--- title: "Deploy OpenSEO | (Just Updated) Semrush Alternative Whose MCP Endpoint Is Not Public" category: "Analytics" url: https://railway.com/deploy/openseo-v013-or-semrush-alternative-whos --- # Deploy OpenSEO | (Just Updated) Semrush Alternative Whose MCP Endpoint Is Not Public **[Deploy OpenSEO | (Just Updated) Semrush Alternative Whose MCP Endpoint Is Not Public on Railway](https://railway.com/template/openseo-v013-or-semrush-alternative-whos)** - **Creator:** SuperSlowSloth - **Category:** Analytics - **Total deploys:** 1 ## Template content ### openseo - **Image:** ghcr.io/bon5co/openseo-railway:latest - **Health check:** /api/health - **Public domain:** Yes ## Documentation # Deploy and Host OpenSEO on Railway OpenSEO is an open-source alternative to Semrush and Ahrefs: keyword research, rank tracking, site audits, backlink analysis and SERP data on your own infrastructure, paying DataForSEO per call instead of a flat subscription. It also ships an MCP server, so Claude, Cursor or Codex can run the same research tools directly. This template deploys it as **one service on a volume**, with a gate in front of the whole surface — including the MCP endpoint, which OpenSEO's Docker mode authorizes for nobody. ## About Hosting OpenSEO **The MCP endpoint is the part that gets left open.** Docker self-hosting runs `AUTH_MODE=local_noauth`: OpenSEO has no login of its own and treats every caller as the admin. That is fine on a laptop and is exactly what upstream documents. On a public URL it means anyone who knows the hostname can call `POST /mcp` and get 24 research tools bound to your workspace — tools that spend **your** paid DataForSEO credits and can read and write your projects. Putting a password page in front of the browser UI does not close it: the other Railway listing that does gate the UI deliberately forwards `/mcp` unauthenticated, on the assumption that MCP clients authorize against OpenSEO. In this mode there is nothing to authorize against — reproduced anonymously through that exact gateway: `GET /` → 401, `POST /mcp whoami` → 200 as `admin@localhost`. This template gates all of it in a single container: the UI behind a password, `/mcp` behind a bearer token that an agent can actually send, and only `/api/health` left open because Railway's healthcheck is unauthenticated. Deployed with an empty password the container refuses to start rather than publishing an open admin console. **It also boots in seconds instead of minutes.** The stock self-host image runs the full ~7,400-module build at *container start* and keeps the output in the container filesystem, not on the volume — so on Railway, where every deploy and restart is a fresh container, that build runs every single time. Measured on identical hardware and env: 105 s to healthy and 3.16 GiB peak for the stock image, **8 s and 0.63 GiB** here, because the build is baked into the image along with the fingerprint upstream's entrypoint looks for. Change `AUTH_MODE` or any `VITE_*` value and it still rebuilds correctly at boot. **Everything that should persist, persists.** The volume mounts at `/app/.wrangler`, which is where OpenSEO keeps its D1, KV and R2 state: projects, saved keywords, rank-tracking history and the local admin workspace. Verified across a redeploy. ## Common Use Cases - A subscription-free keyword research and rank tracking workspace for one site or a portfolio - SEO tooling for an AI agent over MCP, with a bearer token instead of an open endpoint - Site audits and backlink analysis on data you keep, billed per DataForSEO call ## Dependencies for OpenSEO Hosting - A [DataForSEO](https://dataforseo.com) account — every SEO data feature calls their API. `DATAFORSEO_API_KEY` is the base64 of your `login:password`. - Optional: an OpenRouter key for SAM, the in-app agent, and Google OAuth credentials for Search Console. ### Deployment Dependencies - [OpenSEO](https://github.com/every-app/open-seo) — the application - [Docker self-hosting guide](https://github.com/every-app/open-seo/blob/main/docs/SELF_HOSTING_DOCKER.md) - [DataForSEO API key guide](https://github.com/every-app/open-seo/blob/main/docs/DATAFORSEO_API_KEY.md) - [bon5co/openseo-railway](https://github.com/bon5co/openseo-railway) — the image this template deploys, and the measurements behind every claim above ### Implementation Details - Image: `ghcr.io/bon5co/openseo-railway:latest`, wrapping `ghcr.io/every-app/open-seo:v0.1.3` (pinned — the other listings run `v0.1.1` and `latest`) - Volume: `/app/.wrangler` - Sign in with user `admin` and the generated `OPENSEO_ADMIN_PASSWORD`; point an MCP client at `https:///mcp` with `Authorization: Bearer ` - The deploy form asks for nothing: the password, the MCP token and the auth secret are all generated for you. After the first deploy add one variable — `DATAFORSEO_API_KEY`, the base64 of your DataForSEO `login:password` (`printf 'email:password' | base64`) — and the data features switch on. `/api/health` reports whether it is set. - The gateway rate-limits on the first address of `X-Forwarded-For`, since Railway's edge is every request's `remote_addr` ## Why Deploy OpenSEO on Railway? Railway runs the container, the volume and the domain without any of the ops around them, and usage-based billing suits a tool you open when you are doing SEO work rather than one that has to idle at full size all month. One service, one volume, no external database — and with the build baked into the image, redeploys come back in seconds. ## Similar templates - [Matomo Analytics + MariaDB](https://railway.com/deploy/matomo-analytics-mariadb) — Privacy-friendly analytics with MariaDB and persistent volumes. - [Bugsink](https://railway.com/deploy/bugsink) — Self-hosted Error Tracking. Sentry-SDK compatible - [SubTrackr](https://railway.com/deploy/bscottsubtrackr) — Self-hosted Subscription Tracker Open this page in a browser: https://railway.com/deploy/openseo-v013-or-semrush-alternative-whos