Deploy
Deploy to your Cloudflare
v0.1.0 First release · open source

Your search data,
kept.

SEO & GEO analytics that lives in your own Cloudflare account. See which pages AI crawlers read, cite and send clicks to, keep your history forever, and ask about it from Claude, Cursor or ChatGPT.

Deploy to your Cloudflare Star on GitHub
  • One Worker + D1
  • No telemetry
  • Behind Cloudflare Access
  • MIT licensed

Built on data you already own

  • Google Search Console
  • Bing Webmaster Tools
  • Cloudflare AI crawler traffic
  • Cloudflare Web Analytics
  • Claude
  • Cursor
  • ChatGPT
The GEO funnel

Crawled. Cited. Clicked.
Finally in one place.

Generative engines read your site long before anyone clicks. Searchkeep joins three first-party sources per page, so you can see where AI visibility leaks out, not just that it does.

  1. 01

    Crawled

    Cloudflare AI crawler traffic

    Which pages GPTBot, ClaudeBot, PerplexityBot and friends actually fetch, how often, and with what status code.

  2. 02

    Cited

    Bing AI Performance (CSV import)

    Which of those pages show up as sources in AI answers, so you know crawling turned into visibility.

  3. 03

    Clicked

    Web Analytics · GSC · Bing

    Visits referred by ChatGPT, Perplexity, Copilot and others, side by side with classic search clicks.

Crawled, not cited

AI reads it, then ignores it.

Often thin or outdated pages, missing direct answers, or crawlers hitting errors. Fix the content or the status code.

Cited, not clicked

You’re the source, not the destination.

The answer is complete without you. Add what an answer can’t: tools, data, depth, a next step.

The Cited step uses Bing AI Performance, which has no API yet: you import its CSV export from the dashboard. Example figures are illustrative.

MCP server

Ask, don’t dig.

Point Claude, Claude Code, Cursor or ChatGPT at https://your-domain/mcp. Twelve task-shaped read-only tools aggregate on the server and return compact answers, so your assistant does the digging.

13 tools 12 read-only · 1 opt-in write
  • list_sites Configured sites, their connected sources and stored date ranges.
  • query_performance Clicks, impressions, CTR and position by any dimension.
  • compare_periods What moved between two periods, and by how much.
  • find_quick_wins High-impression queries ranking just off the top.
  • find_cannibalization Queries where several of your pages compete.
  • find_ctr_anomalies Queries with a CTR well below what their position predicts.
  • find_content_decay Pages whose clicks have been sliding for weeks.
  • geo_funnel Crawled → Cited → Clicked, per page.
  • ai_crawlers AI crawler requests by bot, operator, purpose, path and status.
  • inspect_url Live Google URL Inspection for one URL.
  • list_sitemaps Sitemaps known to Search Console, with status.
  • submit_sitemap Submit a sitemap to Search Console. Off by default. write · off
  • setup_status Readiness, configuration and sync health in one call.
Tool reference
Dashboard

And look, when you’d rather look.

A fast dashboard served by the same Worker. Every view runs the same analysis functions as the MCP tools, so the numbers your assistant quotes are the numbers you see.

  • Overview

    Clicks, impressions and AI crawler requests for a site, against the previous period.

  • GEO funnel

    Every page’s path from crawled to cited to clicked, with crawled-but-never-cited pages flagged.

  • AI crawlers & referrals

    Requests by bot, operator and purpose (training, search, user), and visits sent by AI assistants.

  • Performance & compare

    GSC and Bing queries and pages, brand vs non-brand, by country and device, period over period.

  • Opportunities

    Quick wins, cannibalization, CTR anomalies and content decay, ranked.

  • Technical & settings

    Web Vitals, sitemaps, crawl issues and URL inspection, plus setup checks, sync runs and Sync now.

Long-term history

Keep your history forever.

Search Console forgets everything older than 16 months. Searchkeep starts backfilling those 16 months the day you deploy, keeps every new day in D1 and never deletes. Comparing this quarter with the same quarter two years ago just works.

Search Console
16 months
Searchkeep, two years in
40 months, and counting
Dropped by Google after 16 months Backfilled after you deploy Synced daily, never deleted
Data sources

First-party data only.

Searchkeep reads the APIs you already have access to, for sites you own. Each source is synced into D1 once a day, in small batches; live calls are reserved for things like URL inspection.

  • Google Search Console

    • Search Analytics by date, query, page, country, device
    • Sitemaps
    • Live URL Inspection
    Credential
    Service account, added as a Restricted user
    Keep in mind
    16 months of history, a few days of delay

  • Bing Webmaster Tools

    • Traffic, query and page stats
    • Crawl issues
    • AI Performance citations, imported from its CSV export
    Credential
    API key
    Keep in mind
    Weekly granularity, no date filter

  • Cloudflare

    • AI crawler requests by bot, path and status
    • Web Analytics page views and referrers
    • Core Web Vitals
    Credential
    Read-only API token
    Keep in mind
    AI crawler data needs a proxied zone
Every source, permission and limitation
Ownership

One Worker. Your account.
Nobody else in the loop.

MCP, the dashboard and the scheduled sync are three entrances to one Worker, sharing one core and one D1 database. There is no Searchkeep server to trust, pay or outlive.

  • Your data never leaves your account

    Searchkeep runs as one Worker and one D1 database in your Cloudflare account. No telemetry, no vendor server, nothing phones home.

  • Read-only by default

    Every tool reads. The single write, submitting a sitemap, stays unregistered until you set ENABLE_WRITES and grant Full permission.

  • Free-tier friendly

    One Worker, one D1 database and a cron that syncs in small batches, paced to stay within Cloudflare’s free plans for typical sites.

  • Upgrade = Sync fork

    Click “Sync fork” on GitHub. Workers Builds rebuilds and deploys, and the Worker applies new migrations itself. Your config lives in Secrets, so nothing conflicts.

Security

Secure by default.
Locked until it’s safe.

Search data is sensitive. Searchkeep refuses to serve any of it until Cloudflare Access is protecting it properly, and it checks again on every request.

  • Cloudflare Access in front

    One self-hosted Access app guards the dashboard and the MCP endpoint. Only the emails you allow get in.

  • Managed OAuth for MCP

    Access acts as the OAuth 2.1 server with dynamic client registration and PKCE. No client IDs to paste.

  • JWT re-verified in the Worker

    Every request’s Access JWT is checked against your team’s keys and AUD tag, so bypassing Access gets nothing.

  • Locked until ready

    Until Access, Managed OAuth and a tight policy are confirmed, data and sync stay off. Break a check later and it locks again.

  1. 1
    no_access Not protected by Access
    Locked
  2. 2
    oauth_disabled Managed OAuth off
    Locked
  3. 3
    policy_too_broad Policy too broad
    Locked
  4. 4
    ready All checks pass
    Serving
  5. Cron only syncs after ready is recorded, and re-checks Access before every pass.
Deploy with an agent

Hand the runbook to your agent.

The deploy guide is written as an idempotent runbook: every step can be re-run and comes with a check. An agent with GitHub and Cloudflare MCP access can do almost all of it, and stops to ask when a human must click.

  • You, once Authorize the Cloudflare GitHub App
  • You, once Create your Zero Trust organization
  • You, once Create the read-only Cloudflare API token
  • You, once Add the service account in Search Console
  • You, once Generate the Bing API key
  • You Sign in through Access
Read the runbook
Comparison

Honest about what it isn’t.

Searchkeep is deliberately narrow: your own data, for your own sites. If you need backlinks, competitor research or rank tracking, keep a SaaS tool for that, and use Searchkeep for everything you own.

CapabilitySearchkeepTypical SaaS SEO tool
Where your data livesYour Cloudflare accountThe vendor’s servers
PriceFree, MIT licensedMonthly subscription
History past GSC’s 16 monthsKept in D1, foreverVaries; often only while subscribed
AI crawled → cited → clicked, per pageBuilt inRare
Ask from Claude, Cursor, ChatGPT12 read-only MCP toolsSometimes
TelemetryNoneUsually
Writes to your propertiesOff unless you opt inVaries
Backlink indexNo, by designYes
Competitor researchNo, by designYes
Rank tracking (SERP scraping)No, by designYes
FAQ

Questions, answered.

More in the docs FAQ, or open an issue on GitHub.

What is Searchkeep?

Searchkeep is open-source SEO and GEO (generative engine optimization) analytics that you deploy to your own Cloudflare account. It keeps syncing Google Search Console, Bing Webmaster Tools and Cloudflare data into a D1 database, then lets you explore it in a dashboard or ask about it from any MCP client such as Claude, Cursor or ChatGPT.

How much does it cost?

Searchkeep is free and MIT licensed. You pay only for the Cloudflare resources it uses: one Worker, one D1 database and a cron trigger, which fit within Cloudflare’s free plans for typical sites. The history backfill is paced to stay under D1’s free limit of 100,000 rows written per day. Cloudflare Access is part of Zero Trust, which has a free plan for small teams.

Does my data leave my Cloudflare account?

No. Searchkeep has no backend of its own and sends no telemetry. Data flows from Google, Bing and Cloudflare APIs into your D1 database and is served only to you, through Cloudflare Access. When you ask a question over MCP, the tool results go to the AI client you chose to connect, just like any other MCP server.

What is the GEO funnel?

It follows each page through three steps of AI visibility: Crawled (AI crawlers fetched it, from Cloudflare), Cited (an AI answer referenced it, from the Bing AI Performance report, which has no API yet, so you import its CSV export from the dashboard) and Clicked (people arrived from an AI assistant, from Web Analytics referrers, alongside classic GSC and Bing clicks). Gaps between steps tell you what to fix.

How far back does the history go?

After you deploy, Searchkeep backfills as much as Google provides, which is 16 months, one day at a time. On the free D1 write quota the full backfill takes days to weeks. It never deletes anything, so your history keeps growing past the point where Search Console forgets it. The earlier you deploy, the more you keep.

Why no backlinks, competitor data or rank tracking?

By design. Searchkeep only uses first-party data you already have access to for sites you own. Backlink indexes and rank trackers depend on large-scale crawling or SERP scraping, which needs a vendor and is outside the project’s charter. Pair Searchkeep with a dedicated tool if you need them.

Do I need a paid Cloudflare plan?

No. AI crawler data requires the site to be proxied through Cloudflare (orange-clouded), which works on the free plan; Searchkeep identifies crawlers by user agent. AI referrals come from Web Analytics referrer hosts. Workers Free allows 10 ms of CPU per invocation, so the sync works in small batches; if sync units keep getting skipped, lower GSC_ROWS_PER_DAY or move to Workers Paid.

Can an AI agent deploy it for me?

Yes. The deploy guide is written as an idempotent runbook with a verification for every step. An agent with GitHub and Cloudflare MCP access can fork the repo, create the Worker, configure Access and set Secrets. A few steps need a human: authorizing the Cloudflare GitHub App, creating the Zero Trust organization, adding the service account in Search Console, generating the Bing API key and signing in through Access.

Which AI clients can connect?

Any MCP client that supports Streamable HTTP with OAuth, including Claude, Claude Code, Cursor and ChatGPT. Cloudflare Access acts as the OAuth server with dynamic client registration and PKCE, so there is no client ID to paste: the client opens a browser, you sign in, and it is connected.

How do I upgrade?

Open your fork on GitHub and click “Sync fork”. Workers Builds notices the new commit, builds and deploys, and the Worker applies any new D1 migrations itself on its next request. Your configuration lives in Worker Secrets, never in the repo, so upstream changes do not conflict with it.

Start keeping your search data today.

Every day you wait is a day Search Console forgets. Deploying takes about 30–45 minutes.

Deploy to your Cloudflare Star on GitHub