Atlas / MCP servers / adamgusky / blawgy-mcp

blawgy-mcpCAUTION

mcp/adamgusky/blawgy-mcp

Blawgy MCP server: research keywords, plan, write, update and publish SEO blog posts from any AI agent

Verdict
CAUTION
Grade
C
Trust score
79 /100
Exposed tools
—
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Run your blog from Claude, ChatGPT, Cursor or your own agent.

Blawgy researches keywords, writes SEO articles and publishes them to your site (WordPress, Shopify, Webflow, Wix, Framer, Ghost, Duda or your own API) on a schedule. This MCP server gives an AI agent everything the dashboard can do. Read your Search Console traffic, run keyword research, build and reorder the content plan, write and edit articles, draft and approve updates to live posts, change images, products, locations and settings, manage guardrails, webhooks and your team.

This repo holds the public listing (README, server.json, logo). The server itself runs inside Blawgy and is not open source.

Endpoint https://app.blawgy.com/mcp (Streamable HTTP) Auth OAuth 2.1 with PKCE and dynamic client registration, or an API key as a bearer token Plans every paid Blawgy plan, including clients of white-label partners Docs blawgy.com/mcp and the help article

Connect

Claude (web, desktop, mobile)

Customize, then Connectors, then Add custom connector. Name it Blawgy, paste the server URL, press Connect and sign in with your Blawgy account. Pick the sites and whether the connection can write. On Team and Enterprise plans an owner adds it under Organization settings. To use an API key instead, paste Authorization and Bearer under Request headers.

Claude Code

claude mcp add --transport http blawgy https://app.blawgy.com/mcp
claude mcp login blawgy     # or run /mcp inside a session

With an API key, no sign-in needed

claude mcp add --transport http blawgy https://app.blawgy.com/mcp \
--header "Authorization: Bearer blk_live_..."

Shared with your repo in .mcp.json (--scope project)

{
"mcpServers": {
"blawgy": {
"type": "http",
Read from source at commit d63046700143OBSERVED · 2026-10-11
02

Trust audit

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (4)

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
README.md:54
Settings, then Connectors, then Advanced settings, turn on Developer mode, press Create. Name it Blawgy, paste the server URL, choose OAuth, sign in. ChatGPT only supports OAuth, so keys do not work t
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
README.md:380
- **Scoped credentials.** A key or OAuth connection reaches one site, all your sites, or (for partners) every approved client site. Each is read only or read and write. Read-only credentials never see
Why it matters. asks the agent to read credentials

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha d63046700143full audit observations/trust-audit/mcp-server/adamgusky__blawgy-mcp.json · Report an issue / request a re-scan
03

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11d63046700143CAUTIONC79first audit
04

Questions

What is the blawgy-mcp MCP server?

Blawgy MCP server: research keywords, plan, write, update and publish SEO blog posts from any AI agent

Is blawgy-mcp safe to connect to an agent?

With care. The audit graded it C (79/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does blawgy-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does blawgy-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (d63046700143), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement