SCom-82/topvisor-mcp
An unofficial MCP server that provides 17 tools for Yandex/Google rank tracking via the Topvisor API v2, enabling project management, keyword import, asynchronous position checks, and retrieval of history and SERP snapshots.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SCom-82
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
topvisor_servicesList all Topvisor API v2 services, operators, methods, searcher_key reference, filter operators, and all 17 tools in this MCP server. Works without credentials.
topvisor_requestGeneric escape hatch: call any Topvisor API v2 method directly. Covers all API methods including undocumented ones not yet available as typed tools. Use operator/service/method path and pass body verbatim.
topvisor_balanceGet account balance. Returns balance calculated from transaction history (sum of all deposits minus charges). NOTE: The Topvisor bank_2/info endpoint returns empty result for single-user accounts — this is a known API limitation confirmed empirically (result:[], total:1 regardless of parameters; fi…
topvisor_bank_historyGet account transaction history (deposits, charges, bonuses).
topvisor_list_projectsList all projects in the account. Use fields, filters, orders for precise queries. show_searchers_and_regions=1 includes configured search engines and regions.
topvisor_add_projectCreate a new project in Topvisor. Returns the new project object. ⚠️ Exact response shape not fully documented — raw result is returned.
topvisor_add_searcherAdd a search engine (searcher) to a project. Must be done before adding regions.
topvisor_add_regionAdd a region to a searcher for a project. After adding, call topvisor_list_regions to get the assigned region_index — region_key (add-time catalog key) is NOT the same as region_index (query-time index used in history/checker calls).
topvisor_list_regionsList configured searchers and regions for a project. Returns region_key and region_index for each region. CRITICAL: region_key (used when adding a region) is NOT the same as region_index (used in topvisor_get_history, topvisor_check_price, topvisor_check_positions). Always call this tool after addi…
topvisor_list_keywordsList keywords for a project. Supports filtering, ordering, pagination.
topvisor_import_keywordsImport keywords into a project via CSV. Returns {countSended, countDuplicated, countAdded, countChanged}. To assign keywords to a group, set group_name or include group_name column in CSV headers.
topvisor_check_pricePreview the cost of a position check without actually running it. Returns pricesByUsers.<userId>={projectsIds, price}. Use this before topvisor_check_positions to estimate cost.
topvisor_check_positionsASYNC: Submit a position check job to the Topvisor queue. Returns projectsIds immediately — actual data collection runs in the background (minutes to hours depending on queue). To monitor progress, poll topvisor_list_projects for status_positions/positions_percent fields. Read results later via topv…
topvisor_get_historyGet position history for a project and regions. Requires either 'dates' array OR both 'date1' and 'date2'. Returns keywords[] with positionsData.
topvisor_get_summaryGet a positions summary comparing two dates for a project and single region. Returns keyword distribution across top positions with optional dynamics, tops, averages, and visibility metrics.
topvisor_get_summary_chartGet chart data showing position distribution over time for a project and single region. Returns dates array and seriesByProjectsId for chart rendering.
topvisor_get_snapshotsGet SERP snapshots for a project and region. Snapshots are collected when do_snapshots=1 is set in topvisor_check_positions. Returns snapshotsData per keyword. Requires either 'dates' array OR both 'date1' and 'date2'.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
TOPVISOR_API_KEY"": "your_api_key"TOPVISOR_API_URLno https://api.topvisor.com/v2/json Override base URLTOPVISOR_HTTP_TIMEOUT_MSno 30000 HTTP request timeout in millisecondsTOPVISOR_USER_ID"": "your_user_id",Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
17/17 tools missing one or more hints — topvisor_services (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); topvisor_request (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); topvisor_balance (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +14 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
15/17 tool handlers declare input schemas (88%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/17 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @scom82 doesn't match GitHub owner scom-82
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/scom-82/topvisor-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check