SEO & GEO MCP Server

seo-geo-mcp-server is a TypeScript MCP (Model Context Protocol) server that gives an AI agent —like Claude— 17 read-only tools to audit a page along two dimensions: classic SEO (meta tags, headings, structured data, images, links, robots.txt, sitemaps, hreflang, redirects) and GEO (Generative Engine Optimization): whether ChatGPT, Claude, Perplexity or Gemini can actually crawl, read and cite that page. No API keys — everything runs on public HTTP, DNS and robots.txt.

Nothing to clone: claude mcp add seo-geo -- npx -y seo-geo-mcp-server

It is the sibling of the domain security MCP server and shares its architecture: a pure core with no MCP coupling, thin tool wrappers, and an SSRF guard that checks the IP address at connect time, on every redirect hop.

Why GEO, not just SEO

The GEO side exists because two mechanisms decide whether an AI can cite you, and almost nobody checks them:

• Blocking training is not the same as blocking citation. Blocking GPTBot stops training; blocking OAI-SearchBot removes you from ChatGPT’s results. Plenty of sites that meant the first have done the second without realising. The server separates the two groups and says so.
• Most AI crawlers do not execute JavaScript. Googlebot does; GPTBot, ClaudeBot, PerplexityBot and CCBot largely do not. A client-rendered page can rank perfectly well in Google and be invisible to every AI assistant. The server detects that case.

Features

• 17 tools with typed output: every tool declares an inputSchema and outputSchema (Zod) and returns structuredContent validated by the SDK, alongside human-readable markdown.
• Two flagship tools: seo_audit scores seven weighted sections from a single page fetch and returns an A–F grade with prioritised fixes; geo_audit scores AI answer-engine readiness across seven signals.
• Crawler registry verified against official documentation from OpenAI, Anthropic, Google, Perplexity, Apple, Meta, Amazon, Mistral and others. Each token records its provenance (first-party docs or community aggregator) and whether the vendor actually honours robots.txt.
• RFC 9309-compliant robots.txt matcher: case-insensitive tokens, group merging, longest-match with allow-wins-tie, * wildcards and $ anchors, plus Apple’s documented quirk (Applebot inherits Googlebot’s rules).
• Honesty by design: llms.txt is detected and validated but deliberately not scored, because it is an unadopted community proposal and Google has stated it does not use it. Blocks on bots documented to ignore robots.txt are reported as unenforceable rather than as clean blocks.
• Two transports: stdio for local clients (Claude Desktop / Claude Code / Cursor) and stateless Streamable HTTP for self-hosting behind a reverse proxy (Coolify/Traefik), safe by default: loopback bind, Host and Origin validation and an optional Bearer token.
• What the audited site controls is bounded: the server fetches URLs the site itself names (links, og:image, sitemaps, redirects), so none of them can point into an internal network; the robots.txt matcher uses no regular expressions (a hostile pattern cannot freeze it); a page nested more than 512 levels deep is refused before parsing; and .gz sitemaps are decompressed with a cap.
• Tested and published: 49 deterministic unit tests (SSRF guard, robots matcher, sitemaps, SPA detection, JSON-LD, HTTP transport), a smoke test that calls all 17 tools on both protocol eras, CI on Node 20, 22 and 24 that boots the package through npx and the Docker image, and published to npm and the official MCP Registry.

Tech stack

• TypeScript, strict (noUncheckedIndexedAccess, outputSchema on all 17 tools)
• MCP SDK v2 (@modelcontextprotocol/server): serves the 2026-07-28 revision and 2025-era clients from one factory
• Zod 4 for input and output validation
• Cheerio for DOM parsing
• Express 5 for the stateless HTTP transport
• Node.js (undici with the SSRF guard in its lookup, manual redirects, byte caps)
• Docker for self-hosted deployment

Repository

View on GitHub → · Package on npm →

Goal

To fill a real gap: on-page SEO tools are web UIs an agent cannot operate, and GEO tooling is mostly paid rank-tracking dashboards. This server puts both within reach of an agent, key-free, and with an explicit position on which signals are backed by vendor documentation and which are not.