Ahrefs MCP

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Ahrefs MCP guide; the main thing to watch is that connecting it grants an AI client access to your Ahrefs account data and API usage.

Before installing, confirm the MCP URL is the official Ahrefs endpoint, review the OAuth consent screen, set API usage limits if available, and revoke the MCP key when you no longer need it. Use the optional local MCP server only if you have Enterprise/APIv3 access and have reviewed the external repository and install steps.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The AI client can query data available through the connected Ahrefs account and may consume API units until the key is limited or revoked.

Why it was flagged

The integration creates delegated access to the user's Ahrefs account through an MCP-scoped API key. This is expected for the Ahrefs integration, but it is still account-level authority users should review.

Skill content
Grant permissions to your Ahrefs account ... An API key will be generated automatically (tagged with `MCP` scope)
Recommendation

Review the Ahrefs consent screen, set API unit limits where possible, use an appropriately scoped workspace/account, and revoke the MCP key when no longer needed.

What this means

Business-sensitive SEO targets, keyword lists, competitor research, and returned Ahrefs data may be processed through the Ahrefs MCP service and the user's AI client.

Why it was flagged

The skill relies on a remote MCP server, so user queries, target domains, keywords, and Ahrefs responses flow through that external MCP integration. This is disclosed and purpose-aligned.

Skill content
connect via the remote MCP server URL: `https://api.ahrefs.com/mcp/mcp`
Recommendation

Verify the endpoint is the official Ahrefs MCP endpoint and avoid sending domains or keyword lists that should not be processed through the connected service.

What this means

Broad keyword, backlink, or competitor queries could use monthly API quota or hit plan limits if run without clear scope.

Why it was flagged

The skill can drive large Ahrefs data queries that consume account limits, but it explicitly warns about limits and advises confirmation before expensive requests.

Skill content
Each plan has row limits per request and monthly API unit caps ... Verify before expensive queries: Confirm the scope before running large dataset requests
Recommendation

Require confirmation for bulk or expensive queries, batch requests thoughtfully, and monitor Ahrefs limits and usage.

What this means

If choosing the local server option, the user would run external code and configure APIv3 credentials outside the submitted instruction-only skill.

Why it was flagged

The optional Enterprise local-server path points users to external code and install instructions that are not included in this artifact review. It is user-directed and relevant to the purpose, not automatic.

Skill content
Local MCP Server (Enterprise Only) ... git clone https://github.com/ahrefs/ahrefs-mcp-server ... Follow installation instructions in the repo
Recommendation

Use the documented remote endpoint unless local Enterprise deployment is needed; for local setup, verify the repository owner, review the code and install steps, and pin a trusted version where possible.