Connect SEOReport to VS Code: MCP setup for GitHub Copilot

What you need

You need an active SEOReport plan and an API key. Create the key at https://seoreport.dev/dashboard/api-keys. API keys require an active plan. [3][4][1]

SEOReport shows the key once. Store it in a secret store or an environment variable, not in a prompt, a project file or your shell history. [4]

The server speaks streamable HTTP at https://seoreport.dev/mcp. It expects the key on every request as an Authorization: Bearer <api-key> header, the same key you use for the REST API. [3][4][1]

Add the server

Run MCP: Add Server from the Command Palette, select HTTP and enter https://seoreport.dev/mcp. Or edit one of the files below yourself. [5]

Option 1, a hidden prompt: in .vscode/mcp.json, define an input with "password": true and use it in the header. VS Code prompts you for the value when the server starts for the first time. [6]

Option 2, your user config: in ~/.copilot/mcp-config.json (or $COPILOT_HOME/mcp-config.json), add the server under mcpServers. This file is outside your projects and works across workspaces. [5][6]

{
  "inputs": [
    {
      "type": "promptString",
      "id": "seoreport-api-key",
      "description": "SEOReport API key",
      "password": true
    }
  ],
  "servers": {
    "seoreport": {
      "type": "http",
      "url": "https://seoreport.dev/mcp",
      "headers": {
        "Authorization": "Bearer ${input:seoreport-api-key}"
      }
    }
  }
}

{
  "mcpServers": {
    "seoreport": {
      "type": "http",
      "url": "https://seoreport.dev/mcp",
      "headers": {
        "Authorization": "Bearer sr__live_your_api_key"
      }
    }
  }
}

VS Code's Add Server flow lists .vscode/mcp.json as a deprecated destination it keeps for compatibility. It is still the format that supports input variables. [5][6]

VS Code does not forward configurations that need interactive input, such as ${input:...}, to Copilot harness sessions. If you work in those sessions, use option 2. [5]

Confirm it works

Run MCP: List Servers to start, stop or restart the server and to show its output. In the chat input, select Configure Tools to see the server's tools and turn single tools on or off. [6][5]

For a server from outside the workspace, VS Code shows a trust dialog when the server first starts or its configuration changes. [5]

You should see 9 tools whose names start with seoreport_: seoreport_create_report, seoreport_get_report_status, seoreport_get_report, seoreport_list_reports, seoreport_get_report_download, seoreport_get_account, seoreport_list_plans, seoreport_start_checkout and seoreport_submit_feedback. [3]

Then try a first prompt: "Audit https://example.com and list the three highest-severity findings." The agent can start the audit with seoreport_create_report and read the findings with seoreport_get_report. A report takes up to about 30 seconds. [4][3]

A new site uses one credit from your plan. Running a site you already have a report for again does not use a credit. [1][2]

Keep the key out of version control

VS Code's guidance is to avoid hardcoding sensitive information like API keys and to use input variables or environment files instead. [5]

Option 1 keeps the key out of .vscode/mcp.json, so you can commit that file. Option 2 holds the key in plain text in your home folder; never copy that file into a repository. [6]

The workspace-root .mcp.json supports neither input variables nor an environment file, so do not put this server there with a key in it. [6]

Troubleshooting

Authentication error or HTTP 401: SEOReport lists and calls tools only for a valid key. Check that the header value is Bearer, one space, then the key. If the key may be wrong or exposed, revoke it and create a new one in the dashboard. [3][4]

Plan or credit error: if seoreport_create_report says an active plan is required or the month's credits are used, the key works but the account cannot start a report. Ask the agent to call seoreport_get_account to see the plan and the credits left. [4]

To subscribe from the agent, it can call seoreport_list_plans and then seoreport_start_checkout. Checkout returns a browser link: an agent can start it, and only a person can pay. Credits reset on the first day of each month (UTC). [4][1]

Tools not listed: restart the server from MCP: List Servers. If the tool list looks out of date, run MCP: Reset Cached Tools. [6]

If MCP servers are unavailable altogether, your organization may manage MCP access through Copilot enterprise-managed settings. [5]