Docs · run it from your terminal
One command to connect. Then you just talk to your agent.
Moonleap is a Model Context Protocol server. Your coding agent reads the findings, verifies them in your repo, fixes what you approve and reports back. This page is the commands, what each tool does, and one real session.
$ claude mcp add --transport http moonleap https://moonleap.io/mcp
✓ connected · one-click authorize, no API key to copy
you: what does moonleap see on my site? start with the overview
agent: get_overview → 4 open findings (1 high), Google connected, 2 content ideas on hold
agent: plan: 1) fix hreflang return links in the layout 2) drop /login from the sitemap
you: do 1 and 2
agent: done · report_finding ×2 · the Monday check will confirm
1
Connect
One command per client. A browser tab asks you to approve; the token stays in the client. Revoke it any time in Settings.
2
Ask in plain words
"Check moonleap and fix what we agree on." The agent picks the tools; you never type a tool name unless you want to.
3
Approve, then it reports
Every finding it closes is recorded with a note and a date. Monday's report says what moved and what came back.
Connect your client
claude mcp add --transport http moonleap https://moonleap.io/mcp
Run it in your project folder (add --scope user for every project), then type /mcp in Claude Code and pick Authenticate — your browser opens, you approve, done.
What happens
OAuth in the browser, no key to paste. The client keeps a token; Settings shows which clients are connected and lets you revoke each one.
Check it worked
Ask the agent to list_projects. In the app, Settings shows the client and its last call.
One session, annotated
A real exchange, with the tool the agent used at each step.
you: check moonleap and fix what we agree on
agent: [get_overview]4 open findings, 2 snoozed until 11 Sept, Google connected, 6 queries rank but get no clicks
agent: [verifies in repo]the sitemap generator lists /login; the layout has no hreflang return links for the /nl pages
agent: plan: 1) remove /login and /register from src/routes/sitemap.xml 2) generate hreflang from the translations table in +layout.svelte 3) the AI Overview ones are a content decision, not code
you: do 1 and 2, snooze 3 for two weeks
agent: [report_finding done ×2, snoozed ×1]2 files changed, checks pass, committed
moonleap: logged. The Monday check re-tests both fixes; if one comes back you get a "regressed" note with your own words attached.
Everything about the project in one call: findings with evidence, what is parked, Search and AI numbers, priorities.
The agent checks the finding against your code before proposing anything. A wrong finding gets disputed, not fixed.
Nothing changes without it. Approve some items and snooze others.
Closes each item with a note and a date. This is what makes Monday's re-measurement possible.
What happens, every time
Detect
Moonleap lists findings with the URLs and values they were computed from.
Verify
Your agent checks each one against the repository before proposing anything.
Plan
A short list of changes, with the files.
You approve
Some, all, or snooze. Nothing ships without it.
Fix and report
Edits, checks, commit, then a dated note per finding.
Re-measure
Monday: what moved, and what came back.
Tool reference
15 tools. Your agent chooses them; you can also name one. Start with the first.
- get_overview
- The whole project in one call: open findings with evidence and recipe, what is parked and until when, Search Console and GA4 movement, AI mentions, security state, watch alerts, and a ranked list of what to do first. Start here, every session.
- get_findings
- Open findings with evidence and a fix recipe, plus snoozed ones with their return dates. When you need every row, not the summary.
- get_insights
- Search Console and GA4 for the last 28 days against the 28 before, the queries that rank but get no clicks, and content ideas built from real queries. With Google connected.
- get_watch
- The daily checks (site up, noindex, robots, certificate) and the last weekly report versus the week before. To see what moved.
- get_profile
- What Moonleap thinks the site is, for whom, in which markets, and who the competitors are.
- list_projects
- Your projects and their ids.
- analysis_status
- Whether an analysis is running, when the last one finished, and what the quota allows next.
- get_notifications
- Recent alarms, reports and draft notices with their delivery status.
- report_finding
- Closes a finding as done, disputed, skipped or snoozed, with a note. Required for every finding the agent fetched; the note is what the Monday check compares against. After each change you approved.
- report_content_idea
- The same for a content recommendation: shipped, disputed, skipped, snoozed, or already exists.
- run_analysis
- A full re-analysis of the public site (crawl, inventory audit, AI probes, speed, rankings, links, security surface). Three a day, 12 hours apart unless forced. After a deploy.
- check_draft
- Runs a page or post draft through the content quality gate: filler, vague numbers, missing question headings, unsourced claims. Before publishing anything.
- run_security_checkup
- The instructions for the repo-side checkup an external scanner cannot do: git history, .env hygiene, agent transcripts, RLS, buckets, dependencies. Monthly, and after auth or webhook changes.
- submit_security_checkup
- Records the checkup; every reported issue becomes a security finding in the normal loop.
- mark_finding_done
- Shortcut for report_finding with outcome done.
Prompts that work
First time
use moonleap: get_overview for <project> and tell me what to do first, with the evidence
The loop
check moonleap for <project> and fix what we agree on; verify each finding in the repo before proposing, show me the plan, and report every item you touch
After a deploy
run_analysis for <project> with force, wait for it to finish, then re-check the findings I asked you to fix and report them
Security
run the moonleap security checkup on this repo; present what you find masked, never a raw value, then submit it
Before publishing
run this draft through moonleap check_draft and fix what fails before I publish it
FAQ
Do I have to type tool names?
No. Say what you want in plain words; the agent picks the tools. Naming one is useful when you want a specific action, such as run_analysis after a deploy.
Does Moonleap need access to my repository?
No. Moonleap reads the public site. The repository work happens on your machine, by your agent, under your approval.
What if the agent never reports back?
The finding stays at "fetched" and Settings shows it awaiting a report. Ask the agent to close its items; the protocol it receives with every finding says the same.
Can I use it without an MCP client?
Yes: the app shows the same findings and recipes, and an API key from Settings works as a bearer token for scripts and CI.