AEO with an API and an MCP server
Short answer: We built this, so treat the recommendations accordingly. There are three ways to run an AI-visibility audit without opening a browser, and they suit genuinely different jobs. An HTTP endpoint returns a scored JSON report for one URL, which is what you want in CI or a script. Three hosted MCP servers expose 31 read-only tools to an AI assistant, which is what you want when the thing doing the analysis is itself a model. And the scoring engine is on npm under Apache-2.0, which is what you want if you are auditing at any volume, because the hosted endpoint is rate-limited to ten audits per IP per ten minutes and will not serve a bulk job. Every number here was checked against the live system on 2026-10-02, including the ones that make us look worse.
## three_ways
Three access modes, and which job each one fits
These are not tiers. Nothing is gated behind payment and nothing is a trial. They are three different shapes of the same engine, and picking the wrong one is the usual reason people conclude the thing does not work.
| Mode | Use it when | Auth | Ceiling |
|---|---|---|---|
| HTTP API | A script, a CI check, or a dashboard needs one scored report for one URL | None | 10 audits per IP per 10 minutes |
| MCP servers | An AI assistant is doing the analysis and should call tools instead of guessing | Two of three need none; the search server needs Google | Conversation-paced, not a bulk channel |
| npm packages | You are auditing more than a handful of sites, or you want the rules in your own pipeline | Yours to run | Your own infrastructure |
The short answer for most people reading this
If you are auditing one site, use the API. If you are auditing a list, do not use the API — install the packages. The rate limit is not a paywall nudge, it is the reason bulk work has to run somewhere else, and we would rather say that here than have you discover it at request eleven.
## the_api
The HTTP API
One POST, one JSON report. No key, no account, no sign-up step. This is the same endpoint the browser tool calls, so what you get back is exactly what the hosted audit shows.
curl -X POST https://advancelabs.dev/api/audit/technical \
-H 'Content-Type: application/json' \
-d '{"url":"https://example.com"}'The response is a graded score broken into weighted categories, and every category carries its individual findings. A finding is not a sentence of advice: it is a structured object with a stable id, a severity, whether it passed, the weight it carried, and a documentation link. Those stable ids are the part that matters if you are diffing runs over time, because the wording of a title can change between engine versions and the id will not.
{
"url": "https://example.com/",
"generatedAt": "2026-10-02T05:27:27.620Z",
"score": {
"overall": 50,
"grade": "F",
"categories": [
{
"key": "crawlability",
"label": "Crawlability",
"score": 58,
"weight": 50,
"findings": [
{
"id": "tech.robots-present",
"severity": "high",
"title": "robots.txt is present",
"passed": false,
"weight": 8,
"recommendation": "Add a robots.txt at the site root referencing your sitemap.",
"docsUrl": "https://developers.google.com/search/docs/..."
}
]
}
]
}
}That is a real response, trimmed for length. example.com scores 50 and grades F, which is a useful sanity check on what the number means: a page with no robots.txt, no sitemap and no structured data is not a broken website, it is a site that has published nothing for a machine to read. The grade measures machine-readability, not quality.
The limit, precisely
Ten audits per IP per ten minutes, enforced as a sliding window. Exceed it and you get a refusal with a Retry-After hint rather than a truncated report. The limit exists because each audit crawls someone else's site on your behalf, and an unbounded public endpoint pointed at third-party servers is a abuse vector, not a feature.
## the_mcp
The MCP servers: 31 read-only tools
The MCP servers exist for a different situation: when the thing doing the analysis is an AI assistant rather than your code. Instead of asking a model what it thinks your AI visibility looks like and getting a confident guess, the model calls a tool and reads real data back.
They are hosted Streamable-HTTP endpoints. There is nothing to install and no local process to run, which is the main practical difference from most MCP servers you will have set up.
| Server | Tools | Auth | What it answers |
|---|---|---|---|
| AI Visibility | 5 | None | Does an AI engine name this company, for which prompts, and how does that compare to a competitor |
| Backlink | 7 | None | Who links to a competitor and not to you, who mentions you without linking, is a link still live |
| Search | 19 | Google sign-in or your own keys | Your first-party Search Console, GA4 and Bing data: top queries, decay, cannibalization, CTR gaps |
Connecting takes one command per server in Claude Code. The trailing path segment is required; pointing at the bare namespace returns the adapter's own not-found rather than a connection.
claude mcp add --transport http --scope user aeo-visibility \
https://aeo.advancelabs.dev/api/mcp/ai-visibility/mcp
claude mcp add --transport http --scope user aeo-backlink \
https://aeo.advancelabs.dev/api/mcp/backlink/mcp
claude mcp add --transport http --scope user aeo-search \
https://aeo.advancelabs.dev/api/mcp/search/mcpFor Claude.ai, Cursor, Windsurf or anything else that takes a URL or a JSON block, the connection page has the exact configuration for each.
MCP connection details for every clientEvery tool is read-only, and that is a design constraint rather than a limitation we plan to lift
No tool on any of the three servers calls a write method on any upstream API. An assistant connected to these can read your Search Console and report what it finds; it cannot submit a sitemap, request indexing, change a property, or send an email. Connecting an agent to a system that can only read is a materially different risk decision from connecting one that can act, and keeping that line bright is worth more than the convenience of crossing it.
## auth
Why two servers need no login and one does
AI Visibility and Backlink read public information. Whether ChatGPT names your company, and who links to whom, are both facts about the open web, so there is nothing to authenticate and no account to create.
The search server is different because it reads your first-party analytics. That data is yours and Google requires consent to release it, so an anonymous request gets a 401 that points the client at an authorization server, and the client walks a standard OAuth flow with Google's own consent screen as the approval step. If you would rather not do that, your own Google and Bing keys still work directly.
One deliberate oddity you may notice
The OAuth discovery documents at the domain root return 404 on purpose. Advertising OAuth at the root would drag the two keyless servers into a login they do not need, so discovery is scoped to the one server that requires it. If you are debugging a connection and find that 404, it is the intended behaviour and not the fault.
## self_host
Or skip all of it and run the engine yourself
This is the part a product page would leave out. The scoring engine is not a hosted secret: it is four packages on npm under Apache-2.0, and the hosted API is a thin wrapper around them. If you are auditing more than a handful of URLs, running them yourself is not a workaround, it is the intended path.
| Package | Version | Does |
|---|---|---|
| @advance-labs/crawler | 0.2.2 | Fetches pages, respects robots.txt, rate-limits per host |
| @advance-labs/html-parser | 0.2.2 | Extracts the signals the rules read |
| @advance-labs/schema-validator | 0.2.2 | Validates structured data |
| @advance-labs/scoring | 0.2.2 | The rules and the weighted score |
The pipeline is crawl, parse, validate structured data, score. With your own infrastructure there is no per-IP limit, you can set your own page cap and concurrency, and you can pin an engine version so a rules change does not silently move every score you have recorded.
Pin the version if you are tracking scores over time
Every score is a function of the rule set that produced it. When the rules change, every score shifts, and a trend line that spans two engine versions is measuring two different things. Record the engine version alongside each score. We hit this on our own leaderboard work and it is the single easiest way to publish a number you cannot reproduce.
The rules are open, which also means there is nothing to game. Improving the score requires improving the site, because the score is just a reading of what a machine can find on it.
## limits
What it does not do
- It does not write anything, anywhere: Every MCP tool is read-only and the API only returns a report. Nothing here submits a sitemap, requests indexing, or edits a property. If you want an agent that acts, this is not it, by design.
- The hosted API will not do bulk: Ten per IP per ten minutes. A list of a few hundred sites is roughly seven hours against the hosted endpoint and about twenty minutes against the packages. Use the packages.
- A score is a reading, not a ranking prediction: It measures what a machine can find and verify on your site. It does not predict whether an engine will cite you, because that depends on your competitors, the query, and decisions made inside systems nobody outside those companies can see.
- AI visibility checks are sampled, not continuous: Answer engines are non-deterministic and the same prompt can produce a different answer an hour later. A single check is a reading at a moment. Treat a trend across repeated checks as the signal and any one result as weak evidence.
If you would rather see the output before wiring anything up, the same engine runs as free browser tools with no sign-up.
Run an audit in the browser first## faq
Is there an API for AEO audits?
Yes. POST a JSON body of {"url": "..."} to https://advancelabs.dev/api/audit/technical and you get a graded report back with weighted categories and individual findings, each carrying a stable id, severity, pass state and documentation link. No key or account is required. It is rate-limited to ten audits per IP per ten minutes, so for bulk work install the Apache-2.0 packages and run the engine yourself instead.
What MCP servers does Advance Labs offer?
Three hosted Streamable-HTTP servers exposing 31 read-only tools in total: AI Visibility (5 tools, no auth) for whether AI engines name a company, Backlink (7 tools, no auth) for link prospecting and verification, and Search (19 tools, Google sign-in or your own keys) for first-party Search Console, GA4 and Bing data. Nothing is installed locally; you point an MCP client at the URL.
Can I self-host the AEO scoring engine?
Yes, and for any volume you should. The engine is four npm packages under Apache-2.0 at version 0.2.2: @advance-labs/crawler, html-parser, schema-validator and scoring. The pipeline is crawl, parse, validate structured data, score. Self-hosting removes the per-IP rate limit and lets you pin an engine version so a rules change does not silently move scores you have already recorded.
Can an AI agent change my site through these MCP tools?
No. Every tool on all three servers is read-only and none calls a write method on any upstream API. An assistant can read your Search Console data and report what it finds, but cannot submit a sitemap, request indexing, alter a property or send anything. That boundary is deliberate and is not planned to change.