What an AI assistant should and should not be able to do in your SEO tool

Connecting an AI assistant to an SEO tool saves copying data between windows. It also raises a fair question: what is the assistant allowed to change? Here is how SerpUp answers it.

What the assistant can do

SerpUp has an MCP server, using the Model Context Protocol, an open standard for letting an assistant call tools in another product. It lists well over a hundred tools, most of them read-only; the full list, with how to connect, is public on the MCP tools page. Seven of them carry most of the work described here: list_actions, open_investigation, get_investigation, create_task, update_task_status, get_track_record and get_brief. With those an assistant can list what needs attention ranked by expected value, open and read an investigation, create a task, move a task through some states, and read your track record and content briefs.

What stays with people

An assistant cannot approve a task, verify it, monitor it or close it, and that includes approving a risky task. When it tries, it gets a message naming who can. The limit is enforced by SerpUp, not by the assistant behaving well, so it holds whichever assistant you connect.

The reason is practical. An assistant reads untrusted text such as page titles and queries, and that text can contain instructions meant to mislead it. Keeping approval and closing with a person means a misled assistant can propose a bad task but cannot ship it.

A safe first session

1. Connect read-only. A key is either read only (the default, and the write tools are not even listed to it) or read and write, and it can be limited to chosen properties when you create it.
2. Ask for your open work and check that the list matches the Action Center.
3. Ask it to open an investigation and read the evidence back to you.
4. Only then allow task creation, and review each task before it is validated.

If you connect with an API key instead, it is shown once at creation, so put it in the assistant's own secret storage and not in a document. A key can be revoked at any time. Changes an assistant makes with a read and write key are recorded in the same audit log as the same action in the app.

Short version: give an assistant the narrowest scope that does the job, let it propose, and keep approval and verification with a person.