MCP server

What the server is

The whereamimentioned MCP server lets an AI assistant measure whether AI assistants mention your brand. Connected to Claude, Cursor, VS Code or any other MCP client, it can read your visibility reports, the model answers behind them, the competitors that appear instead of you and the sources the models cite, and it can run scans. It also carries the site tools that need no account at all: which AI crawlers can reach your site, validating and generating llms.txt, generating sitemaps, validating structured data, analysing how your content chunks, and checking meta descriptions.

Endpoint and URL shapes

One server, one base URL. The path decides what the client can reach, so no tool ever takes an organization or workspace as an argument: a model picks arguments from a schema and will eventually pick wrong, and a URL is set by whoever configured the client.

https://whereamimentioned.com/api/mcp
https://whereamimentioned.com/api/mcp/{orgSlug}
https://whereamimentioned.com/api/mcp/{orgSlug}/{workspaceSlug}
https://whereamimentioned.com/api/mcp/readonly
https://whereamimentioned.com/api/mcp/{orgSlug}/readonly
https://whereamimentioned.com/api/mcp/{orgSlug}/{workspaceSlug}/readonly

The unpinned URL serves the site tools to everyone. With an organization key it also reaches that organization and its workspaces; with an account-wide key it reaches the organization named on each request, plus the account-wide tools. Pinning an organization (/{orgSlug}) drops the account-wide tools. Pinning a workspace (/{orgSlug}/{workspaceSlug}) also drops the workspace list and workspace creation, so a pinned agent cannot even see the tools that would let it wander. Adding /readonly to any of them drops every tool that writes: run_scan, update_prompts, create_workspace and create_organization. The server also rejects those tools at the handler on a readonly URL, so a client that cached an older tool list cannot call them.

Two kinds of key

An organization key reaches one organization and is the default. Pick it unless you know you need the other one.

An account-wide key reaches every organization you belong to and is the only kind that can create a new one, which makes it a bigger secret. Used at the unpinned URL, it names the organization per request with the X-Wam-Org header (the organization slug), or you pin the organization in the URL, which is the simpler choice.

The safety property is worth one sentence: an account-wide key gives you no more permission anywhere, only more places to use it, and in each of them you are whatever you already are. If you are a viewer in an organization, the key is a viewer there. If you are removed from an organization, the key loses it on the next request, with nothing to rotate. At a pinned URL an account-wide key sees exactly what an organization key for that organization would see.

Where to mint a key

Settings > API keys in your organization, at /{orgSlug}/settings/api-keys. The key is shown once, at creation. API keys, the MCP server and the API are included on every paid plan; the site tools need no key at all.

Cost and confirmation

A scan spends credits, so the server makes an agent quote before it runs. estimate_scan is free: it returns the cost in credits and a signed quote that is valid for five minutes. run_scan requires that quote, an explicit confirmation and an idempotency key, and it re-derives the cost on the server, so a client cannot hand it a cheaper number. Replaying the same idempotency key returns the scan that already exists and starts nothing.

As a hard ceiling that does not depend on the client behaving, a key may start at most 3 scans per rolling 60 minutes. The tool error names the cap and when it resets.

Protocol

The server speaks MCP revision 2026-07-28 over Streamable HTTP, POST only, and also serves the 2025 revisions (2025-06-18 and earlier) statelessly, so a client still on one of those connects to the same URL: the initialize handshake is answered, no session id is issued, and there is no SSE stream. A client that cannot add a remote URL at all uses the stdio bridge below, which forwards each request to this endpoint.

Install

No single config snippet works everywhere: the top-level key and the transport name differ per client. Pick yours. Every snippet uses the placeholder wam_live_XXXX where your key goes.

claude mcp add --transport http whereamimentioned \
  https://whereamimentioned.com/api/mcp \
  --header "Authorization: Bearer wam_live_XXXX"

https://whereamimentioned.com/api/mcp

{
  "mcpServers": {
    "whereamimentioned": {
      "type": "http",
      "url": "https://whereamimentioned.com/api/mcp",
      "headers": { "Authorization": "Bearer ${WAM_TOKEN}" }
    }
  }
}

{
  "mcpServers": {
    "whereamimentioned": {
      "url": "https://whereamimentioned.com/api/mcp",
      "headers": { "Authorization": "Bearer wam_live_XXXX" }
    }
  }
}

{
  "servers": {
    "whereamimentioned": { "type": "http", "url": "https://whereamimentioned.com/api/mcp" }
  }
}

{
  "mcpServers": {
    "whereamimentioned": {
      "type": "streamableHttp",
      "url": "https://whereamimentioned.com/api/mcp",
      "headers": { "Authorization": "Bearer wam_live_XXXX" }
    }
  }
}

{
  "mcpServers": {
    "whereamimentioned": {
      "command": "npx",
      "args": ["-y", "@whereamimentioned/mcp"],
      "env": { "WAM_TOKEN": "wam_live_XXXX" }
    }
  }
}

Other clients

Every client needs the same two facts: the endpoint URL and, for the account tools, an Authorization: Bearer header carrying your key. Where a client cannot send a header, use the stdio bridge.

tools: [{ type: "mcp", server_label: "whereamimentioned", server_url: "https://whereamimentioned.com/api/mcp", authorization: "wam_live_XXXX" }]

amp mcp add whereamimentioned https://whereamimentioned.com/api/mcp

The stdio bridge

npx -y @whereamimentioned/mcp runs a small proxy: it reads each request from the client on stdin, POSTs it to the hosted endpoint, and writes the response back. It holds no tool definitions of its own, so what it lists is exactly what the hosted server lists. It reads these environment variables.

npx @whereamimentioned/mcp --help prints the same table. Requires Node 20.19 or newer.

Related

• The CLI
• The OpenAPI document for the REST API behind these tools
• The server card, the machine-readable description of this server
• All docs