---
title: "Run in cloud agents | SEO Skill"
description: "Set up SEO Skill on cloud agents and CI machines that are rebuilt each time, with the hosted MCP or a headless CLI that signs in with a Google service account."
canonical: "https://seoskill.dev/docs/cloud-agents"
language: "en"
---

# Run in cloud agents

Use SEO Skill on Amp, Codex cloud, CI and other machines that start fresh each time. Pick the hosted MCP or a headless CLI.

A cloud agent machine is rebuilt for each task, so nothing you set up by hand survives. Everything has to come from the agent’s config, its start-up script and its secrets.

## Option 1: the hosted MCP

Add the server URL to the agent’s MCP config, the same way as on your own machine:

```text
https://seoskill.dev/mcp
```

That URL is all the config needs. Your Google sign-in lives in the MCP client as a token, not on our server. Whether that token survives a rebuilt machine depends on the client, so check your client’s docs. The first sign-in also needs a browser. If your cloud agent cannot open one, use the CLI below.

Research keys can come from the agent’s secrets as headers, for example `X-Ahrefs-Key`. The [API keys guide](https://seoskill.dev/docs/keys) lists them.

## Option 2: the CLI, fully headless

The CLI can run with no browser and no saved state. It needs three things from the platform: an install step, a Google service account, and your keys as secrets.

### Create a Google service account

1.  In Google Cloud, create a service account and download a JSON key for it.
2.  In Search Console, open each property’s settings, then **Users and permissions**, and add the service account’s email address as a user.
3.  If you want Google Analytics too, add the same email as a Viewer on the Google Analytics property.

The service account reads Search Console and Google Analytics with read-only access, like a normal sign-in.

### Add the secrets

Store these as secrets in the platform, so they arrive as environment variables:

| Variable | What it holds |
| --- | --- |
| `SEO_GOOGLE_SERVICE_ACCOUNT_JSON` | The whole service account JSON key |
| `SEO_DATAFORSEO_LOGIN`, `SEO_DATAFORSEO_PASSWORD` | Optional, for research with DataForSEO |
| `SEO_AHREFS_API_KEY` | Optional, for research with Ahrefs |
| `SEO_CLICKY_SITEKEY` | Optional, read by the [Clicky provider package](https://github.com/iannuttall/seoskill-clicky-provider) |

If the platform gives you a file instead, set `SEO_GOOGLE_SERVICE_ACCOUNT_FILE` (or `GOOGLE_APPLICATION_CREDENTIALS`) to its path. Set only one of the three Google variables.

### Install in the start-up script

```sh
npm i -g seo
```

If your platform has a persistent volume, point the CLI’s state at it so caches and saved crawls survive between runs:

```sh
export SEO_CONFIG_DIR=/workspace/.seo/config
export SEO_CACHE_DIR=/workspace/.seo/cache
```

Commands take the site directly, so there is no setup step to run:

```sh
seo report --site example.com --json
```

### Give the agent a clear prompt

```text
Use the seo CLI. Run seo report --site example.com --json, then the
quick-wins section. Summarise the facts and list the pages to look at.
Never print environment variables, keys or the service account JSON.
```

## Keep keys out of logs

Never print a key, paste one into a prompt or commit it to the repository. Put keys in the platform’s secret store only, and do not echo environment variables in the start-up script. Anonymous usage counts turn off by themselves in common CI environments.