SEO Skill
NPM · SEO · 2 COMPONENTS
Free Google Search Console MCP: your real GSC, Google Analytics and keyword data for AI agents.
Available components
Last scanned (17 hours ago)
Scores higher than 65% of npm servers
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 256 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to iannuttall/seo). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1857 tokens (~142/item across 13 items; 12 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 68% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 80
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 16 Oct 2026 · Analysed npm/seo@0.5.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | iannuttall/seo |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/iannuttall/seo/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3276698433 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:e628ba317cf97ffc93b555fcda23113ce0276573ca0fe34569d658b43768506bb808d5e7e71a78e585a8ee49b431cd7509ba3eb0f09585d5479265ab9 |
Background: How many MCP packages publish verified provenance →
Dependencies 256 packages
| Packages resolved | 256 |
|---|---|
| Stale | 50 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
seo_compare Before and after a date ~125
Compares equal periods before and after a date, such as a site change or a Google update: totals, devices, and the pages and queries that moved, with Google updates in the window. Optional pages narrows it to URLs that contain that text, such as /blog/.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | yes | YYYY-MM-DD: the first day after the change. |
| pages | string | – | Optional URL text, such as /blog/. |
| site | string | yes | Search Console property or site, such as sc-domain:example.com, https://example.com/ or example.com. |
No output schema declared.
No examples provided.
seo_crawl Crawl a site ~42
Crawls a site from this machine and returns technical issues and the URLs they affect. The crawl is saved locally for later reports.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | – |
No output schema declared.
No examples provided.
seo_data Raw rows ~318
Raw rows for questions the report does not answer. search_console (default): rows for any dimensions, each with the previous period and the change; page and query narrow to rows whose URL or query contains that text. google_analytics: landing pages for visits from search, with Google Analytics’ own metric names. bing: Bing Webmaster query or page rows (first dimension) for the same site, by week. Clicky and other analytics run on the person’s machine with the CLI and a provider package: `npx -y seo providers install @seoskill/clicky-provider`, connect it once with `seo providers connect clicky`, then `npx -y seo analytics clicky report --json`. `seo providers list` shows installed providers.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | summary first. rows: the next page of rows. full: every field as JSON. |
| dimensions | array | – | search_console; bing uses the first, query or page. |
| end_date | string | – | YYYY-MM-DD. Optional; send with start_date. |
| offset | integer | – | rows only: the first row to return. |
| page | string | – | search_console only: URL text, such as /blog/. |
| query | string | – | search_console only: query text. |
| site | string | yes | search_console and bing: the property or site. google_analytics: numeric property id from seo_sites. |
| source | string | – | – |
| start_date | string | – | YYYY-MM-DD. Optional; send with end_date. |
No output schema declared.
No examples provided.
seo_describe_provider ~32
Describe one installed provider, its shared capabilities, and its agent action schemas
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
seo_index Pages that lost their clicks ~139
Pages that had at least 3 clicks in the previous 28 days and kept 20% or less of them in the last 28 days, with a live check of the top 20 and Google’s index status for the top 10. It shows pages that broke, redirect, block indexing or dropped out of Google.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | YYYY-MM-DD. Optional; send with start_date. |
| site | string | yes | Search Console property or site, such as sc-domain:example.com, https://example.com/ or example.com. |
| start_date | string | – | YYYY-MM-DD. Optional; send with end_date. |
No output schema declared.
No examples provided.
seo_internal_links Internal link opportunities ~40
Pages of the same site that could link to a target page, from Search Console and live page checks on this machine.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | – |
No output schema declared.
No examples provided.
seo_list_providers ~28
List provider packages installed through the seo CLI. Package installation requires human approval in a terminal.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
seo_page One page ~134
Everything for one URL: live page facts (status, redirect, title, description, H1, canonical, robots), Google’s index status from URL Inspection, and the page’s Search Console queries against the previous period.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | summary first. rows: the next page of rows. full: every field as JSON. |
| end_date | string | – | YYYY-MM-DD. Optional; send with start_date. |
| offset | integer | – | rows only: the first row to return. |
| start_date | string | – | YYYY-MM-DD. Optional; send with end_date. |
| url | string | yes | – |
No output schema declared.
No examples provided.
seo_report Search Console report ~447
The main report for a Search Console property. Without a section it returns the overview plus each section's row count and top rows. With a section it returns that section's rows; page sections also check their top 20 URLs live. Sections: - overview: Site totals (clicks, impressions, CTR, position) against the previous period, by device, with the top pages and queries and their change. - quick-wins: Query and page pairs at average positions 4 to 10 with a click-through rate below the site’s own curve for that position. - low-ctr: Query and page pairs at average positions 1 to 4 with a click-through rate below the site’s own curve: titles and snippets to review with the person. - striking-distance: Queries just outside the top positions, with impressions, for pages that already rank. - second-page: Pages with an average position of 11 to 20 and their queries. - content-decay: Query and page pairs that lost clicks against the previous period. - cannibalization: Queries where more than one page of the site gets impressions, with each page’s share. - traffic-drop: Daily clicks and impressions checked for a sudden change that lasted, with the date it started (else the last 7 days against the days before), and Google updates within 3 days of that date. Overlap is timing only, not cause. - bing: Bing’s top queries from Bing Webmaster Tools with Google’s clicks, impressions and position for the same query beside them, and the same for pages.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | summary first. rows: the next page of rows. full: every field as JSON. |
| end_date | string | – | YYYY-MM-DD. Optional; send with start_date. |
| offset | integer | – | rows only: the first row to return. |
| section | string | – | Optional. Leave it out first; then ask for one section. |
| site | string | yes | Search Console property or site, such as sc-domain:example.com, https://example.com/ or example.com. |
| start_date | string | – | YYYY-MM-DD. Optional; send with end_date. |
No output schema declared.
No examples provided.
seo_research Keyword, competitor and backlink data ~215
Data from the person’s own DataForSEO or Ahrefs account, which costs them credits. It uses the key the person saved on their seoskill.dev account (or on this machine for the CLI). Actions: keyword_metrics (keywords: volume, difficulty, CPC), ranked_keywords (target: keywords a domain or URL ranks for), serp (keywords, up to 5: the ranking pages), competitors (target: domains that share keywords), backlinks (target: referring domains). Rows with a domain, and the target, get a free Ahrefs domain_rating column. Numbers are provider estimates, not Search Console data.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| country | string | – | Two-letter country code. |
| detail | string | – | summary first. rows: the next page of rows. full: every field as JSON. |
| keywords | array | – | – |
| offset | integer | – | rows only: the first row to return. |
| provider | string | yes | – |
| target | string | – | Domain or URL. |
No output schema declared.
No examples provided.
seo_run_provider ~61
Run one action from an installed provider after reading its schema with seo_describe_provider
| Name | Type | Req | Description |
|---|---|---|---|
| account | object | – | – |
| action | string | yes | – |
| id | string | yes | – |
| params | object | – | – |
| refresh | boolean | – | – |
No output schema declared.
No examples provided.
seo_sites List sites ~41
Lists the Search Console and Google Analytics properties the connected Google accounts can read, the Bing Webmaster site for each, and which research keys are set. Call it first.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the SEO Skill MCP server?
SEO Skill runs locally as an npm package, launched with npx -y seo. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · seo
claude mcp add dev-seoskill-seo -- npx -y seo
What is the SEO Skill MCP server?
SEO Skill is an MCP server listed in the public MCP registry as dev.seoskill/seo. Free Google Search Console MCP: your real GSC, Google Analytics and keyword data for AI agents. This page covers its npm package (seo).
Is the SEO Skill MCP server safe to use?
SEO Skill scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SEO Skill MCP server expose?
SEO Skill exposes 12 tools: seo_sites, seo_report, seo_page, seo_compare, seo_index, and 7 more. Their descriptions and schemas cost roughly 1,622 tokens of context every time the server is loaded.
Is the SEO Skill MCP server still maintained?
SEO Skill is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the SEO Skill MCP server under?
SEO Skill declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.