AltoRank

AltoRank: open-source, self-hosted AI SEO content writer (Outrank alternative)

An open-source alternative to Outrank and Jasper. AltoRank researches a keyword, writes the article, scores it and fact-checks it: a figure that cites a page is looked for on that page, and one with no source is flagged for the reviewer. Every draft can be copied as Markdown (front matter included) or HTML, or downloaded as a .md file, for you to paste wherever you publish. Approve it, paste it, then Mark as published records the live URL, and the article is tracked from there: indexing and rank.

AltoRank never publishes to your site without an approval recorded under a named person. Approve each draft by hand, or set a rule that approves drafts after a hold unless you hold them (the rule publishes through a CMS connection, which is built but not yet verified end to end; see Status). Agents can research and draft through the MCP server and the agent API. Neither can approve, and neither can publish anything a person has not already approved (the one publish-side call retries a failed publish of an approved article).

Self-host it free under AGPL-3.0, or use the hosted app at app.altorank.co. Open source, the whole product. No feature-gated tier, no ee/ directory.

Status

The hosted app at app.altorank.co is this repository, deployed from main (docs/deploy.md). A self-hosted install runs the same code against your own Supabase and your own API keys. Research, drafting, scoring, fact-checking, audits, rank tracking and Search Console / Bing sync run today; the table below has the detail. What is not finished yet:

• No paying customers, no case studies. Nothing here has a growth figure attached to it, and that is on purpose.
• CMS publishing is built but not yet verified end to end. The thirteen adapters are in apps/web/lib/cms/ and the connection form covers all of them, but none has been watched publishing to a live site yet, so the platform tiles on /connect ask you to request an integration instead of offering Connect. Every draft can be copied as Markdown or HTML today. Details under What works today.
• AI visibility tracking is built but not switched on. The probe, the weekly cron and the /geo page exist, but nothing in the app turns tracking on for a workspace or adds the prompts it measures, so the sidebar marks it "soon" (apps/web/lib/constants.ts).
• The CLI is publishable, not yet on npm. packages/altorank-cli bundles apps/web/scripts/cli.ts into an altorank binary (npx altorank auth whoami once it is published); until then, npm run cli from apps/web drives the same agent API from a checkout. skills/altorank/SKILL.md is the skill file a coding agent reads, and it does install with npx; see below.

Whether you want to read how it works, run it yourself or send a patch, everything is here.

The publishing decision

One gate, two ways through it. lib/publishing/core.ts refuses any article that is not approved or scheduled with approved_by set. Only the server writes those columns: a signed-in user's own database client cannot make an article approved, scheduled or live (migration 109), and an edit to approved text sends it back to review. What can write an approval:

• A person, from the editor (approveArticle), recorded as approved_by. The button checks for an active plan and refuses a bare, unsourced figure.
• A rule a named member of the account set (auto_approve, migration 079): the publish cron runs stricter checks than the Approve button - active plan, somewhere to publish, no unsourced figure, no named reviewer still to sign off, no failing audit item, SEO score at or above the floor - after a hold window (default 24h) during which the drafted email carries a Hold link. approved_by is whoever turned the rule on; approval_kind says auto. Held drafts carry the reason on their own row. See lib/publishing/auto-approve.ts.

live is written after an approved publish, by Mark as published on an approved article, and by one thing that is not a publish: the nightly found-on-site check (lib/found-on-site/detect.ts) marks a draft live when its text is already on the customer's own site. That records something done outside AltoRank, sends nothing to a CMS, carries no approval, and can be undone from the editor.

What cannot write an approval: an agent. No MCP tool or agent API call approves an article or publishes a draft - not disabled, absent. The one publish-side call, altorank_retry_publish (POST /articles/{id}/retry-publish), re-runs a failed publish of an article a person already approved, and is refused for anything else. The MCP tools are all registered in apps/web/lib/mcp/server.ts, and its server instructions say so to the agent.

Competing tools ship the words "you stay in control" as copy. The difference is checkable here: every live row is an approved article (by click or by rule) or one found already published on the customer's own site.

What works today

Publishing destinations (apps/web/lib/cms/adapter.ts) — thirteen adapters covering ten CMS platforms; WordPress is reachable two ways, and git and webhook are publishing targets rather than CMSs. Framer, Ghost, git, HubSpot, Magento, Notion, Shopify, Webflow, webhook, Wix, WooCommerce, WordPress, and the WordPress plugin — a second, recommended route to WordPress that installs a plugin and takes a per-site token instead of an application password (apps/web/lib/cms/wordpress-plugin.ts), which is why WordPress appears twice.

None of the thirteen has yet been verified end to end against a live site, so CONNECTABLE_CMS in apps/web/lib/cms/connectable.ts is empty on purpose and every CMS tile on /connect offers "Request integration" instead of Connect; adding an id to that set brings that tile's Connect button back. The connection form itself is unchanged and still covers all thirteen: the page's "New connection" button, a draft's publish panel and /connect?connect=<id> all open it. Without a connection, the editor copies any draft as Markdown (front matter included) or HTML, or downloads it as a .md file.

Install the plugin

Claude Code. From a terminal:

claude plugin marketplace add AltoRank/altorank
claude plugin install altorank@altorank

Or inside a Claude Code session: /plugin marketplace add AltoRank/altorank, then /plugin install altorank@altorank.

plugins/altorank/ bundles the hosted MCP server (https://app.altorank.co/api/mcp, OAuth, no API key to copy) with a skill written for those tools. The same folder carries the portable plugin.json + mcp.json that ChatGPT and Codex read, and .agents/plugins/marketplace.json lists it for them.

Install the skill

npx skills add AltoRank/altorank

That puts skills/altorank/SKILL.md where Claude Code, Cursor, Codex, Copilot, Windsurf, Gemini CLI, Cline and the other agents the skills CLI supports will read it. The skill teaches an agent to drive the agent API (/api/agent/v1): preflight the key, check a site's readiness, list or suggest keywords, generate a draft into a human's review queue, edit a draft by find-and-replace, move the content plan. It never approves, deletes or publishes a draft; the API has no such calls. Its one publish-side call retries a failed publish of an article a person already approved.

It needs an API key, created at /settings/api-keys in the dashboard and exported as ALTORANK_API_KEY. Self-hosted installs also set ALTORANK_BASE_URL. skills/altorank/commands/ holds five thin slash commands for the common calls; the skills CLI does not register slash commands, so copy them into .claude/commands/ (Claude Code) or your agent's equivalent if you want them.

Running it

Requires Node 22+, and a Supabase project (local via Docker, or hosted). The full deployment story, hosted and self-hosted, is in docs/deploy.md; the Cloudflare assessment is in docs/deploy-cloudflare.md.

npm install
cp docker/.env.example apps/web/.env.local   # every variable, with what each one enables
npm run dev

Required before a self-hosted install works end to end:

• your Supabase URL, its anon key and its SUPABASE_SERVICE_ROLE_KEY
• NEXT_PUBLIC_APP_URL, the address people open the app at. Every emailed link (signup confirmation, invites, password reset) is built from it, and the Docker build bakes it into the image, so set it before docker compose up --build; compose refuses to build without it.
• ANTHROPIC_API_KEY
• ENCRYPTION_KEY and CRON_SECRET (openssl rand -hex 32 for each). docker compose refuses to start without CRON_SECRET, and without it no scheduled job runs.
• RESEND_API_KEY and RESEND_FROM_EMAIL (a sender on a domain verified in your Resend account). Signup confirms by email, so without them nobody can create an account and nobody can reset a password.

Add DATAFORSEO_LOGIN / DATAFORSEO_PASSWORD for keyword volume and rank tracking; without them those steps skip rather than fail. Everything else in the example file is optional and each one disables exactly one feature. The file says which. Product analytics (the two NEXT_PUBLIC_POSTHOG_* variables, project token and host) are optional too: without them the browser console says analytics are off and nothing else changes.

Other entry points:

npm run test     # vitest, unit tier: mocks only, needs no services
npm run test:db  # vitest, db tier: *.db.test.ts against the local Supabase only
npm run smoke    # research → prompt → model → fact check, against real APIs

and from apps/web:

npm run mcp                  # MCP server over stdio, for driving the engine from an AI assistant
npm run cli -- --help        # the agent API from a shell; auth with ALTORANK_API_KEY
npm run readiness -- <domain>  # the agent-readiness checks on their own

Hosted MCP endpoint

The same tools are served at /api/mcp (Streamable HTTP) by the running app, so an MCP client adds one URL as a connector instead of running the stdio server: https://app.altorank.co/api/mcp on the hosted install, or your own origin when you self-host. Authentication is a bearer token, either an API key from /settings/api-keys or the token the built-in OAuth flow issues:

• discovery at /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource/api/mcp
• dynamic client registration at /api/oauth/register (public clients, PKCE S256 only)
• consent at /oauth/authorize, owner or admin only, write scope opt-in
• token at /api/oauth/token, authorization-code grant, no refresh token

The token a connector receives is an api_keys row (migration 080), so it is listed, expires and is revoked on /settings/api-keys like any other key. Claude Code registers it with claude mcp add --transport http altorank https://app.altorank.co/api/mcp; ChatGPT and Claude.ai take the same URL as a custom connector.

Neither the CLI nor the MCP server can approve an article or delete anything — not by configuration, but because the agent API has no such call and no DELETE handler at all. Nor can either of them publish: the single endpoint that reaches a CMS is POST /articles/{id}/retry-publish, which re-runs a publish that a human already approved and that then failed. An article in draft or review is refused, and the refusal tells the caller to hand it to a person (apps/web/app/api/agent/v1/articles/[id]/retry-publish/route.ts:13-35).

Database

apps/web/supabase/ carries a config.toml and the numbered migrations, which apply in order. With the Supabase CLI:

cd apps/web
supabase start      # local Postgres + auth; applies the migrations, prints the URL and keys for .env.local

supabase start applies every migration to the local database on first start (supabase db reset re-applies them from scratch). Do not run supabase db push for a local stack: it targets the linked remote project. Against a hosted project, supabase link --project-ref <ref> first, then supabase db push. The app will not get far without the migrations: every query targets tables they create.

docker/ has a container setup if you would rather not run Node directly.

Layout

apps/web/               the engine and dashboard (Next.js)
  app/(dashboard)/      dashboard routes
  lib/audit/            domain analysis, readiness checks
  lib/seo/              recommendations, scoring, locales, topical profile
  lib/content/          generation (one implementation, shared by route + cron)
  lib/ai/               fact checking
  lib/cms/              13 publishing adapters
  lib/geo/              AI-answer visibility
  scripts/mcp.ts        MCP server
  scripts/cli.ts        CLI over /api/agent/v1
plugins/altorank/       Claude / ChatGPT / Codex plugin: hosted MCP server + skill
skills/altorank/        the skill file a coding agent reads (`npx skills add AltoRank/altorank`)
packages/altorank-cli/  npm package `altorank`: bundles scripts/cli.ts into a bin
docker/                 container setup for self-hosting
tools/agent-readiness/  standalone agent-readiness scanner

Licence

GNU AGPL-3.0-only. Full text in LICENSE.

In practice: self-host it, run it for your own clients, commercially, and you owe nothing and publish nothing. The one obligation only reaches people rebuilding the product. If you modify the source and offer that modified version to others over a network, your changes have to be shared back under the same licence.

Running an account on it is free and unencumbered. Relaunching a modified copy as a closed competing service is not.

Contributing

Issues and pull requests are welcome. Two things that will get a patch rejected regardless of how good the code is:

• Adding a way to publish that is not attributable to a person - a click, or a rule a named member set and can veto. An agent-triggered publish is the canonical example.
• Adding a claim the repository cannot support. If grep cannot find the feature, the README does not get to mention it.

The code conventions a patch is read against, and how this repository relates to the marketing site, are in CONTRIBUTING.md.