MCP server

The Rank Prompt MCP server is a hosted remote Model Context Protocol server at https://mcp.rankprompt.com/mcp. It exposes your AI visibility data (brands, reports, citations) as tools any MCP client can call, plus generic read, write, and delete over the /v1 API. Same data and the same entitlement as the API; nothing to host or keep running.

For the product overview see the MCP landing page. This page is the technical reference.

Connect

Pick your client, add the server, then authenticate. In Claude Code you sign in over OAuth and never paste a key. Other clients point at the URL and approve in the browser, or fall back to an API key.

claude mcp add --transport http --scope user rankprompt https://mcp.rankprompt.com/mcp

{
"mcpServers": {
  "rankprompt": {
    "url": "https://mcp.rankprompt.com/mcp"
  }
}
}

--scope user makes the server available in every project. Once connected, call rankprompt_prime first: it returns your entitlement status and the canonical workflow the agent should follow.

Authentication

Two ways to authenticate, both resolving to a scoped /v1 API key:

• OAuth 2.1 (interactive clients). The client registers over dynamic client registration, then you approve access on a consent screen and sign in with Google. The flow uses PKCE (S256), so no secret ends up in your shell history. The access token the server issues carries your API key encrypted: the client can read the token but not the key, which is decrypted server-side only to call /v1.
• Pass-through API key (headless / CI). Send a rp_live_... key as the bearer token. Mint one on the Developers page inside your workspace. Use this for clients without a built-in OAuth flow.

Either way, every call is bound to the key’s scopes and brand restriction, and revoking a key takes effect on its next call.

Scopes

The consent screen recommends the scopes of the everyday toolset: brands, reports, prompts, citations, jobs, page audit, scheduled reports, region configs, competitors, content, CMS connections, brand audits, tasks, analytics, SEO, reading outreach, account metadata and billing, read and write where a tool needs it. Sending outreach email, community threads, Google Business Profile, client reports, the agency portfolio and prospect searches are offered unticked. You can grant more or fewer in the picker. The generic rankprompt_read, rankprompt_write, and rankprompt_delete tools reach any /v1 path within the scopes granted; an endpoint outside them returns insufficient_scope.

Implementing your own client

Discovery is standard, so any compliant MCP client connects with no manual config. All paths are on the server origin mcp.rankprompt.com:

Public clients only (token_endpoint_auth_method: none), the authorization_code grant, and PKCE S256 are required. A tools/call sent without a token returns 401 with a WWW-Authenticate header pointing at the protected-resource metadata, which is the pointer MCP clients follow to start OAuth.

Tools

The tools are the ones the in-app Agent runs, generated from the same catalog, so the server and the Agent never drift, each with typed arguments and its credits and plan in its description. Each one calls its own /v1 endpoint with your key, so it takes that endpoint’s scope, request units and credits and answers its JSON; rankprompt_schema with tool names the endpoint. Pass dry_run: true to see what a write would spend without running it. A tool that deletes something or acts outside Rank Prompt (sends mail, publishes, opens a checkout) first answers a dry run of the call and what it would do, and runs once called again with confirm: true after you agree.

Built in

By area

The Agent’s chat helpers (help search, the page on screen, plans, memory), its ready-to-paste copy, its GitHub repo browser and the team list stay in the app.

The workflow

Run it end to end. The value is in shipping the fixes, not in “report done”. rankprompt_prime returns this loop in full.

1. Pick or create a brand, and make sure it has facts. A report cannot run without them.
2. Create a report and choose the engines.
3. Seed prompts (the questions engines answer), or auto-generate them.
4. Run the report and read it back until it completes.
5. Read the summary (score plus AI analysis), the cited sources and the suggested tasks: those are the to-do list.
6. Audit your pages, implement the fixes in your repo, then track over time with a schedule, and find new questions to track with rankprompt_discover_prompts.

Engines and credits

Reports measure mentions and citations across six answer engines, all on every plan: chatgpt, claude, gemini, grok, perplexity and ai_overviews (Google AI Mode). Choose the platforms when you create a report; with none picked it runs on chatgpt, claude and ai_overviews.

• 1 credit per prompt covers up to 3 platforms.
• 2 credits per prompt cover 4 to 6, so all six cost 2.

See Pricing for the full cost model.

Security

• OAuth 2.1 with PKCE (S256): browser sign-in, no secret in your shell history.
• Dynamic client registration plus an explicit consent screen with Google sign-in.
• Your API key is never exposed to the client. It is carried encrypted inside the access token and decrypted server-side only to call /v1.
• Scoped, brand-restricted access. Revocation is enforced on every call.
• A hosted remote server; the OAuth endpoints are rate-limited per IP.