MCP · SEO research · Ahrefs
Ahrefs MCP Server
Query Ahrefs SEO data such as keywords and backlinks from an AI host, on Lite and higher plans, using API units from your subscription.
API units run out. Large or repeated queries use shared monthly units. Keep requests small and check usage in account settings.
Understand the tool
What it does.
Ahrefs' hosted MCP server lets AI hosts query Ahrefs data through the Ahrefs API: keyword metrics, backlinks, site and competitor data. It uses an MCP key from your Ahrefs account and draws on your plan's API units.
Why use it?
Use it for keyword and competitor research inside a writing or planning conversation. Watch API-unit usage, which is shared with other Ahrefs integrations.
A useful fit for
- Keyword research for content plans
- Backlink and competitor checks
- Quick SEO questions while drafting
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Keyword ideas for an article
A writer plans an article and needs search demand.
- Give the seed topic and country.
- Pull keyword volume and difficulty.
- Pick three targets with reasons.
Intended outputA short list of target keywords with dated metrics.
Use case 02
Compare two competitors' backlinks
A marketer wants to know why a competitor ranks higher.
- Name both domains.
- Pull referring-domain counts and top linking pages.
- List the clearest gaps.
Intended outputA dated comparison to plan outreach from.
A concrete starting point
Illustrative prompt: keyword targets
Limiting the keyword count keeps API-unit use predictable.
Using the Ahrefs MCP server, get search volume and keyword difficulty for up to 20 keywords related to the topic I name, for the United States. Recommend three targets and say which metrics and date the data reflects. Keep the request small to save API units.What this can change
Requests consume Ahrefs API units shared across MCP, Ahrefs Connect and API v3 usage; results enter the AI host.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- An Ahrefs Lite or higher plan.
- An MCP key generated in Ahrefs (MCP keys and API keys are not interchangeable).
- An MCP client that supports remote servers.
- Authentication
- An Ahrefs MCP key sent as a bearer token; the endpoint also advertises OAuth metadata.
- Can read
- Ahrefs keyword, backlink, site and competitor data
- Can write or change
- None to outside systems; usage is recorded against your API units
- Network and data flow
- Ahrefs API
- AI host/model provider
- Approval and control
- Read operations against Ahrefs data; host approval controls when calls run and how many units they use.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Remote MCP clients
- Ahrefs documents setup for several AI hosts
- No local server
Costs and account requirements
No separate fee for the MCP server; calls consume the API units in your Ahrefs plan, shared with Ahrefs Connect and API v3.
Current pricing or plan information ↗Hosted service terms
No public source license for Ahrefs's hosted implementation is asserted. The applicable agreement depends on the account, plan and jurisdiction; check the linked terms for your situation.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
API units run out
Large or repeated queries use shared monthly units. Keep requests small and check usage in account settings.
Metrics are estimates
Search volume and difficulty are modeled estimates; treat them as directional.
Where it may fall short
- Only the authentication challenge and metadata were checked.
- Ahrefs documents that a local server is not offered.
Observed behavior · 2026-10-18
Runtime and security findings.
The endpoint rejected credential-free initialization with a plain-text token message and pointed to public metadata using a non-standard scopes field.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Metadata uses a non-standard scope field
The metadata listed apiv3-mcp under scopes_provided rather than the standard scopes_supported, and its resource was the API root rather than the MCP path.
In practice: Use the documented MCP key setup; generic OAuth discovery may not behave as expected.
Documented concern · low severity under stated conditions
MCP keys differ from API keys
Ahrefs documents that API keys and MCP keys are not interchangeable.
In practice: Generate an MCP key specifically for this connection.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://api.ahrefs.com/mcp/mcp
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 614c8fdfb87956e9126a59b5dd2100318d68f0c66cf8e213e2268bd1d18c97f3. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:05.920151+00:00 through 2026-10-19T05:52:06.138185+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://api.ahrefs.com/mcp/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T05:52:05.920151+00:00. WWW-Authenticate: Bearer resource_metadata="https://api.ahrefs.com/.well-known/oauth-protected-resource". Body: api token is required
Public authentication discoveryMet expectation
- Method
GET https://api.ahrefs.com/.well-known/oauth-protected-resource; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:52:06.138185+00:00; Content-Type: application/json. Resource: https://api.ahrefs.com/. 1 advertised scope: apiv3-mcp. Authorization server: https://api.ahrefs.com/.
Practical caveats
- API units are shared across Ahrefs integrations.
- Data reflects Ahrefs' index and models, not live search engines.
What this evaluation does not establish
- MCP-key and OAuth access, plan enforcement and API-unit accounting.
- Data accuracy, tool lists and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
Valuable for content and SEO work with clear plan and usage rules. Paid-plan requirement and shared API units rank it below general-purpose servers.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Remote endpoint and authentication discovery
- Documented plans and usage
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official getting-started article ↗help.ahrefs.com
- Ahrefs terms of service ↗ahrefs.com
- Ahrefs pricing ↗ahrefs.com