A cloud agent machine is rebuilt for each task, so nothing you set up by hand survives. Everything has to come from the agent’s config, its start-up script and its secrets.
Option 1: the hosted MCP
Add the server URL to the agent’s MCP config, the same way as on your own machine:
https://seoskill.dev/mcp
That URL is all the config needs. Your Google sign-in lives in the MCP client as a token, not on our server. Whether that token survives a rebuilt machine depends on the client, so check your client’s docs. The first sign-in also needs a browser. If your cloud agent cannot open one, use the CLI below.
Research keys can come from the agent’s secrets as headers, for example X-Ahrefs-Key. The API keys guide lists them.
Option 2: the CLI, fully headless
The CLI can run with no browser and no saved state. It needs three things from the platform: an install step, a Google service account, and your keys as secrets.
Create a Google service account
- In Google Cloud, create a service account and download a JSON key for it.
- In Search Console, open each property’s settings, then Users and permissions, and add the service account’s email address as a user.
- If you want Google Analytics too, add the same email as a Viewer on the Google Analytics property.
The service account reads Search Console and Google Analytics with read-only access, like a normal sign-in.
Add the secrets
Store these as secrets in the platform, so they arrive as environment variables:
| Variable | What it holds |
|---|---|
SEO_GOOGLE_SERVICE_ACCOUNT_JSON | The whole service account JSON key |
SEO_DATAFORSEO_LOGIN, SEO_DATAFORSEO_PASSWORD | Optional, for research with DataForSEO |
SEO_AHREFS_API_KEY | Optional, for research with Ahrefs |
SEO_CLICKY_SITEKEY | Optional, read by the Clicky provider package |
If the platform gives you a file instead, set SEO_GOOGLE_SERVICE_ACCOUNT_FILE (or GOOGLE_APPLICATION_CREDENTIALS) to its path. Set only one of the three Google variables.
Install in the start-up script
npm i -g seo
If your platform has a persistent volume, point the CLI’s state at it so caches and saved crawls survive between runs:
export SEO_CONFIG_DIR=/workspace/.seo/config
export SEO_CACHE_DIR=/workspace/.seo/cache
Commands take the site directly, so there is no setup step to run:
seo report --site example.com --json
Give the agent a clear prompt
Use the seo CLI. Run seo report --site example.com --json, then the
quick-wins section. Summarise the facts and list the pages to look at.
Never print environment variables, keys or the service account JSON.
Keep keys out of logs
Never print a key, paste one into a prompt or commit it to the repository. Put keys in the platform’s secret store only, and do not echo environment variables in the start-up script. Anonymous usage counts turn off by themselves in common CI environments.