Atlas / MCP servers / jayniebingyu-cyber / goaimoat-ai-visibility-mcp

goaimoat-ai-visibility-mcpCAUTION

mcp/jayniebingyu-cyber/goaimoat-ai-visibility-mcp

GoAI Moat - AI Visibility Audit MCP server. Diagnose a brand visibility in AI answers (ChatGPT, Perplexity, AI Overviews). https://mcp.goaimoat.com/mcp

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
3 3r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Multi-model AI visibility audit for any website or brand — ChatGPT (consumer app), Perplexity, and Grok, plus GEO/SEO health and a 0–100 score with benchmark percentile.

Thin relay by design: this MCP holds no API keys, no billing logic, and makes no direct upstream calls. It forwards your request (with your api_key / license_key / email) to the GoAI Moat server, which holds all credentials and enforces access and quota. The MCP is only the request-initiating interface.

Tools

  • audit_ai_visibility(url, api_key=..., license_key=..., email=...) — full audit: multi-model AI mentions + GEO/SEO health + 0–100 score + benchmark percentile + prioritized issues.
  • check_ai_mentions(brand, api_key=..., email=...) — quick check: what ChatGPT / Perplexity / Grok say about a brand.
  • check_license(license_key, email=...) — activate a license and receive your api_key.

Pricing

  • Free: 3 audits per email.
  • Subscription: $98/month. Activate via check_license.

Run locally (stdio)

pip install -r requirements.txt
python server.py

No credentials are needed here — authentication, quota, and the actual audit all live on the GoAI Moat server. The server returns a clear error if your api_key/license/email is missing or exhausted.

Hosted endpoint

https://ai-visibility.mcp.goaimoat.com/mcp

License

MIT

Read from source at commit 11430d6caeddOBSERVED · 2026-10-11
02

Exposed tools (3)

3 read · 0 write · 0 destructive.

ToolRiskDescription
audit_ai_visibilityreadFull AI visibility audit of a website (multi-model AI mentions + GEO/SEO + 0-100 score).
check_ai_mentionsreadQuick check: what do ChatGPT, Perplexity and Grok say about a brand?
check_licensereadActivate a Gumroad license and receive your GoAI Moat api_key.
03

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (4 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (5)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
server.py:12
AUDIT_URL = os.environ.get("AUDIT_URL", "http://127.0.0.1:8031")
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastmcp
Why it matters. 1 requirement(s) not pinned with ==
Fix. pin exact versions
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:5
**Thin relay by design**: this MCP holds **no API keys, no billing logic, and makes no direct upstream calls**. It forwards your request (with your `api_key` / `license_key` / `email`) to the GoAI Moa
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:25
No credentials are needed here — authentication, quota, and the actual audit all live on the GoAI Moat server. The server returns a clear error if your api_key/license/email is missing or exhausted.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 11430d6caeddfull audit observations/trust-audit/mcp-server/jayniebingyu-cyber__goaimoat-ai-visibility-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1111430d6caeddCAUTIONB89first audit
05

Questions

What is the goaimoat-ai-visibility-mcp MCP server?

GoAI Moat - AI Visibility Audit MCP server. Diagnose a brand visibility in AI answers (ChatGPT, Perplexity, AI Overviews). https://mcp.goaimoat.com/mcp

What tools does goaimoat-ai-visibility-mcp expose?

3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is goaimoat-ai-visibility-mcp safe to connect to an agent?

With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does goaimoat-ai-visibility-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does goaimoat-ai-visibility-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (11430d6caedd), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement