed | string | – | Seed keyword; defaults to the product's target keyword or name |
No output schema declared.
No examples provided.
run_site_report ~99
Start the free public scan for any website and return immediately. Authenticated agents get 2 full scans per calendar month per credential; anonymous callers share a per-IP monthly budget with every other surface. Poll get_site_report for the domain until scanStage clears to read the finished report. Domains already listed as krawlup products are refused — scan those from the dashboard.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | The website domain, e.g. "example.com" |
No output schema declared.
No examples provided.
search_products ~63
Search the public catalog of launched products in plain language (min 2 characters).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many results (default 20, max 50) |
| query | string | yes | What to search for: product names, taglines, descriptions, domains |
No output schema declared.
No examples provided.
set_excluded_pages ~166
Replace the per-product Excluded pages board — paths whose visits are discarded at intake (never stored, never counted). DESTRUCTIVE: it changes what the site's analytics records. MCP clients should prompt the site owner before calling; regardless, set confirm=true ONLY after the owner explicitly approved the exact list in the conversation. An empty array removes all exclusions. Requires a key with the submit scope
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true, and may only be true after the site owner approved this exact list in the conversation |
| paths | array | yes | FULL replacement list of absolute paths (e.g. /admin also covers /admin/settings; max 25) — an empty array clears the board |
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
set_product_private ~47
Remove one of your products from the public directory (always allowed, any plan).
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (domain) as returned by add_product or list_products |
No output schema declared.
No examples provided.
set_product_public ~85
Make one of your products public in the krawlup directory. Publishing requires an active paid subscription (no trial) OR an admin-approved publishing grant covering this exact product; the 403 message names which. Unpublishing is set_product_private. Requires the submit permission.
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (domain) as returned by add_product or list_products |
No output schema declared.
No examples provided.
trigger_rescan ~96
Starts a fresh full analysis of one product in the background — spends one of the founder's full-analysis allowances for the current billing period (per product, and across all their products), plus one page speed check. Returns immediately; poll get_insights for this product until scanPending is false to read the fresh numbers. Requires a key with the rescan scope.
| Name | Type | Req | Description |
|---|---|---|---|
| productKey | string | yes | The product key (see list_products) |
No output schema declared.
No examples provided.
How do I install the Krawlup MCP server?
Krawlup is a hosted endpoint at https://api.krawlup.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.krawlup.com
claude mcp add --transport http com-krawlup-krawlup 'https://api.krawlup.com/mcp'
What is the Krawlup MCP server?
Krawlup is an MCP server listed in the public MCP registry as com.krawlup/krawlup. SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics, via MCP. This page covers its hosted endpoint (https://api.krawlup.com/mcp).
Is the Krawlup MCP server safe to use?
Krawlup scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Krawlup MCP server expose?
Krawlup exposes 26 tools: search_products, get_product, check_launch_readiness, get_site_report, run_site_report, and 21 more. Their descriptions and schemas cost roughly 2,572 tokens of context every time the server is loaded.
Does the Krawlup MCP server require authentication?
Yes. Krawlup asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Krawlup MCP server still maintained?
Krawlup is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Krawlup MCP server?
VerifyMCP ran 13 checks on Krawlup, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.