The best OpenClaw SEO plugins, skills and MCP servers (October 2026)

Skills, plugins and MCP servers: three different things

People search for "OpenClaw SEO plugins", but OpenClaw has three separate extension points, and they carry very different amounts of risk:

The rule of thumb that follows: get your data through MCP servers and your procedures through skills. A skill that pulls data itself usually means community code on your machine handling your Google or SEO-platform credentials. A vendor's remote MCP server keeps that credential flow with the vendor, and OpenClaw's tool policy can still restrict what the agent calls.

Vet before you install: what ClawHavoc taught everyone

In February 2026 Koi Security found 341 malicious skills on ClawHub. Most of them used fake "prerequisites" to install the Atomic Stealer macOS infostealer. OpenClaw responded by scanning uploads with VirusTotal, and the registry now shows security-audit verdicts. But ClawHub is, in its own words, "open by default: anyone can upload". SEO is an attractive category to impersonate, because SEO skills legitimately ask for API keys. Before you install anything:

• Run clawhub inspect <skill> and read the SKILL.md and every script in the folder. An instructions-only skill is low risk. A skill that tells you to curl | sh a "dependency" is a red flag.
• Check where your credential goes. Does the skill call the vendor's API directly, a third-party gateway, or a server you have never heard of?
• Prefer the vendor's own MCP server to a community skill that wraps the same API.
• Give SEO keys the narrowest scope available. Read-only wherever the service offers it.
• Run openclaw security audit after any change to skills, plugins or MCP servers.

The shortlist at a glance

MCP servers for SEO data

Any MCP server you would use in Claude or Cursor also works in OpenClaw. What changes is that the agent can run unattended, so cost model, permission scope and tool-list size matter more than in an interactive chat. For the wider landscape, see the best SEO MCP servers; below is what is specific to OpenClaw.

1. GSC Wizard MCP

Good at: giving an always-on agent finished answers about your own Search Console, GA4 and Bing data. The server is hosted at https://mcp.gscwizard.com/mcp over Streamable HTTP, so there is no process to keep alive next to your Gateway. Analysis runs on the server against a ClickHouse warehouse, which matters for agents. detect_anomalies, find_decaying_content, analyze_cannibalization or score_opportunities return a computed result instead of 25,000 rows that the model would have to summarise after truncation. Stored properties keep up to ten years of history, past Google's 16-month limit, so the agent can compare against last year's season.

Watch for: it is a paid product, and it is ours. It also exposes well over a hundred tools. On OpenClaw, use --include to load only the families you need (see the config below). For a scheduled agent, use a read-scoped API key: a read key cannot call a mutation tool, whatever the prompt says.

Access: plans from €17/month with a 7-day free trial, MCP access on every plan. Create a key under Account → API keys.

2. Community Search Console servers

Good at: free Search Console access. ahonn/mcp-server-gsc and AminForou/mcp-gsc are stdio servers, and OpenClaw supports stdio, so they run on your Gateway host. The OpenClaw setup is actually friendlier than ChatGPT's or Claude's web clients, which cannot reach a local process at all.

Watch for: setup usually means a Google Cloud project and a service-account JSON key stored on the Gateway host, which is a broad, long-lived credential sitting next to an agent that reads untrusted web content. They also inherit the Search Console API's 16-month history ceiling and row limits.

3. Google Analytics MCP (official)

Good at: the conversion half of the picture: run_report and run_funnel_report against the GA4 Data API, from Google's own googleanalytics/google-analytics-mcp. Pair it with a Search Console server and the agent can answer "which pages earn clicks and convert".

Watch for: it is labelled experimental, it is read-only, and it runs locally against a Google Cloud project you set up yourself. GSC Wizard exposes GA4 through the same connection if you would rather run one server than two.

4. Semrush MCP

Good at: competitor and keyword research if Semrush is already your platform. The official endpoint is https://mcp.semrush.com/v2/mcp, Streamable HTTP only, with OAuth by default.

Watch for: it draws on your subscription's API units, and an unattended agent can spend units much faster than a person clicking through the UI. Cap date ranges and row counts in the prompt, and do not schedule open-ended research.

5. Ahrefs MCP

Good at: backlink work. Ahrefs runs a remote server at https://api.ahrefs.com/mcp/mcp (docs). The older local ahrefs-mcp-server repository is marked no longer maintained, so ignore guides that still point at it.

Watch for: row caps scale with your plan, and the traffic figures are modelled. Never let the agent put them unlabelled next to Search Console clicks.

6. DataForSEO MCP

Good at: raw SERP, keyword and backlink data billed per request, which suits a scheduled rank or SERP-feature check. The public remote URL is https://mcp.dataforseo.com/v3/mcp (note the /v3/; some guides drop it), and the TypeScript server can also be self-run.

Watch for: responses are large and uninterpreted. Constrain every scheduled call to a fixed keyword list and a fixed location.

Built-in OpenClaw tools you already have

Two built-ins cover a lot of SEO ground before you install anything:

• web_search with the Brave provider. OpenClaw supports the Brave Search API as a search provider (set BRAVE_API_KEY). It is useful for spot-checking a live SERP, and Brave is also the index Claude leans on for citations (see how to rank in Brave Search). Remember it is Brave's ranking, not Google's.
• The managed browser. A dedicated Chromium profile the agent controls, good for checking what a rendered page actually shows, its title, canonical and robots meta.

Both read untrusted content from the open web. OpenClaw's prompt-injection guidance recommends limiting exec, browser, web_fetch and web_search to trusted agents or allowlists. An agent that browses competitor pages should not also hold a write key to your properties.

ClawHub SEO skills

These are the most-downloaded SEO-related skills we found on ClawHub on October 5, 2026. All of them are community-published, none by the vendor they name, and none was flagged by ClawHub's scanner when we checked. That is a snapshot, not an endorsement: read each one before installing.

Our honest read: the most useful SEO skills are the ones you write yourself. A twenty-line SKILL.md that says "for a weekly review, call these four tools, label every figure with its source and date range, and post three actions" is safer than any download, and better fitted to your site. The continuous SEO analysis guide includes one you can copy.

Connect GSC Wizard to OpenClaw

The same pattern works for any remote server above. The one setting people get wrong is the transport: when it is omitted, OpenClaw uses SSE, and GSC Wizard, Semrush and Ahrefs all speak Streamable HTTP. Set it explicitly.

With an API key (best for unattended runs; create a read key under Account → API keys), in ~/.openclaw/openclaw.json:

{
  mcp: {
    servers: {
      gscwizard: {
        url: "https://mcp.gscwizard.com/mcp",
        transport: "streamable-http",
        headers: { Authorization: "Bearer gscw_live_..." }
      }
    }
  }
}

openclaw mcp doctor warns when a header holds a literal secret, and it is right to. Once the connection works, move the key into OpenClaw's secrets mechanism and never commit the file.

With OAuth (when the Gateway host can open a browser), use the CLI. GSC Wizard publishes standard MCP OAuth discovery with dynamic client registration, so there is no client ID to paste:

openclaw mcp set gscwizard '{"url":"https://mcp.gscwizard.com/mcp","transport":"streamable-http","auth":"oauth"}'
openclaw mcp login gscwizard

Then probe it. As the docs put it, "saving a definition proves nothing about reachability - the probe does":

openclaw mcp doctor gscwizard --probe

Trim the tool list. Every tool definition costs context on every turn. If you add the server with openclaw mcp add, the --include flag takes a comma-separated list of names or globs. For example, --include 'list_sites,get_site_summary,detect_*,find_*,get_ranking_changes,score_opportunities,analyze_*' keeps the analysis tools and leaves out the write tools entirely.

Technical details (endpoint, scopes, the 60-calls-per-minute rate limit) are in the GSC MCP server reference. The setup is the same whichever client connects.

Three stacks that work

Frequently asked questions