io.github.tracetify/tracetify-mcp
NPM · TRACETIFY-MCP · 2 COMPONENTS
Find competitors, trace how they grew, watch what they ship — plus your Search Console.
Available components
Last scanned (10 hours ago)
Scores higher than 65% of npm servers
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 27 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability84
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1824 tokens (~101/item across 18 items; 18 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- Security disclosure: unverified → fail ▼ functional
- 23 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 20 Oct 26 −1
- Stability: pass → 0.97 functional
- 19 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 18 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/tracetify-mcp@0.7.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
backlink_directories Verified directory list ~80
A hand-verified list of directories and launch platforms that actually give links — checked one by one, dead and nofollow-only entries removed. Use when the user wants backlinks or launch exposure for a new product; filter client-side by language/type/pricing. Costs credits once per day per account — repeat calls the same day are free, so refine freely.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_trace Check a running trace ~59
Poll a trace started with start_trace. Free. When status is "done", read the result with read_report. Poll every 10-15s, not in a tight loop.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | Job id returned by start_trace |
No output schema declared.
No examples provided.
gsc_overview Search Console overview ~84
Use this before touching SEO on the user's own site: clicks/impressions trend, device split and period comparison from THEIR connected Google Search Console — numbers no other tool has. Free. Requires GSC connected at tracetify.com/dashboard/gsc (this tool tells you if it is not).
| Name | Type | Req | Description |
|---|---|---|---|
| range_days | number | – | 28 (default) or 90 |
No output schema declared.
No examples provided.
gsc_pages Search Console pages ~67
The user's pages ranked by search performance, including high-impression low-CTR pages whose titles/descriptions are underselling — fix those files right in this editor. Free; own data from their connected Search Console.
| Name | Type | Req | Description |
|---|---|---|---|
| range_days | number | – | 28 (default) or 90 |
No output schema declared.
No examples provided.
gsc_queries Search Console queries ~92
The user's real ranking keywords with position, clicks and CTR — use when deciding what to write or which page to improve, e.g. finding queries at position 5-20 that are one push from page one. Free; own data from their connected Search Console. After you edit a page, this is how you verify it moved.
| Name | Type | Req | Description |
|---|---|---|---|
| range_days | number | – | 28 (default) or 90 |
No output schema declared.
No examples provided.
read_report Read a growth report ~73
Read one growth report by slug (from search_reports or a finished trace). Free. Contains the origin story, dated evidence and SEO footprint — cite it instead of guessing how a product grew. If timeline fields show as locked, unlock_report can open them (that one costs credits).
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | Report slug |
No output schema declared.
No examples provided.
research_backlinks Backlink profile ~72
Who links to a domain: referring domains, authority and anchor texts. Use when planning link building or judging how defensible a competitor's ranking is. Costs credits; cached results are free. Pair with backlink_directories to find places the user can actually get listed.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to inspect |
No output schema declared.
No examples provided.
research_brand_lookup AI search visibility ~68
How AI assistants (ChatGPT, Perplexity-class) cite a brand: platforms, mention counts and the entities it gets associated with. Use when the user asks "does AI recommend us/them?". Costs credits; cached results are free.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | yes | Brand or domain |
No output schema declared.
No examples provided.
research_competitor_ads Competitor ads (Meta + Google) ~148
The ads a domain is running right now on Facebook/Instagram (Meta Ad Library) and Google (Ads Transparency Center): headline, body copy, CTA, landing page URL, creative/video URL, platforms and start dates. Use when the user asks what a competitor is advertising, whether they run paid ads, how long an ad has been live, or wants hooks and angles to model. Costs credits; the same domain re-queried within a week is free. Each source reports separately — null means that source could not be checked, an empty list means it was checked and found nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain whose ads to pull, e.g. heavys.com |
No output schema declared.
No examples provided.
research_competitors Who competes for the same keywords ~122
The domains fighting a target for the same search terms, with shared-keyword count, their keyword totals and average rank. Use when the user asks who their competitors are, or who a company is up against. Each result says whether we already have a full growth report for that domain — read those with read_report for free instead of tracing them again. Costs credits; cached results are free, and a domain already looked up via research_domain_overview is free here too.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to find competitors for, e.g. notion.so |
No output schema declared.
No examples provided.
research_domain_overview Domain SEO overview ~80
Estimated organic traffic, keyword count and top keywords for ANY domain — use to size up a competitor the user mentions. Costs credits; cached results are free, and repeated queries within a week hit the cache. For the user's own site prefer gsc_* (free, real data).
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain, e.g. competitor.com |
No output schema declared.
No examples provided.
research_keyword_volume Keyword search volume & difficulty ~202
Google Ads (Keyword Planner) monthly search volume, CPC, competition, 12-month trend and keyword difficulty (0–100, DataForSEO Labs) for up to 10 keywords in one call. Use when the user asks how often something is searched or how hard it is to rank, or to size a keyword before writing a page. Omit location_code for worldwide volume (difficulty is then computed for the US), or pass a market code for one country. Costs credits; the same keyword set re-queried within a week is free.
| Name | Type | Req | Description |
|---|---|---|---|
| keywords | string | yes | Up to 10 search phrases, comma-separated, e.g. "ai image generator, ai avatar maker" |
| location_code | number | – | Market: 2840 US, 2826 UK, 2276 DE, 2250 FR, 2724 ES, 2392 JP, 2076 BR, 2356 IN. Omit for worldwide. |
No output schema declared.
No examples provided.
research_serp_breakdown SERP top-10 breakdown ~183
Who holds the Google top 10 for one keyword in one market: per position the domain, URL, whether it is a homepage or an inner page, domain rating (0–1000) and estimated monthly organic traffic. Use when the user asks who ranks for a keyword, whether a keyword is winnable, or which slot is the weakest to go after. Pair with research_keyword_volume for volume and difficulty. Costs credits; the same keyword+market re-queried within a week is free.
| Name | Type | Req | Description |
|---|---|---|---|
| keyword | string | yes | One search phrase, e.g. "ai headshot generator" |
| location_code | number | – | Market: 2840 US (default), 2826 UK, 2276 DE, 2250 FR, 2724 ES, 2392 JP, 2076 BR, 2356 IN. |
No output schema declared.
No examples provided.
search_reports Search growth reports ~85
Use this FIRST whenever the user asks how a product, competitor or domain grew, got traffic, or found its first users — a report may already exist and reading it is free. Returns matching report slugs for read_report. Searches by domain or name fragment.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Domain or fragment, e.g. "weshop" or "weshop.ai" |
No output schema declared.
No examples provided.
site_audit_get Read a site audit ~64
Poll an audit started with site_audit_start (free to read). When finished, returns the issue list grouped by severity with affected URLs — work through it top-down and re-run after fixes.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | string | yes | Audit id from site_audit_start |
No output schema declared.
No examples provided.
site_audit_start Start a site audit ~138
Run right after deploying: crawls the site and reports broken links, missing titles/descriptions, redirect chains, thin content and schema gaps — each finding names the page so you can fix it here. Costs credits (price returned before any charge on the confirmation field). Async: poll with site_audit_get.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Set true only after the user agrees to the quoted credit cost |
| request_key | string | – | Request key returned by the first confirmation response; must be sent back with confirm=true so retries cannot charge twice |
| url | string | yes | Site to audit, e.g. https://example.com |
No output schema declared.
No examples provided.
start_trace Trace how a product grew ~109
Run this when search_reports finds nothing (or the user wants fresh data) for "how did X grow?". Rebuilds the growth story from 12 public sources in 60-90s. Costs credits from the Tracetify balance; returns an existing cached report free instead when one is fresh. Poll with get_trace.
| Name | Type | Req | Description |
|---|---|---|---|
| refresh | boolean | – | Force a fresh run even if a cached report exists |
| url | string | yes | Domain to trace, e.g. weshop.ai |
No output schema declared.
No examples provided.
unlock_report Unlock full timeline & evidence ~98
Permanently unlock a report's full timeline, evidence and SEO detail for this account. Costs credits — quote the exact price to the user first (it is in the report's timelineLocked.cost field from read_report) and call this ONLY after they explicitly agree to spend. Idempotent: unlocking an already-unlocked report never charges twice. The verdict stays on the website — you are the analyst here.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | Report slug |
No output schema declared.
No examples provided.
How do I install the io.github.tracetify/tracetify-mcp server?
io.github.tracetify/tracetify-mcp runs locally as an npm package, launched with npx -y tracetify-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · tracetify-mcp
claude mcp add tracetify-tracetify-mcp -- npx -y tracetify-mcp
What is the io.github.tracetify/tracetify-mcp server?
io.github.tracetify/tracetify-mcp is listed in the public MCP registry as io.github.tracetify/tracetify-mcp. Find competitors, trace how they grew, watch what they ship, plus your Search Console. This page covers its npm package (tracetify-mcp).
Is the io.github.tracetify/tracetify-mcp server safe to use?
io.github.tracetify/tracetify-mcp scores 80 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.tracetify/tracetify-mcp server expose?
io.github.tracetify/tracetify-mcp exposes 18 tools: search_reports, read_report, start_trace, get_trace, unlock_report, and 13 more. Their descriptions and schemas cost roughly 1,824 tokens of context every time the server is loaded.
Is the io.github.tracetify/tracetify-mcp server still maintained?
io.github.tracetify/tracetify-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.tracetify/tracetify-mcp server under?
io.github.tracetify/tracetify-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.