Deploy and Host OpenSEO on Railway

OpenSEO is an open-source alternative to Semrush and Ahrefs: keyword research, rank tracking, site audits, backlink analysis and SERP data on your own infrastructure, paying DataForSEO per call instead of a flat subscription. It also ships an MCP server, so Claude, Cursor or Codex can run the same research tools directly.

This template deploys it as one service on a volume, with a gate in front of the whole surface — including the MCP endpoint, which OpenSEO's Docker mode authorizes for nobody.

About Hosting OpenSEO

The MCP endpoint is the part that gets left open. Docker self-hosting runs AUTH_MODE=local_noauth: OpenSEO has no login of its own and treats every caller as the admin. That is fine on a laptop and is exactly what upstream documents. On a public URL it means anyone who knows the hostname can call POST /mcp and get 24 research tools bound to your workspace — tools that spend your paid DataForSEO credits and can read and write your projects. Putting a password page in front of the browser UI does not close it: the other Railway listing that does gate the UI deliberately forwards /mcp unauthenticated, on the assumption that MCP clients authorize against OpenSEO. In this mode there is nothing to authorize against — reproduced anonymously through that exact gateway: GET / → 401, POST /mcp whoami → 200 as admin@localhost.

This template gates all of it in a single container: the UI behind a password, /mcp behind a bearer token that an agent can actually send, and only /api/health left open because Railway's healthcheck is unauthenticated. Deployed with an empty password the container refuses to start rather than publishing an open admin console.

It also boots in seconds instead of minutes. The stock self-host image runs the full ~7,400-module build at container start and keeps the output in the container filesystem, not on the volume — so on Railway, where every deploy and restart is a fresh container, that build runs every single time. Measured on identical hardware and env: 105 s to healthy and 3.16 GiB peak for the stock image, 8 s and 0.63 GiB here, because the build is baked into the image along with the fingerprint upstream's entrypoint looks for. Change AUTH_MODE or any VITE_* value and it still rebuilds correctly at boot.

Everything that should persist, persists. The volume mounts at /app/.wrangler, which is where OpenSEO keeps its D1, KV and R2 state: projects, saved keywords, rank-tracking history and the local admin workspace. Verified across a redeploy.

Common Use Cases

A subscription-free keyword research and rank tracking workspace for one site or a portfolio
SEO tooling for an AI agent over MCP, with a bearer token instead of an open endpoint
Site audits and backlink analysis on data you keep, billed per DataForSEO call

Dependencies for OpenSEO Hosting

A DataForSEO account — every SEO data feature calls their API. DATAFORSEO_API_KEY is the base64 of your login:password.
Optional: an OpenRouter key for SAM, the in-app agent, and Google OAuth credentials for Search Console.

Deployment Dependencies

OpenSEO — the application
Docker self-hosting guide
DataForSEO API key guide
bon5co/openseo-railway — the image this template deploys, and the measurements behind every claim above

Implementation Details

Image: ghcr.io/bon5co/openseo-railway:latest, wrapping ghcr.io/every-app/open-seo:v0.1.3 (pinned — the other listings run v0.1.1 and latest)
Volume: /app/.wrangler
Sign in with user admin and the generated OPENSEO_ADMIN_PASSWORD; point an MCP client at https:///mcp with Authorization: Bearer
The deploy form asks for nothing: the password, the MCP token and the auth secret are all generated for you. After the first deploy add one variable — DATAFORSEO_API_KEY, the base64 of your DataForSEO login:password (printf 'email:password' | base64) — and the data features switch on. /api/health reports whether it is set.
The gateway rate-limits on the first address of X-Forwarded-For, since Railway's edge is every request's remote_addr

Why Deploy OpenSEO on Railway?

Railway runs the container, the volume and the domain without any of the ops around them, and usage-based billing suits a tool you open when you are doing SEO work rather than one that has to idle at full size all month. One service, one volume, no external database — and with the build baked into the image, redeploys come back in seconds.