Ask Claude or ChatGPT About Your Own SEO Data And Get Real Answers, Not Guesses

MCP (Model Context Protocol) is an open standard, created by Anthropic and adopted across the industry, that lets AI assistants securely use external tools and data sources. Instead of the AI guessing about your website, it calls well-defined tools like “get orphan pages” or “get broken links” and works with the actual results. Linkilo 2.9 ships a full MCP server inside the plugin, so any MCP-compatible assistant can read your internal-linking data with your permission.

Any client that speaks MCP over HTTP. That includes claude.ai (custom connectors), ChatGPT (connectors), Claude Code, Claude Desktop, Cursor, and a growing list of others. Web apps connect via the built-in sign-in flow; desktop and CLI clients connect with a bearer token you issue in Linkilo. Because MCP is an open standard, new clients work without Linkilo needing an update.

No. The MCP surface contains no tools for WordPress users, plugins, themes, files, or arbitrary settings. It is limited to Linkilo’s internal-linking domain by design. On top of that, the entire endpoint is off by default, all write actions are gated behind a second switch that is also off by default, and every connection is limited by its role. The worst a read-only connection can do is read reports. Even at the highest level, “admin” means Linkilo administration only, never WordPress admin.

The tools make that as hard as possible. Every tool returns only data actually stored on your site. There is no generative step in the middle. When a dataset is empty, the tool says so explicitly and instructs the assistant not to invent values, and not to interpret empty data as a broken connection. There’s even a get_connection_status tool the assistant can call to get ground truth about the connection, its role, and which data sources (Search Console, GA4) are attached, so it checks instead of guessing.

Enable MCP under Linkilo → MCP Access, copy the endpoint URL shown there, and add it as a custom connector in the AI app. Click Connect and you’ll be sent to a wp-admin approval screen where you pick the access level (start with read_only) and expiry. Important: you never paste a token anywhere for web apps: the URL alone plus the approval is the whole setup. Tokens are only for desktop/CLI clients like Claude Code, which use an Authorization header.

Exactly what its role allows, drawn from Linkilo’s reports: the internal-linking overview, orphan pages, anchor analysis, keyword and link cannibalization, topic clusters, broken links, redirects, click analytics, crawl-log activity, stored Search Console queries, index coverage, link-equity scores, and internal link suggestions. Nothing else: no user data, no emails, no WooCommerce orders, no content outside those reports.

Only if you allow it twice. First, the connection needs an editor-level role (you choose this at approval). Second, the global “Allow write actions” switch must be on. It’s off by default, and while it’s off every connection is read-only regardless of role. When both are enabled, the AI can insert an approved internal link into a post or create a 301 redirect, using Linkilo’s own vetted mechanisms. Every write is recorded in the activity log.

One click. Every connection, whether it came from the web sign-in flow or a manually issued token, appears in the token list on the MCP Access page. Click Revoke and access ends on the very next request. Tokens can also carry an expiry (30/90/365 days) so access ends automatically even if you forget. And the master switch cuts off everything at once.

No. Visitors never touch the MCP endpoint. It only answers authenticated requests from your connected assistants, and every query it runs is bounded and capped. Security-wise: tokens are stored hashed (SHA-256) so a database leak doesn’t expose them, requests are rate-limited per token, sign-in uses OAuth 2.1 with PKCE and single-use codes, and the whole surface is dead while the master switch is off, which is how it ships.

Three usual causes, in order: MCP access is still off (enable it, then delete and re-add the connector); you’re on Linkilo 2.8 or older (the sign-in flow shipped in 2.9); or your host’s nginx blocks the /.well-known discovery URLs before WordPress can answer. That’s a one-line server exception your host can add in minutes. Our knowledge base has the exact message to send them. Meanwhile, desktop clients like Claude Code connect immediately with a token, no discovery required.