CONNECT YOUR AI
Connect an AI assistant (MCP)
QueryHippo is an MCP server. Any AI assistant that supports remote MCP over
HTTP, and lets you set a custom Authorization header, can read your
Search Console evidence.
Endpoint
https://queryhippo.com/mcp The endpoint uses MCP Streamable HTTP with stateless JSON responses. Requests
are sent with POST; GET and DELETE return 405.
Authentication
Send a personal access token as a Bearer token on every request:
Authorization: Bearer <YOUR_PERSONAL_TOKEN> - Create tokens in the dashboard under Connect your AI.
Tokens start with
qhpat_. - A token lasts 30 days. You can copy it again while it is active, and revoke it there at any time.
- Your Google and Clerk credentials are never sent to the AI client. Keep your tokens private.
No OAuth yet. OAuth sign-in for hosted MCP clients is not
implemented. Use a client that lets you set a custom Authorization header.
Client setup
Generic JSON configuration
Many clients accept a server entry in this shape:
{
"url": "https://queryhippo.com/mcp",
"headers": {
"Authorization": "Bearer <YOUR_PERSONAL_TOKEN>"
}
} Claude Code
claude mcp add --transport http queryhippo https://queryhippo.com/mcp --header "Authorization: Bearer <YOUR_PERSONAL_TOKEN>" Replace <YOUR_PERSONAL_TOKEN> with a token from Connect your
AI.
What a token can see
A token grants exactly the properties its user can already see in QueryHippo: the properties you own, plus the ones another user has explicitly granted to you. Nothing else.
Read-only tools
Every tool is read-only. Tools never start collection and never call a model: QueryHippo returns measured evidence, and your assistant's model explains it.
- Results carry source labels. Fixture and synthetic data are always labelled as such.
- Errors are returned as safe error codes.
Source notice
If your Google connection needs attention, or the data may be stale, results include a second text block, the QueryHippo source notice. Your AI assistant should relay it to you before drawing conclusions.
Size limits
Results are size-limited, usually to 128 KiB. Some lists are shortened to fit, and the result says so when that happens.
Browser origins
Requests from a browser carry an Origin header, and that origin
must be an allowed one. Command-line and desktop clients that send no Origin header are fine.