SEO MCP Authentication and Access

SEO MCP uses an OAuth authorization-code flow with PKCE. The access grant carries the mcp:use scope and belongs to the authenticated Screpy member. Project access is checked again on every tool call.

Authentication flow

1. Your MCP client discovers the server’s authorization metadata.
2. The client creates or identifies its OAuth application.
3. You sign in and approve access in the browser.
4. The client exchanges the authorization code using its PKCE verifier.
5. The client uses the scoped token for SEO MCP calls.

PKCE protects the authorization-code exchange. The client does not need your Screpy password, and the MCP server does not expose raw account credentials to the model.

What the scope allows

The mcp:use scope allows the client to call the registered member tools. It does not bypass application authorization.

Every project operation must still pass:

• Member authentication.
• Email verification in production.
• Project ownership or shared-access checks.
• Tool-specific validation.
• Rate limits.
• Confirmation rules for high-impact operations.

Read and write behavior

Most SEO analysis uses read-only tools. State-changing tools include:

• create_project
• update_project_settings
• delete_project
• start_crawl
• add_rank_tracker_keywords and delete_rank_tracker_keywords
• create_rank_tracker_segment, update_rank_tracker_segment, and delete_rank_tracker_segment
• add_ai_visibility_prompts and delete_ai_visibility_prompt

Agents are instructed not to use these tools unless the user explicitly requests the action. Some tools expose a confirm input for the final execution step. Before setting it, identify the exact project, target records, and effect. Adding tracked keywords or monitored prompts can consume plan capacity.

Safe prompting

Use explicit boundaries when the task is investigative:

Analyze only. Do not create projects, change settings, delete data, or start a crawl.
Use the latest completed crawl and cite the records behind every recommendation.

For a requested change, separate planning from execution:

Show the exact crawl configuration you would use and explain its impact.
Do not start the crawl until I confirm.

Revoking access

Remove the SEO MCP connection from your client and revoke its application authorization from your account when it is no longer needed. If a device or client is compromised, revoke access before reconnecting.

See Security and permissions for the full operating model.