Ask your AI assistant about your AI visibility

1. Create a key

1. In CiteBrief, open Settings, then API and MCP. Owners and admins can create keys.
2. Name the key after where it will live, for example “Claude Code on my laptop”, and choose Create key.
3. Copy the key straight away: it is shown once. Store it in an environment variable such as CITEBRIEF_API_KEY rather than in a file you commit.

› A workspace can hold 10 active keys. Revoke one in the same place; anything using it stops at once.

2. Connect a client

Claude Code

export CITEBRIEF_API_KEY=cb_your_key
claude mcp add --transport http citebrief https://getcitebrief.com/api/mcp \
  --header "Authorization: Bearer $CITEBRIEF_API_KEY"

Check it with claude mcp list, then ask in any session. Add --scope user to use it in every project.

Cursor

{
  "mcpServers": {
    "citebrief": {
      "url": "https://getcitebrief.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:CITEBRIEF_API_KEY}"
      }
    }
  }
}

VS Code

{
  "servers": {
    "citebrief": {
      "type": "http",
      "url": "https://getcitebrief.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:CITEBRIEF_API_KEY}"
      }
    }
  }
}

Claude Desktop and other clients that only run local servers

Bridge to the remote server with mcp-remote, which runs locally and forwards to CiteBrief with your header. Add this to the client’s config (Claude Desktop: Settings, Developer, Edit config).

{
  "mcpServers": {
    "citebrief": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://getcitebrief.com/api/mcp",
        "--header",
        "Authorization:${CITEBRIEF_AUTH}"
      ],
      "env": {
        "CITEBRIEF_AUTH": "Bearer cb_your_key"
      }
    }
  }
}

Any HTTP client

Send one JSON-RPC message per POST. Clients normally call initialize and tools/list first; a direct call works too.

curl -s https://getcitebrief.com/api/mcp \
  -H "Authorization: Bearer $CITEBRIEF_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_visibility","arguments":{"brand":"acme.com"}}}'

3. Ask

Ask in plain words. The assistant picks the tools; start broad and narrow down.

• Which of my brands lost visibility since last week, and on which engine?
• For acme.com, which buyer questions does ChatGPT answer without naming us, and who does it name instead?
• Which sources do engines cite when they recommend our competitors? Draft an outreach plan from get_outreach.
• List the open fixes for acme.com by priority and tell me which ones I can ship today.
• Show me exactly what Gemini answered to “best invoicing tool for agencies” in the latest check.

› CiteBrief tracks whether AI engines (ChatGPT, Gemini, Perplexity, Google AI Overviews and others) name a brand for the questions its buyers ask. Read tools change nothing; keys made with “Can make changes” also get write tools (pause_prompts, save_competitor, pause_weekly_checks, create_article, update_fix) that never run a check, draft a page or touch a site. Start with list_brands, then get_visibility, get_competitors and get_citations; get_outreach and list_fixes say what to do next. Visibility is the share of scored buyer questions where the brand was named, from one answer per question per engine per weekly check.

Tools

8 read tools for every key, and 5 write tools for keys made with “Can make changes”. Write tools never run a check, draft a page or change your site, and each call is in the audit log. Brands can be named by name, domain or id; list_brands shows them.

Limits and errors

› Numbers match the app: visibility is the share of scored buyer questions where the brand was named, from one answer per question per engine per check. Confidence comes from the last four checks.

Security

• CiteBrief stores only a SHA-256 hash of each key. A lost key cannot be shown again; revoke it and create another.
• A key reads one workspace and nothing else. It cannot run checks, change questions, apply fixes or see billing.
• Creating and revoking keys is recorded in the workspace audit log, with who did it.
• Keep keys in environment variables or your client’s secret store, never in a repository.

Protocol

• Streamable HTTP without sessions: POST one JSON-RPC 2.0 message, get one JSON response. Batches are not accepted. Notifications get 202 Accepted.
• Protocol versions: 2025-06-18, 2025-03-26, 2024-11-05. The server answers initialize with your version when it supports it, otherwise with 2025-06-18.
• Capabilities: tools only (no resources, prompts or server-sent events). GET returns 405.
• CORS is open so browser-based inspectors work; the key is the only credential, never a cookie.