# Auth.md (auth.md)

EnterraHost MCP authentication.

EnterraHost exposes two remote MCP servers, one for EnterraMon and one for EnterraSEO. Both require a customer key. The discovery documents are public. The tools are read-only.

## Endpoints

| Product | MCP endpoint |
|---|---|
| EnterraMon | `https://mcp.enterrahost.com/enterramon/mcp` |
| EnterraSEO | `https://mcp.enterrahost.com/enterraseo/mcp` |

Use the endpoint for the product you have. Add both if you have both.

## Get a key

1. Sign in at `https://toolbox.enterrahost.com/login`.
2. Open **Account settings**.
3. Open **Agent access**.
4. Choose **Create agent key**.
5. Copy the key once and store it in your agent's secret store.

The section appears only when an EnterraMon or EnterraSEO product is active on the account. One key can read both products when both are active.

## Send the key

Send the key as a bearer token:

```http
Authorization: Bearer <customer-key>
```

Do not put the key in a prompt, a document, a screenshot or a support ticket.

## What the key can read

- EnterraMon availability, response time, SSL and domain expiry, daily audit scores, Core Web Vitals, security headers, accessibility findings and recommendations.
- EnterraSEO crawl findings, page snapshots, technical on-page checks, keywords and rankings, Search Console and Analytics summaries, backlinks, competitors and answer visibility, within the products on the account.
- EnterraSEO AI readiness: robots.txt, llms.txt, sitemap presence, Markdown delivery and Content-Signal details. Crawler access is reported separately from the optional AI-readiness score.

The key cannot edit a page, create a backup, run a new crawl or start a paid check.

## Using the data

All timestamps are UTC. A date-only value is a calendar date, not an instant.

The newest audit or crawl is a point-in-time snapshot. Older rows are history for trends. Do not present an older row as current state.

EnterraMon audits are labelled `scheduled` or `on-demand`. Multiple on-demand tests can share one date, so audit history is a list, not one row per day.

If the latest audit is on-demand, stale, or older than the expected cadence, the agent must:

1. tell the human what is unscheduled or stale;
2. explain that findings may no longer describe the site;
3. obtain explicit permission before acting on them.

Do not treat a stale snapshot as current and do not run a production change on it without that permission. The MCP cannot trigger a new crawl or audit.

## Status codes

- `401` means the key is missing, wrong or revoked.
- `403` means the key is valid but the product is not active.
- `isError` with `code: "not_attached"` and `reason: "not_attached"` means the domain is not attached to this key.
- `isError` with `code: "inactive"` and `reason: "inactive"` means the property is attached but switched off.
- `isError` with `reason: "page_not_found"` means the URL is not in the latest crawl for that property.
- `isError` with `reason: "property_not_crawled"` means the property has no crawl yet.
- `isError` with `reason: "invalid_arguments"` means the tool arguments are invalid; the message names the field and rule. The protocol code is `-32602`.

## Discovery

- MCP manifest: `https://enterrahost.com/.well-known/mcp.json`
- MCP server card: `https://enterrahost.com/.well-known/mcp/server-card.json`
- EnterraMon server card: `https://enterrahost.com/.well-known/mcp/enterramon/server-card.json`
- EnterraSEO server card: `https://enterrahost.com/.well-known/mcp/enterraseo/server-card.json`
- Human guide: `https://enterrahost.com/agent-access/`
- Support: `https://enterrahost.com/support/articles/agent-access/`

The server cards contain public metadata only. They never contain a key.

## Safety

The MCP key is separate from any site credential. Giving an agent access to the actual site is a second decision. Start read-only, then staging, then production only with a backup, a Git branch or tag, staging verification and human approval. Never give an agent root SSH, DNS, payment or authentication access for a content fix.

## More

- [Agent access guide](https://enterrahost.com/agent-access/)
- [Agent access support article](https://enterrahost.com/support/articles/agent-access/connect-your-own-agent/)