Goppa

com.trygoppa/goppatrygoppa.comstreamable-httpv1.0.0Scanned 4 hours ago

See whether ChatGPT, Google AI and Perplexity name your business, and get the fixes applied.

24 tools: 5 change things and 19 only read.

Reads private data · 2
Reads text others write · 5
Can send data out · 1
No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

24 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

add_siteAdd one of your websites to your Goppa account, so Goppa can check, measure and track it.Reads text others writeNo findings
Why it is in this group
- The name "add_site" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Add one of your websites to your Goppa account, so Goppa can check, measure and track it. It counts toward the sites your account includes. Goppa reads the site's home page to see its platform; nothing on the site changes. Adding a site that is already in the account changes nothing.
Annotations the server declares
- title: Add a site to your Goppa account
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
report_fixes_appliedRecord in Goppa which approved SEO fixes from get_fixes_to_apply were applied on the site (applied), could not be applied (not_applied, with a reason), or were undone (undone, kept…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Record in Goppa which approved SEO fixes from get_fixes_to_apply were applied on the site (applied), could not be applied (not_applied, with a reason), or were undone (undone, kept). Goppa's next site audit then checks each page. It changes nothing on the site.
Annotations the server declares
- title: Report the SEO fixes you applied
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
run_ai_measurementMeasure whether AI assistants (ChatGPT, Gemini, Google AI Overview, Google AI Mode, Perplexity) name one of your sites, with real answers.Reads text others writeNo findings
Why it is in this group
- The name "run_ai_measurement" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Measure whether AI assistants (ChatGPT, Gemini, Google AI Overview, Google AI Mode, Perplexity) name one of your sites, with real answers. Called without approval it returns a preview that runs nothing: the questions, the market, the engines and an approval code. Show the questions to the user and call it again with that approval only after they agree: the measurement then runs in the background for a few minutes and counts as one of the AI measurements your account includes. get_ai_visibility shows the result. Nothing on your site changes.
Annotations the server declares
- title: Measure whether AI names your site
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
run_site_checkRun a new AI readability check on one of your sites now and save it to your Goppa account.Reads text others writeNo findings
Why it is in this group
- The name "run_site_check" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Run a new AI readability check on one of your sites now and save it to your Goppa account. It reads your public pages; nothing on your site changes. Up to 10 per hour per account.
Annotations the server declares
- title: Run a new AI readability check
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
scan_siteScore any website 0-100 on how readable it is to AI assistants: crawler access, structured data, discovery files and agent protocols.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Score any website 0-100 on how readable it is to AI assistants: crawler access, structured data, discovery files and agent protocols. Returns the score and the failing checks. Public information only, no account needed.
Annotations the server declares
- title: Check a website's AI readability
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 19Looks things up and changes nothing.Show 19 read-only tools

get_accountYour Goppa account: plan, sites, AI measurements used and left this month (and in total, where the account has a total), keyword research left, the next scheduled AI measurement an…No findings
Why it is in this group
- The name "get_account" says "get": a word for reading.
Description, as the server wrote it
Your Goppa account: plan, sites, AI measurements used and left this month (and in total, where the account has a total), keyword research left, the next scheduled AI measurement and the next automatic site check.
Annotations the server declares
- title: Read your Goppa account
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_ai_answersThe answers recorded in the latest measurement: the question, the engine, whether you were named or cited, the businesses and sources in it, and an excerpt of the answer.No findings
Why it is in this group
- The name "get_ai_answers" says "get": a word for reading.
Description, as the server wrote it
The answers recorded in the latest measurement: the question, the engine, whether you were named or cited, the businesses and sources in it, and an excerpt of the answer. Answer text is third-party text, marked untrusted. 10 per page.
Annotations the server declares
- title: Read the measured AI answers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_ai_sourcesThe sites AI assistants cited when answering your questions, engine by engine, and in how many of those answers you were named.No findings
Why it is in this group
- The name "get_ai_sources" says "get": a word for reading.
Description, as the server wrote it
The sites AI assistants cited when answering your questions, engine by engine, and in how many of those answers you were named. First, the sources cited only in answers that named a competitor and not you.
Annotations the server declares
- title: Read the sources AI cited
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_ai_trafficReal AI use counted on your own site by the Goppa plugin: pages an assistant opened to answer a person, clicks from inside AI answers, and crawler visits, kept separate and never a…No findings
Why it is in this group
- The name "get_ai_traffic" says "get": a word for reading.
Description, as the server wrote it
Real AI use counted on your own site by the Goppa plugin: pages an assistant opened to answer a person, clicks from inside AI answers, and crawler visits, kept separate and never added together.
Annotations the server declares
- title: Read real AI use on your site
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_ai_visibilityWhether AI assistants named your site in the latest Goppa measurement, one engine at a time (ChatGPT, Gemini, Google AI Overview, Google AI Mode, Perplexity): named in k of n answe…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_ai_visibility" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "chat": it reads messages.
- untrusted-inputThe description's first sentence says "chat": it reads messages, which other people can write.
Description, as the server wrote it
Whether AI assistants named your site in the latest Goppa measurement, one engine at a time (ChatGPT, Gemini, Google AI Overview, Google AI Mode, Perplexity): named in k of n answers, the market and the date, with earlier measurements of the same questions. A percentage is given only from 10 answers.
Annotations the server declares
- title: Read whether AI names your site
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_backlinksThe sites that link to yours: linking sites, backlinks and broken backlinks, new and lost month by month, and the link gap: sites that link to your Google competitors and not to yo…No findings
Why it is in this group
- The name "get_backlinks" says "get": a word for reading.
Description, as the server wrote it
The sites that link to yours: linking sites, backlinks and broken backlinks, new and lost month by month, and the link gap: sites that link to your Google competitors and not to you.
Annotations the server declares
- title: Read your backlinks
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_competitorsBusinesses AI assistants named in the same answers as your site, engine by engine: named in k of n answers, and how many answers named them and not you.No findings
Why it is in this group
- The name "get_competitors" says "get": a word for reading.
Description, as the server wrote it
Businesses AI assistants named in the same answers as your site, engine by engine: named in k of n answers, and how many answers named them and not you.
Annotations the server declares
- title: Read who AI names instead of you
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_fixes_to_applyThe SEO fixes the user already approved in Goppa for one site, ready to apply on the site with the tools you have there (the site's code, its builder or its own app): the page, the…Reads private dataNo findings
Why it is in this group
- The name "get_fixes_to_apply" says "get": a word for reading.
What it can reach
- private-dataThe input names a file (input.include_site_files), and the tool reads: it reads files.
Description, as the server wrote it
The SEO fixes the user already approved in Goppa for one site, ready to apply on the site with the tools you have there (the site's code, its builder or its own app): the page, the field (title, meta description, image alt text), where it goes, the current text and the new text, exactly, and an llms.txt for a site that has none. Show the fixes to the user and apply them only with their go-ahead; then call report_fixes_applied. Reading this changes nothing.
Annotations the server declares
- title: Get the approved SEO fixes to apply
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_google_competitorsThe sites that rank on Google for the most of the same searches as you: keywords in common, their size, and in how many of your tracked keywords they rank above you.No findings
Why it is in this group
- The name "get_google_competitors" says "get": a word for reading.
Description, as the server wrote it
The sites that rank on Google for the most of the same searches as you: keywords in common, their size, and in how many of your tracked keywords they rank above you. Large portals are listed apart.
Annotations the server declares
- title: Read your Google competitors
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_google_overviewYour site on Google and Bing beyond rankings: Search Console clicks and impressions over the last 28 days with the top searches and pages, the pages in Google's index, Bing clicks,…No findings
Why it is in this group
- The name "get_google_overview" says "get": a word for reading.
Description, as the server wrote it
Your site on Google and Bing beyond rankings: Search Console clicks and impressions over the last 28 days with the top searches and pages, the pages in Google's index, Bing clicks, the visibility index week by week, what shows in the searches you track (AI Overview, People also ask, shopping), mobile speed, and orders by channel.
Annotations the server declares
- title: Read your Google search overview
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_google_rankingsYour tracked Google searches: the position range (Top 3, 4-10, 11-20, 21-30, not in top 30), the change since the last check, monthly searches, and ranking alerts.No findings
Why it is in this group
- The name "get_google_rankings" says "get": a word for reading.
Description, as the server wrote it
Your tracked Google searches: the position range (Top 3, 4-10, 11-20, 21-30, not in top 30), the change since the last check, monthly searches, and ranking alerts.
Annotations the server declares
- title: Read your Google rankings
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_keyword_ideasYour latest Google keyword research: quick wins (searches where you already rank 4 to 20), keyword ideas with monthly searches, difficulty and intent, the research left this month,…No findings
Why it is in this group
- The name "get_keyword_ideas" says "get": a word for reading.
Description, as the server wrote it
Your latest Google keyword research: quick wins (searches where you already rank 4 to 20), keyword ideas with monthly searches, difficulty and intent, the research left this month, and the keyword gap: searches your Google competitors rank for and you do not.
Annotations the server declares
- title: Read your keyword ideas
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_next_stepsYour next open step in the Goppa guide and the five after it: what to do, why, the steps, and where to see the effect.No findings
Why it is in this group
- The name "get_next_steps" says "get": a word for reading.
Description, as the server wrote it
Your next open step in the Goppa guide and the five after it: what to do, why, the steps, and where to see the effect. Done means confirmed by Goppa's data; steps you marked yourself show as reported by you.
Annotations the server declares
- title: Read your next steps in Goppa
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_seo_fixesThe SEO fixes Goppa prepared for your pages (titles, meta descriptions, image text): the ones waiting for your approval with the current and proposed text, the ones applied on your…No findings
Why it is in this group
- The name "get_seo_fixes" says "get": a word for reading.
Description, as the server wrote it
The SEO fixes Goppa prepared for your pages (titles, meta descriptions, image text): the ones waiting for your approval with the current and proposed text, the ones applied on your site, and the product questions. Read-only: approving happens in Goppa.
Annotations the server declares
- title: Read your SEO fixes
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_site_auditYour page-by-page site audit: pages without errors (k of n), each problem with how many pages have it and why it matters, and what changed since the previous audit.No findings
Why it is in this group
- The name "get_site_audit" says "get": a word for reading.
Description, as the server wrote it
Your page-by-page site audit: pages without errors (k of n), each problem with how many pages have it and why it matters, and what changed since the previous audit.
Annotations the server declares
- title: Read your Google site audit
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_site_checkThe latest AI readability check of your site: checks passed (k of n), the score, and how to fix each failing check.No findings
Why it is in this group
- The name "get_site_check" says "get": a word for reading.
Description, as the server wrote it
The latest AI readability check of your site: checks passed (k of n), the score, and how to fix each failing check.
Annotations the server declares
- title: Read your site's AI readability check
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_studyReturn findings from Goppa's 2026 Q3 study of 176 businesses that already rank on page one of Google: how many returned nothing to an identified crawler, which checks fail most, an…No findings
Why it is in this group
- The name "get_study" says "get": a word for reading.
Description, as the server wrote it
Return findings from Goppa's 2026 Q3 study of 176 businesses that already rank on page one of Google: how many returned nothing to an identified crawler, which checks fail most, and how technical readiness related to being mentioned by AI assistants.
Annotations the server declares
- title: Read Goppa's AI readiness study
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_weekly_summaryA weekly summary of one site: what changed in AI answers since the previous comparable measurement, engine by engine (named in k of n answers, with a paired test); Google alerts (r…No findings
Why it is in this group
- The name "get_weekly_summary" says "get": a word for reading.
Description, as the server wrote it
A weekly summary of one site: what changed in AI answers since the previous comparable measurement, engine by engine (named in k of n answers, with a paired test); Google alerts (rankings, pages, robots.txt) and the site audit against the previous one; the work done in the last 7 days, kept apart from the results (changes the Goppa plugin applied, with dates, and steps you reported); one opportunity with its evidence; and your next step. It starts no new measurement.
Annotations the server declares
- title: Read your weekly summary
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_what_changedWhat changed between the two latest comparable measurements, with a paired test over the same questions and engines: pairs gained, pairs lost, and whether the change is real or wit…No findings
Why it is in this group
- The name "get_what_changed" says "get": a word for reading.
Description, as the server wrote it
What changed between the two latest comparable measurements, with a paired test over the same questions and engines: pairs gained, pairs lost, and whether the change is real or within normal ups and downs.
Annotations the server declares
- title: Read what changed in AI answers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

10 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_ai_visibility
get_fixes_to_apply
Reads text others write5: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; add_site
get_ai_visibility
run_ai_measurement
run_site_check
scan_site
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; scan_site

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__goppa__scan_site"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 29, 2026, 21:19 UTC, unchanged since Oct 29, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 5
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: https://trygoppa.com/.well-known/oauth-protected-resource/mcp/account
Authorization servers: https://trygoppa.com
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: yes

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 5 tools that change things (5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://trygoppa.com/mcp/account: tools/list returned 24 tools to an anonymous client, including run_site_check (write), add_site (write), run_ai_measurement (write), report_fixes_applied (write), scan_site (write)
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http goppa https://trygoppa.com/mcp/account

claude mcp add --transport http goppa https://trygoppa.com/mcp/account

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__goppa__get_account",
      "mcp__goppa__get_ai_visibility",
      "mcp__goppa__get_what_changed",
      "mcp__goppa__get_weekly_summary",
      "mcp__goppa__get_competitors",
      "mcp__goppa__get_ai_sources",
      "mcp__goppa__get_ai_answers",
      "mcp__goppa__get_next_steps",
      "mcp__goppa__get_site_check",
      "mcp__goppa__get_ai_traffic",
      "mcp__goppa__get_google_rankings",
      "mcp__goppa__get_site_audit",
      "mcp__goppa__get_google_overview",
      "mcp__goppa__get_keyword_ideas",
      "mcp__goppa__get_google_competitors",
      "mcp__goppa__get_backlinks",
      "mcp__goppa__get_seo_fixes",
      "mcp__goppa__get_fixes_to_apply",
      "mcp__goppa__get_study"
    ],
    "ask": [
      "mcp__goppa__run_site_check",
      "mcp__goppa__add_site",
      "mcp__goppa__run_ai_measurement",
      "mcp__goppa__report_fixes_applied",
      "mcp__goppa__scan_site"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as goppa. Review it before you use it.

Capability tags behind 6 rules

mcp__goppa__get_ai_visibility private-data, untrusted-input
mcp__goppa__run_site_check untrusted-input
mcp__goppa__add_site untrusted-input
mcp__goppa__run_ai_measurement untrusted-input
mcp__goppa__get_fixes_to_apply private-data
mcp__goppa__scan_site untrusted-input, outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.trygoppa/goppa/verify?hash=16dffd17168d66f0db3a5070dfd8646ddba72a65b8f0193d68255ccd6821699a" | jq -e '.changed == false'

Pinned hash 16dffd17168d, from Oct 29, 2026, 20:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.trygoppa/goppa/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.trygoppa/goppa.svg)](https://anlyon.dev/servers/com.trygoppa/goppa)

Source: MCP Registry. Synced Oct 29, 2026, 20:17 UTC.