Cituna MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Cituna answer-engine visibility observations and site audits: Do stdio and HTTP expose the same tool contract while observations remain distinct from score interpretations?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

AI-visibility analysis using real tracked prompts, citations and Google Search Console summary data.

What we know

Hosted OAuth or local API-key MCP for querying Cituna AI-visibility scans, prompt/citation metrics and Search Console summaries. Pro/Max write tools can queue content/actions and start scans.

Maintenance / activity evidence

cituna-mcp 1.8.0 published 2026-10-02T07:54:58.066Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read private visibility/Search Console summaries; higher plans can mutate Cituna workflow state. Writes: Start scan; Queue article/content; Mark item published; Change gap status.
OAuth or API key.
Sensitive access: Search Console-derived data, Brand strategy, Content pipeline

Marketing workflow writes can trigger scans/content-state changes; data is private workspace intelligence.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do stdio and HTTP expose the same tool contract while observations remain distinct from score interpretations?

The bounded review of the publisher's documented Cituna answer-engine visibility observations and site audits and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Marketing workflow writes can trigger scans/content-state changes; data is private workspace intelligence.
Read private visibility/Search Console summaries; higher plans can mutate Cituna workflow state.
OAuth or API key.
Cituna processes scan/citation/Search Console summary data; Google connection remains held by Cituna rather than exposed to MCP client.
Reviewed write actions: Start scan; Queue article/content; Mark item published; Change gap status
Sensitive access: Search Console-derived data, Brand strategy, Content pipeline
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Paid workspace required for most useful data.
Write tools require higher plans.
Connecting Cituna does not directly give the model Google credentials; Cituna holds the Search Console connection.
AI visibility metrics are sampling/engine dependent.

Original activity observations

cituna-mcp 1.8.0 published 2026-10-02T07:54:58.066Z

Technical identity

npm/cituna-mcp

Exact implementation source: https://www.npmjs.com/package/cituna-mcp ↗
Reviewed resource type: MCP Server
Package identity: npm:cituna-mcp
Service endpoint: https://mcp.cituna.com/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry metadata ↗
cituna-mcp
Recorded package identity, distribution or download evidence.
Evidence source ↗
cituna.com/guides/connect-cituna-to-claude-mcp
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Not runtime tested, no third-party installation, network authorization, paid calls, or mutation executed.
Do not claim production service is available based on README alone.
Hosted OAuth alternative; one of CITUNA_API_KEY or CITUNA_TOKEN; account and plan metering
CITUNA_API_KEY or CITUNA_TOKEN are alternatives; local stdio key required for authenticated requests, remote connector OAuth separate.
Official npm publisher package page README inspected for this exact npm identity; static research only. Some setup statements are conservatively summarized; no source code or live client execution checked. V2 review did not run any live client.
Check actual host syntax and supply credentials in secure client environment; do not paste placeholders verbatim.
Avoid write, payment, token transfer, publishing, sending, booking and remote account changes as tests.
Replace credential, action and registration placeholders; follow the matching publisher/client prerequisites. No execution performed.
Use the matching host, actual registration name and original installation environment; this does not revoke credentials.

Install / connect
Publisher instructions
Hosted OAuth alternative; one of CITUNA_API_KEY or CITUNA_TOKEN; account and plan metering | Publisher npm README revisited on 2026-10-14; exact identity retained.
Reviewed setup example · Claude Code only · Publisher instructions · Review before use
```
claude mcp add cituna --scope user --env CITUNA_API_KEY=<KEY> -- npx -y cituna-mcp
```
Configure / authenticate
MCP100 setup guide
Get CITUNA_API_KEY from publisher account. Hosted remote OAuth is alternate connection; `CITUNA_TOKEN` session token expires.
Required environment variables: CITUNA_API_KEY
Check connection
Suggested check
Call free/allowed `whoami` to confirm account and entitlements; `gsc_status` separately checks Search Console.
Remove / uninstall / revoke
MCP100 setup guide
If registered by the publisher Claude Code example under `cituna`, run the provided unregister command; for a different MCP client or name, delete the actual client registration. Removing a local client entry is distinct from deleting a vendor account/token.
Separate provider credential revocation · publisher documented: In Cituna account Settings → API access, revoke the long-lived personal API key. Reconnect with a new CITUNA_API_KEY if needed.
Remove named client registration · Claude Code only · MCP100 composed guide
claude mcp remove cituna

Official Documentation & Sources

What it does

Hosted OAuth or local API-key MCP for querying Cituna AI-visibility scans, prompt/citation metrics and Search Console summaries. Pro/Max write tools can queue content/actions and start scans.

Capability: Search & Web
Resource type: MCP Server
Industry: Media & Marketing
Best fit: AI-visibility analysis using real tracked prompts, citations and Google Search Console summary data.

Representative uses

Read citation rate/visibility metrics
Analyze tracked prompts and citation sources
Use Search Console summaries
Start scans
Queue/mark content workflows on higher plans

Limitations

Paid workspace required for most useful data.
Write tools require higher plans.
Connecting Cituna does not directly give the model Google credentials; Cituna holds the Search Console connection.
AI visibility metrics are sampling/engine dependent.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OAuth or API key.
Permissions: Read private visibility/Search Console summaries; higher plans can mutate Cituna workflow state.
Data handling: Cituna processes scan/citation/Search Console summary data; Google connection remains held by Cituna rather than exposed to MCP client.
Cost: plan_based
Risk and cautions: Marketing workflow writes can trigger scans/content-state changes; data is private workspace intelligence.

Access scope and cautions

Write actions: Start scan Queue article/content Mark item published Change gap status
Sensitive access: Search Console-derived data Brand strategy Content pipeline
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Read citation rate/visibility metrics; Analyze tracked prompts and citation sources; Use Search Console summaries; Start scans; Queue/mark content workflows on higher plans.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y cituna-mcp. Recorded endpoint: https://mcp.cituna.com/mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: CITUNA_API_KEY (local). No configuration values are supplied here. Prerequisites: Cituna paid workspace; Node 18.17+ local. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Hosted OAuth or local Cituna API key.

Can it modify data or perform write operations?

Documented write actions include: Start scan; Queue article/content; Mark item published; Change gap status. Recorded permission boundary: Read private visibility/Search Console summaries; higher plans can mutate Cituna workflow state.

What data-handling boundary should I consider?

Cituna processes scan/citation/Search Console summary data; Google connection remains held by Cituna rather than exposed to MCP client. Recorded sensitive-access context: Search Console-derived data; Brand strategy; Content pipeline.

What limitations and risks should I check before use?

Marketing workflow writes can trigger scans/content-state changes; data is private workspace intelligence. Paid workspace required for most useful data. Write tools require higher plans. Connecting Cituna does not directly give the model Google credentials; Cituna holds the Search Console connection. AI visibility metrics are sampling/engine dependent. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is plan based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.