# Krawlup (remote · api.krawlup.com)

SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics — via MCP.

- Trust score: 78/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.krawlup.com`: 78/100 (this document), [markdown](https://verifymcp.io/servers/com-krawlup-krawlup/api.md), [page](https://verifymcp.io/servers/com-krawlup-krawlup/api)

## Channel facts

- Endpoint: `https://api.krawlup.com/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `2.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 89/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2572 tokens (~98/item across 26 items; 26 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Krawlup MCP server?

Krawlup is a hosted endpoint at https://api.krawlup.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-krawlup-krawlup 'https://api.krawlup.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-krawlup-krawlup": {
      "url": "https://api.krawlup.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-krawlup-krawlup": {
      "type": "http",
      "url": "https://api.krawlup.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-krawlup-krawlup]
url = "https://api.krawlup.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-krawlup-krawlup": {
      "type": "remote",
      "url": "https://api.krawlup.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-krawlup-krawlup --url 'https://api.krawlup.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-krawlup-krawlup:
    url: "https://api.krawlup.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-krawlup-krawlup": {
      "Transport": "http",
      "Url": "https://api.krawlup.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-krawlup-krawlup -t streamable-http -u 'https://api.krawlup.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-krawlup-krawlup": {
      "type": "http",
      "url": "https://api.krawlup.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 78, +1)

- [security] Tool “get_website_analytics” rewrote its description, which is the text the model reads
- [functional improvement] Stability: unverified → 0.03

### 2026-11-04 (score 77)

First indexed and scored.

## MCP tools (26)

### `search_products` (~63 tokens)

Search the public catalog of launched products in plain language (min 2 characters).

Input parameters:

- `limit` (integer): How many results (default 20, max 50)
- `query` (string, required): What to search for: product names, taglines, descriptions, domains

### `get_product` (~45 tokens)

The full public listing for one product, by slug or key.

Input parameters:

- `identifier` (string, required): The product slug (e.g. "acme-app") or key (its domain)

### `check_launch_readiness` (~60 tokens)

Audit a URL before adding it to krawlup: bans, blocked platforms, whether the product already exists (and who owns it), plus the optional category list. Run this before add_product.

Input parameters:

- `url` (string, required): The product website URL

### `get_site_report` (~102 tokens)

The free public site report for any website (the /site-report tool): performance, AEO, CRO, SEO crawl, CrUX, OpenPageRank, scorecards and the named checks behind them — the same data the public site-report page renders. Cached read, never generates; if hasReport is false, call run_site_report and poll this tool until scanStage clears.

Input parameters:

- `domain` (string, required): The website domain, e.g. "example.com"

### `run_site_report` (~99 tokens)

Start the free public scan for any website and return immediately. Authenticated agents get 2 full scans per calendar month per credential; anonymous callers share a per-IP monthly budget with every other surface. Poll get_site_report for the domain until scanStage clears to read the finished report. Domains already listed as krawlup products are refused — scan those from the dashboard.

Input parameters:

- `domain` (string, required): The website domain, e.g. "example.com"

### `list_products` (~21 tokens)

List your products on krawlup with their latest scan scores

### `get_my_products_status` (~25 tokens)

Your products with their directory visibility (public/private) — most recent first.

### `compare_products` (~261 tokens)

All your products side by side — lifetime or windowed (today / 7d / 30d / 90d) unique visitors, views, revenue totals with refunds netted, average revenue per conversion, revenue per visitor, and scan scores, sorted by any of them. Windowed numbers are computed exactly the way the dashboard computes them (same events, same windows), so they match the product page; lifetime visitors are the leaderboard's HLL estimate (~1.6%) and lifetime revenue comes from the payments ledger. Products and scores are always included; visitor columns and windowed revenue need the website_analytics subscription facility, revenue columns need analytics_conversion — gated columns come back null with a note instead of failing the call.

Input parameters:

- `limit` (integer): Max products returned. Default 50.
- `order` (string): Sort direction. Default: desc (biggest / newest first).
- `range` (string): Metric window. lifetime = all-time totals; the others are ROLLING windows over the last N UTC days ending today (each includes today so far) — like the dashboard, they are not calendar-day buckets.
- `sortBy` (string): Column to sort by. Products missing the chosen metric sort last. Default: visitors.

### `get_my_subscription` (~85 tokens)

The founder's current subscription: plan name and price, status (active / trial / in the 3-day renewal grace / expired read-only), the plan's abilities and limits (a limit of 0 means unlimited), usage against this period's meters, and a can-do summary. Call this FIRST to check which features the founder's plan actually allows before using any other tool.

### `add_product` (~213 tokens)

Add a product from just its URL: krawlup scrapes the site (name, tagline, description, icons) and adds it to the founder's dashboard. Every other field is optional — explicit values override the scrape. Adding NEVER publishes — the product is private until the founder (or set_product_public) publishes it. Requires the submit permission.

Input parameters:

- `categories` (array): Up to three category ids (or slugs/names) from check_launch_readiness. Optional — the founder can tag the product later.
- `description` (string): Short description (max 600 characters). Omit to use the scraped description.
- `name` (string): Product name (max 40 characters). Omit to use the scraped site title.
- `tagline` (string): One-line tagline (max 120 characters). Omit to use the scraped site description.
- `twitterUsername` (string): The product's X/Twitter handle (bare handle or profile URL)
- `url` (string, required): The product website URL

### `set_product_public` (~85 tokens)

Make one of your products public in the krawlup directory. Publishing requires an active paid subscription (no trial) OR an admin-approved publishing grant covering this exact product; the 403 message names which. Unpublishing is set_product_private. Requires the submit permission.

Input parameters:

- `productKey` (string, required): The product key (domain) as returned by add_product or list_products

### `set_product_private` (~47 tokens)

Remove one of your products from the public directory (always allowed, any plan).

Input parameters:

- `productKey` (string, required): The product key (domain) as returned by add_product or list_products

### `get_insights` (~122 tokens)

Full latest insights for one product — everything the dashboard renders: overall + per-plane scorecards, failing audits, Core Web Vitals metrics, conversion (CRO) checks, the mobile layout test, AI-readiness facts (llms.txt, AI-crawler robots, structured data), trust/security checks, CrUX field data, Domain Rating + OpenPageRank, the SEO crawl, the recommended First Edit, and unresolved AI fix cards (fix cards require the ai_fix_cards plan facility)

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `get_fix_cards` (~54 tokens)

All stored AI fix cards for one product (what/why/steps/agent prompt per issue). Requires a plan with the ai_fix_cards facility

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `get_scan_history` (~69 tokens)

Score-over-time series for one product (last 100 scans, chronological): performance, AEO, CRO, SEO crawl, scorecards, CrUX, openRank, and issue counts — plus per-run source and timestamp

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `get_analytics_snippet` (~110 tokens)

The exact <script> tag that installs krawlup first-party analytics on a product's own website (visitors, sessions, pages, referrers, countries, conversion goals). The returned snippet already embeds the site token at data-site="…" — insert BOTH lines yourself; never ask the founder to paste the token. After installing, confirm data appears in the dashboard Website tab within a minute of the first visit

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `get_analytics_token` (~109 tokens)

The raw analytics site token for one product — the data-site value inside the krawlup analytics tag. The token is not a secret (it travels in the tagged page source by design) and is already embedded inside the snippet returned by get_analytics_snippet — never ask the founder to paste the token. Use this for hand-written tags, the @krawlup/analytics-tag npm package, or custom integrations

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `set_excluded_pages` (~166 tokens)

Replace the per-product Excluded pages board — paths whose visits are discarded at intake (never stored, never counted). DESTRUCTIVE: it changes what the site's analytics records. MCP clients should prompt the site owner before calling; regardless, set confirm=true ONLY after the owner explicitly approved the exact list in the conversation. An empty array removes all exclusions. Requires a key with the submit scope

Input parameters:

- `confirm` (boolean, required): Must be true, and may only be true after the site owner approved this exact list in the conversation
- `paths` (array, required): FULL replacement list of absolute paths (e.g. /admin also covers /admin/settings; max 25) — an empty array clears the board
- `productKey` (string, required): The product key (see list_products)

### `get_website_analytics` (~123 tokens)

First-party website analytics for one product: visitors, sessions, bounce, avg. duration, pages per session, pageviews, daily series, entry/exit pages, top pages/referrers, acquisition channels, UTM sources, countries/devices, AI crawler visits (AI answers / indexing / training, with a partial flag when a crawler query failed), and conversion events + goals when the plan carries the analytics_conversion facility

Input parameters:

- `productKey` (string, required): The product key (see list_products)
- `range` (string): Defaults to 7d

### `get_bottleneck` (~59 tokens)

The stored AI bottleneck analysis for one product (THE one edit to make, with why/impact/steps and the agent prompt), or null if not run yet

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `get_keyword_ideas` (~115 tokens)

The stored keyword research for one product: intent-clustered keyword ideas with volume/difficulty estimates (exact volume + CPC when a Keywords Everywhere key is configured), prioritized content actions, and a per-keyword verdict (own/push/hard/skip). A new run can be triggered from here with run_keyword_research; ideas worth watching can be added to rank tracking with add_tracked_keywords. Requires a plan with the keyword_research facility

Input parameters:

- `productKey` (string, required): The product key (see list_products)

### `run_keyword_research` (~127 tokens)

Runs one keyword research for a product: a Google-autocomplete sweep clustered by a model into intent groups with volume/difficulty estimates and prioritized content actions (Jev-scored fit/demand/competition when the TypeSafe key is bound). Spends one of the founder's monthly keyword-research runs — check first with get_keyword_ideas whether the stored research still serves. Requires a key with the rescan scope

Input parameters:

- `productKey` (string, required): The product key (see list_products)
- `seed` (string): Seed keyword; defaults to the product's target keyword or name

### `add_tracked_keywords` (~110 tokens)

Adds keywords to a product's rank-tracking board (max KEYWORD_TRACK_CAP per product). Tracked keywords are re-checked by the scanner on its scan passes and their top-10 positions become the rank history get_keyword_ranks reads. Requires a key with the rescan scope

Input parameters:

- `keywords` (array, required): The keywords to track — normalized (trimmed, lowercased, deduped) before storage
- `productKey` (string, required): The product key (see list_products)

### `remove_tracked_keywords` (~67 tokens)

Removes keywords from a product's rank-tracking board. Their stored rank-check history is deleted with them. Requires a key with the rescan scope

Input parameters:

- `keywords` (array, required): The keywords to stop tracking
- `productKey` (string, required): The product key (see list_products)

### `get_keyword_ranks` (~139 tokens)

Rank history for a product's tracked keywords, as checked by the scanner on its scan passes: per keyword the latest position (null = checked and not in the top-10), best position, and the series of stored checks. Only positions actually checked are returned — never interpolated. searchConfigured=false means no SERP source (Treg/Tavily) is configured and the scanner skips checks, so the board stays empty until the admin configures one. Requires a plan with the keyword_research facility

Input parameters:

- `keyword` (string): Limit to one tracked keyword
- `productKey` (string, required): The product key (see list_products)

### `trigger_rescan` (~96 tokens)

Starts a fresh full analysis of one product in the background — spends one of the founder's full-analysis allowances for the current billing period (per product, and across all their products), plus one page speed check. Returns immediately; poll get_insights for this product until scanPending is false to read the fresh numbers. Requires a key with the rescan scope.

Input parameters:

- `productKey` (string, required): The product key (see list_products)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-krawlup-krawlup/api#diagnostics

## Score history

- 2026-11-05: 78
- 2026-11-04: 77

## Common questions

### What is the Krawlup MCP server?

Krawlup is an MCP server listed in the public MCP registry as com.krawlup/krawlup. SEO/AEO audits agents fix directly, free site reports, first-party cookieless analytics, via MCP. This page covers its hosted endpoint (https://api.krawlup.com/mcp).

### Is the Krawlup MCP server safe to use?

Krawlup scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Krawlup MCP server expose?

Krawlup exposes 26 tools: search_products, get_product, check_launch_readiness, get_site_report, run_site_report, and 21 more. Their descriptions and schemas cost roughly 2,572 tokens of context every time the server is loaded.

### Does the Krawlup MCP server require authentication?

Yes. Krawlup asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Krawlup MCP server still maintained?

Krawlup is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Krawlup MCP server?

VerifyMCP ran 13 checks on Krawlup, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://api.krawlup.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-krawlup-krawlup/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-krawlup-krawlup/api/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/com-krawlup-krawlup/api.json
- HTML version of this page: https://verifymcp.io/servers/com-krawlup-krawlup/api