pucilpet/crawlgraph-mcp

Five MCP tools for backlink research using CrawlGraph
and Common Crawl snapshots: backlinks, backlink_changes, gap_analysis,
gap_outreach_targets, and releases. Outreach tools identify research
candidates; they do not send messages or create contacts.
Choose an authentication profile
| Surface | Credentials | Tool profile |
| --- | --- | --- |
| npm / local stdio | Your CRAWLGRAPH_API_KEY (cg_live_…) | Legacy |
| https://crawlgraph.com/mcp | Your API key in Authorization: Bearer cg_live_… | Legacy |
| https://crawlgraph.com/mcp/connectors | Account-linked OAuth access token in the Authorization header | Bounded directory profile, when enabled |
Legacy /mcp also accepts Smithery's ?apiKey=… and base64 JSON ?config=…
forms. Header credentials take precedence, then apiKey, then packed config.
Prefer the Authorization header. The connector endpoint rejects API keys,
query credentials and packed configuration; OAuth tokens never go to the
public /api/v1 API.
Directory approval and real Claude/OpenAI compatibility verification remain
pending. No Verified listing or logo is claimed. This checkout's source
version is **0.4.0**; it does not establish the current npm or hosted version.
Verify each distribution separately through the operator runbooks linked in
DEPLOY.md.
API-key setup: npm / stdio and legacy HTTP
Obtain a key through CrawlGraph's API onboarding.
The free-key flow emails a key; it does not sign you into an account.
For Claude Desktop / Claude Code, put this in your client's MCP configuration:
Cursor, Windsurf, Cline and Zed use the same command/environment arrangement.
Streamable HTTP clients can use https://crawlgraph.com/mcp with their own
bearer API key. Confirm the hosted tools/list response before relying on a
specific source feature.
| Local stdio setting | Required | Default |
| --- | --- | --- |
| CRAWLGRAPH_API_KEY | Yes for tool execution; resolved lazily | — |
| CRAWLGRAPH_BASE_URL | No; legacy REST adapter only | https://crawlgraph.com |
Account linking: OAuth connector
When the operator enables the reviewed service, connect to
https://crawlgraph.com/mcp/connectors using an existing CrawlGraph account,
sign in and approve consent in the original connection browser. Account
creation is outside OAuth. If you need an account, follow the disclosed
onboarding flow, then return and request sign-in; an emailed API key alone is
not a login session.
The issuer is https://crawlgraph.com, the exact resource is
https://crawlgraph.com/mcp/connectors, and the only scope is
crawlgraph:read. Public clients use authorization code plus S256 PKCE and
token_endpoint_auth_method=none. Omitted registration auth method is
normalized to none and any SDK-generated secret is discarded. Confidential
client methods and metadata-document fetching are unsupported. Callbacks
must be exact operator-approved HTTPS URLs. OpenAI's callback must come from
the actual portal; this repository does not supply a guessed callback.
Authorization and code exchange require the exact raw resource value. At code
exchange a supplied redirect_uri must exactly match the stored callback;
omission retains that callback. Refresh may omit resource and scope to retain
the original grant. PKCE is validated by the backend during the atomic code
exchange, alongside client/resource/redirect/scope checks.
Use account connection management to disconnect and revoke the entire grant
and refresh family. An expired access token can be refreshed while its grant
and refresh family remain valid; revoked or expired grants require
reconnecting. Discovery, OAuth and introspection outages return 503 without
a relink challenge. Execution outages return a safe tool error inside the