# Site SEO & AI Crawler Audit

See which AI crawlers a site lets in, missing share tags and redirects. It is free, with no sign-up and no key.

Also known as: Site Check, Site SEO Check, AI Crawler Access Check, Redirect Chain Checker, Exposed Surface Check, Leak Check, AI App Check, Vibe-coded App Security Check.

## What it does

Site SEO and AI Crawler Audit checks public web pages and reports what they publish right now: SEO tags, redirects, AI crawler rules, AI citation signals, landing page conversion and, for a site you own, what leaks publicly. People also call it Site Check.

The exposure check works only on a domain you prove you own: the first call gives a DNS TXT record or a file to publish, and the check runs once it is live. It never looks up a person, a user name or an email address.

Page and crawler checks: which of 14 AI crawlers robots.txt allows on a page and the rule that decided it; the title, description, canonical, Open Graph and Twitter tags and which are missing; and the 301 redirect chain with status codes and headers.

Store and AI checks: one product page's SEO and Product structured data (price, GTIN, availability); a domain's llms.txt, agents.md, UCP file, sitemap and AI crawler rules; five AI citation signals of one page, each with evidence and a fix; and a sample of up to 40 sitemap addresses for broken pages and redirects.

Landing page check: twelve conversion items such as the h1, the call to action and whether its links work, form fields, trust signals, a price section, viewport and a contact path, each with evidence and a fix. It is a checklist, not a forecast.

Exposure check: exposed or clean with the top 3 risks and fixes, from dangling subdomains, leaked files such as .env, admin paths and masked API keys in the page's scripts, plus six legal signals with official sources. No port scan, and not legal advice.

AI-built app check: for an app made with Lovable, Bolt, v0, Replit or any AI app builder, the missing security headers of any public app with the exact header lines for its host; and, for an app you prove you own, exposed files such as .env and .git, keys in the JavaScript it ships, and whether its Supabase tables or Firebase database, Firestore and storage rules let anyone read them. It reads only status codes and Supabase row counts, never a row's data, and never writes.

What it does not do: no speed test, no rankings or traffic, no JavaScript, no sign-in, no page text returned, and no private, local or internal addresses. It does not request a page that robots.txt disallows for Agent Tools. robots.txt is a request, not access control, and a firewall can treat real crawlers differently.

It stores nothing about you or the site. Answers are cached for five minutes, except owner checks (exposure_check, ai_app_check), which are never cached; the only lasting record is a daily count of calls per tool.

- Shows whether robots.txt allows or blocks 14 published AI crawlers
- Shows the rule that decided each crawler, the sitemaps and any noindex or noai directives
- Reads a page's title, description, canonical link, language and icons
- Reads Open Graph and Twitter share tags and lists the common ones that are missing
- Follows the redirect chain with each status code and shows the final address and headers
- Checks one product page's title, description, h1, canonical link and Product structured data (price, GTIN, availability)
- Checks a domain for llms.txt, agents.md, the Shopify UCP file, a sitemap and AI crawler rules in robots.txt
- Checks a page for five AI citation signals: summary, author credentials, Q&A format, headings, structured data
- Checks up to 40 sitemap addresses for broken pages and redirect chains, skipping pages robots.txt disallows
- Checks a landing page's h1, call to action, form fields, trust signals, listed prices, viewport and contact path
- Tests up to five call-to-action links of a page and gives each finding with evidence and a fix
- Checks the exposed surface of a domain its owner proves: leaked files, dangling subdomains, default pages
- Finds API keys in the JavaScript an owned app ships, public source maps and open admin paths, keys masked
- Flags 6 legal signals on an owned app (COPPA, fonts, session replay, CAN-SPAM, renewals, DMCA) with sources
- Checks 8 security headers of any public app and gives the exact lines for Vercel, Netlify, Cloudflare and others
- Tells an owner whether anyone can read their Supabase tables or Firebase data, by status and row count only
- Refuses private, local and internal addresses and redirects into them

## Who it is for

Anyone who asks an AI assistant a question like this one: “Does this site let AI crawlers in?”

Roles that use it at work: SEO specialist, Marketing lead, Agency owner, Founder, Founder or marketing lead.

Role guides that use it: [SEO specialist](https://tools.openkrill.app/for/seo-specialist).

## Price

Site SEO & AI Crawler Audit is free to use. There is no sign-up, no account and no API key. Calls are limited to 60 calls a minute per network and 5000 calls a day per server, shared by all callers. Repeat questions are answered from a cache.

## Tools it offers

- `check_ai_crawler_access`: Check AI crawler access in robots.txt
- `check_page_tags`: Check Open Graph and share tags
- `trace_redirects`: Trace a 301 redirect chain
- `product_page_seo`: Check product JSON-LD and page SEO
- `ai_readiness_check`: Check AI readiness of a store or page
- `link_sample_check`: Check a sitemap sample for broken links
- `landing_page_check`: Check a landing page for conversion
- `exposure_check`: Check the exposed surface of a site you own
- `ai_app_check`: Check an AI-built app for leaks and open data

## Connect

The MCP server is `https://sitecheck.openkrill.app/mcp` (streamable HTTP). It needs no key.

Claude Code, in one command:

```
claude mcp add --transport http site-check https://sitecheck.openkrill.app/mcp
```

Hermes Agent, in one command that answers its two setup questions (no key, enable all tools):

```
printf 'n\ny\n' | hermes mcp add site-check --url https://sitecheck.openkrill.app/mcp
```

Or add these lines to `~/.hermes/config.yaml`, under an existing `mcp_servers:` key if the file has one. Start a new Hermes session after either step.

```
mcp_servers:
  site-check:
    url: https://sitecheck.openkrill.app/mcp
```

Any other agent: give it this page's Markdown address, `https://tools.openkrill.app/tools/site-check.md`, and ask it to connect Site SEO & AI Crawler Audit.

Install guides, each checked with a real call: [Site SEO & AI Crawler Audit in ChatGPT](https://tools.openkrill.app/integrations/site-check/chatgpt), [Site SEO & AI Crawler Audit in Claude](https://tools.openkrill.app/integrations/site-check/claude), [Site SEO & AI Crawler Audit in Cursor](https://tools.openkrill.app/integrations/site-check/cursor), [Site SEO & AI Crawler Audit in VS Code](https://tools.openkrill.app/integrations/site-check/vscode), [Site SEO & AI Crawler Audit in Pi](https://tools.openkrill.app/integrations/site-check/pi).

## Job recipes for agents

Step-by-step recipes that walk an agent through 3 jobs with this server's tools:

- Check product JSON-LD and page SEO, with `product_page_seo`
- Check a landing page for conversion, with `landing_page_check`
- Check AI readiness of a store or page, with `ai_readiness_check`

[Download the recipes as SKILL.md](https://tools.openkrill.app/skills/site-check-jobs/SKILL.md). Save it as `site-check-jobs/SKILL.md` in your agent's skills folder. A connected MCP client gets the same recipes from `prompts/list` on the gateway, `https://api.openkrill.app/gateway/mcp`.

It is listed under Websites, domains and email in the [full tool list](https://tools.openkrill.app/tools). The same facts in plain text are in [llms.txt](https://tools.openkrill.app/llms.txt).

Source: the Site SEO & AI Crawler Audit listing, version 1.8.0. As of 2026-10-18.