Back to Browse

Cloro MCP Server

Developer ToolsModerate5.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Scrape AI answer engines and Google Search/News with country and state-level geo-targeting.

About

Scrape AI answer engines and Google Search/News with country and state-level geo-targeting.

Remote endpoints: streamable-http: https://mcp.cloro.dev/mcp

Security Report

5.2
Moderate5.2Moderate Risk

The cloro MCP server is a thin wrapper that forwards caller credentials (API keys or verified OAuth tokens) as Bearer tokens to the cloro API, with no hardcoded secrets, no shell execution, and no exfiltration to unexpected hosts. Its network access matches its stated purpose of querying the cloro scraping API. Minor concerns include API keys placed in URL paths (a documented design choice that risks logging) and truncated source hiding the remainder of the URL parser, but no significant security issues were found. Supply chain analysis found 4 known vulnerabilities in dependencies (1 critical, 1 high severity).

10 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

cloro MCP Server

A Model Context Protocol (MCP) server for cloro, the LLM scraping API that includes a Google SERP API. It gives Claude, Codex, Cursor and any MCP client answers from ChatGPT, Gemini, Google AI Mode, Google AI Overview and Bing AI Mode, plus Google web search and Google News results. Ask your agent "compare Google's top results for best LLM scraping API with ChatGPT's answer" and it calls cloro and reasons over the parsed results and cited sources.

Runs hosted at mcp.cloro.dev, or locally over stdio.

How do you connect an agent to the cloro MCP server?

In Claude, you sign in with OAuth and do not need a key:

  1. Go to Customize → Connectors and select Add custom connector.
  2. Enter https://mcp.cloro.dev/mcp. Under Authentication, choose Sign in when needed.
  3. Ask Claude to use a cloro tool. Sign in to cloro and select the organization whose credits pay for the calls.

Other clients use a cloro API key from the dashboard. The hosted server speaks Streamable HTTP. Put the key in the URL path so it works in clients that cannot set custom headers:

{
  "mcpServers": {
    "cloro": {
      "type": "http",
      "url": "https://mcp.cloro.dev/YOUR_CLORO_API_KEY/mcp"
    }
  }
}

If your client can set headers, use https://mcp.cloro.dev/mcp with Authorization: Bearer YOUR_CLORO_API_KEY. In Claude Code:

claude mcp add --transport http cloro https://mcp.cloro.dev/YOUR_CLORO_API_KEY/mcp

In Cursor

This repo is also a Cursor plugin. Install it from the Cursor marketplace, or point Cursor at the repo, and Cursor prompts for one variable:

VariableValue
CLORO_API_KEYYour key from the dashboard

Cursor stores the key on its side and sends it as Authorization: Bearer, so the key stays out of the URL and out of the repo. The manifest is .cursor-plugin/plugin.json and the server definition is mcp.json.

Running it yourself

npm install
npm run build
MCP_TRANSPORT=stdio CLORO_API_KEY=your_key node dist/index.js

MCP_TRANSPORT is http (default) or stdio. In stdio mode the client spawns the process and the key comes from CLORO_API_KEY; in http mode keys arrive per request and no key is configured on the server. PORT defaults to 8095 and CLORO_API_URL to https://api.cloro.dev.

OAuth is off unless you set CLERK_ISSUER. The hosted server sets it to https://clerk.cloro.dev. api.cloro.dev accepts only tokens from that issuer, so a self-hosted server that forwards to it must use the same value. MCP_PUBLIC_URL (default https://mcp.cloro.dev) sets the resource URL in the protected resource metadata.

What tools does it expose?

ToolEndpoint
scrape_chatgptPOST /v1/monitor/chatgpt
scrape_geminiPOST /v1/monitor/gemini
scrape_google_ai_modePOST /v1/monitor/aimode
scrape_bing_aimodePOST /v1/monitor/bing/aimode
scrape_googlePOST /v1/monitor/google
scrape_google_newsPOST /v1/monitor/google/news
resolve_google_redirectPOST /v1/monitor/google/goto
list_countriesGET /v1/countries
list_statesGET /v1/states

The assistant tools take a prompt and a country (ISO 3166-1 alpha-2), plus an optional state for US state-level targeting. The Google tools take gl for the result geography and an optional hl for the interface language; country still works as a deprecated alias for gl. scrape_google_ai_mode targets sub-country with location or uule rather than state. scrape_google runs either from a query plus gl, or from a complete google.com/search URL that carries the query and pagination itself, and accepts include.aioverview for Google's AI Overview. Every tool takes an optional include object for heavier payload fields; leave it unset for the leanest response.

A Google result link can come back empty, or as a google.com/goto URL, with a redirectLink beside it. Pass the redirectLink to resolve_google_redirect to get the destination.

There is no Grok tool. Grok is discontinued: grok.com shows a sign-up wall to logged-out visitors, and the cloro API rejects Grok calls with a 400 (MODEL_UNAVAILABLE).

There are no Copilot or Perplexity tools. Both are discontinued: they block access for logged-out sessions, and the cloro API rejects their calls with a 400 (MODEL_UNAVAILABLE). These calls cost no credits.

How it works

The server holds no business logic and no secrets. Each request forwards the caller's own credential, an API key or an OAuth access token, to api.cloro.dev as a Bearer token, so authentication, credit billing, rate limiting and concurrency are all enforced by the API rather than here. In http mode every POST builds a fresh server and transport bound to that caller's credential, which is why one deployment serves everyone with no session state.

initialize and tools/list answer without a credential, so a client can list the tools before sign-in. The first tools/call without one returns 401 with a WWW-Authenticate header that points at /.well-known/oauth-protected-resource/mcp. An OAuth client reads the authorization server from there and runs the flow. The server checks a token's signature against the issuer's public JWKS (code in src/oauth-tokens/), so it needs no Clerk secret.

Tool input schemas are the same zod schemas the API validates with, vendored into src/schemas/ from cloro's backend. They are copied rather than imported because that package is not published. The API reference is authoritative if the two ever disagree.

FAQ

Do I need to self-host this?

No. mcp.cloro.dev is hosted and is the path most people should take. This repo exists so you can read what runs, and self-host if your setup calls for it.

Does it cost credits?

Yes. The scrape tools call the sync API, so each call costs the API rate plus a 2-credit sync surcharge. For example, a ChatGPT call costs 7 credits (5 + 2). Each tool description states its cost, and each result returns the credits charged and remaining. resolve_google_redirect costs 1 credit, with no surcharge. list_countries and list_states read fixed reference lists and charge nothing. See pricing.

Why is my API key in the URL?

Because several MCP clients cannot set custom headers. If yours can, use the Authorization header form instead and keep the key out of the path. If your client supports OAuth, use that and there is no key at all. The URL path accepts API keys only, never OAuth tokens.

What is the request timeout?

320 seconds. Sync scrapes can take up to five minutes server-side, so the client budget leaves headroom. For long-running batches use the async task API rather than MCP.

Are there agent skills for cloro?

Yes. cloro-dev/skills has one skill per surface (ChatGPT, Gemini, Google AI Mode, Google AI Overview, Google Search, Google News) and skills for SERP research, LLM answer monitoring and AI visibility tracking. Install them with npx skills add cloro-dev/skills. The skills tell the agent which tool or endpoint to call, what it costs, and how to read the result. They work with this server or with the REST API.

Learn more

License

MIT. See LICENSE.

Reviews

No reviews yet

Be the first to review this server!