Free · No API key needed · Read-only

Free MCP server for SEO, AI visibility and security checks

In short: add https://audit.huutran.dev/mcp as a remote MCP server in Claude, Cursor, VS Code or ChatGPT, then ask things like "check whether perplexity can read example.com" or "run an SEO check on my pricing page". Three read-only tools, no account, no key.

Tools

Tool	What it does
`seo_check(url)`	On-page SEO check: title, meta description, H1, canonical, Open Graph, viewport, noindex, empty JavaScript app shells, robots.txt, XML sitemap, HTTPS, response time and HTML size. Score out of 100 with a fix for each issue. Same as the free SEO check.
`ai_visibility_check(url)`	Can AI crawlers and AI search tools read and cite the page: robots.txt rules for 12 crawlers, text in the raw HTML, llms.txt, JSON-LD, snippet controls, sitemap and MCP discovery. Same as the free AI visibility check.
`security_headers_check(url)`	Passive security check: HTTPS, HSTS, CSP, clickjacking protection, other security headers, cookie flags, SPF, DMARC, DKIM, CAA and DNSSEC, graded A to F with fixes. Same as the free headers check.
`full_site_crawl(url, max_pages)` paid key	Checks up to 25 pages from your XML sitemap (or homepage links): title, meta description, H1, canonical, noindex, html lang, Open Graph, thin content, HTTP errors, plus duplicate titles and descriptions across the site.
`compare_competitors(url, competitors)` paid key	Your page next to up to 3 competitors: response time, title and description length, H1, word count, JSON-LD types, llms.txt, AI crawlers blocked in robots.txt, security headers. On-page and technical signals only; no backlink or domain-authority metrics.
`bulk_check(urls)` paid key	Quick on-page check of up to 10 URLs in one call.

Each tool returns a readable text report and the same data as structuredContent. Through MCP you get every fix; there's no email step.

Connection details

URL: https://audit.huutran.dev/mcp
Transport: Streamable HTTP, JSON responses, stateless
Auth: none for the free tools; optional Authorization: Bearer <key> for the paid tier
Limits: free: 10 calls per tool per hour per IP, 30 tool calls per hour per IP. Paid key: 300 tool calls per hour, 100 per check, 30 per paid tool
Server card: /mcp/server-card, listed in /.well-known/ai-catalog.json

Claude (web and desktop)

Open Settings, then Connectors, choose Add custom connector, name it HolicAudit and paste https://audit.huutran.dev/mcp. Leave the OAuth fields empty. Which plans can add custom connectors is up to Anthropic and may change.

On older Claude Desktop versions without custom connectors, add it to claude_desktop_config.json through the mcp-remote bridge (needs Node.js), then restart Claude:

{
  "mcpServers": {
    "holicaudit": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://audit.huutran.dev/mcp"]
    }
  }
}

Claude Code

claude mcp add --transport http holicaudit https://audit.huutran.dev/mcp

Cursor

Add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json in a project, then enable it under Settings, MCP:

{
  "mcpServers": {
    "holicaudit": {
      "url": "https://audit.huutran.dev/mcp"
    }
  }
}

VS Code (GitHub Copilot agent mode)

Add to .vscode/mcp.json:

{
  "servers": {
    "holicaudit": {
      "type": "http",
      "url": "https://audit.huutran.dev/mcp"
    }
  }
}

ChatGPT

ChatGPT can connect to remote MCP servers as custom apps (connectors) when developer mode is turned on in Settings, under Apps and Advanced settings. Create a new app, paste https://audit.huutran.dev/mcp as the server URL and choose no authentication. OpenAI changes these menus and the plans that include them often, so check its current help pages if the names differ.

Any client, or plain curl

curl -s https://audit.huutran.dev/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"ai_visibility_check","arguments":{"url":"example.com"}}}'

You can also explore it with the MCP Inspector: npx @modelcontextprotocol/inspector, transport "Streamable HTTP", URL as above.

Paid API key: $15 for 3 months

The free tools stay free. A key adds higher limits (300 tool calls per hour, 100 per check) and the three paid tools above. Prepaid with USDT (TRC20) or PayPal, no automatic renewal. Your key appears on your invoice page as soon as the payment is confirmed, and we email it too. Ordering again with the same email extends the same key.

Get an API key, $15 / 3 months

Send it as a header. Cursor (and most clients that take a URL):

{
  "mcpServers": {
    "holicaudit": {
      "url": "https://audit.huutran.dev/mcp",
      "headers": { "Authorization": "Bearer hak_your_key_here" }
    }
  }
}

Claude Code:

claude mcp add --transport http holicaudit https://audit.huutran.dev/mcp --header "Authorization: Bearer hak_your_key_here"

A key that's wrong or expired gets an HTTP 401 with a clear message; remove the header to fall back to the free tier.

Frequently asked questions

Does it need an API key or account?

No. The three free tools need no key or account. Each is limited to 10 calls per hour per IP address, and 30 tool calls per hour in total. An optional paid API key ($15 for 3 months, prepaid) raises the limits to 300 calls per hour and adds full_site_crawl, compare_competitors and bulk_check.

What does the paid key add?

Higher limits (300 tool calls per hour, 100 per check, 30 per hour for each paid tool) and three tools: full_site_crawl checks up to 25 pages from your sitemap, compare_competitors puts your page next to up to 3 competitors, and bulk_check checks up to 10 URLs at once. It's prepaid for 3 months with no automatic renewal; ordering again with the same email extends the same key. The paid tools report on-page and technical signals only, not backlinks or domain authority.

Is it safe to point at any site?

The tools only make ordinary public requests: one page load plus a few public files such as robots.txt, or public DNS records for the security check. They never log in, submit forms, or probe for vulnerabilities, and private or internal addresses are refused.

Which MCP protocol versions does it support?

Streamable HTTP with JSON responses, stateless (no session ID), protocol versions 2025-11-25, 2025-06-18 and 2025-03-26. GET on /mcp returns 405 because there's no server-sent event stream.

Can I remove image metadata through it?

No. Our PurgeMeta image metadata remover runs entirely in your browser so images never leave your device; that can't be done by a remote server.

What do you store?

The same as the web versions of the checks: the checked address and its results for 30 days (so the share link works), and short-lived per-IP rate-limit counters. See the privacy policy.

Questions or a tool you'd like added? Email hello@huutran.dev.