Open source owns the interface, not the SEO dataset
OpenSEO combines keyword research, rank tracking, competitor data, backlinks, site audits, analytics, and AI visibility in one TypeScript application. Projects can be explored in its web interface or queried by agents through MCP. Prebuilt skills target Claude Code and other agent clients. That is a useful shape for consultants who want one project context shared between human work and automated analysis.
The data model is less independent than the source license suggests. Every self-hosted installation needs a DataForSEO account, and the project uses that service for SEO data. Its setup guide says new accounts include $1 of credit and require a $50 minimum top-up. The hosted service offers a subscription and says it marks DataForSEO requests up by 28%. OpenSEO replaces the application and workflow layer of a commercial suite, not the costly collection infrastructure behind search and backlink data.
Docker starts without authentication on port 3001
The easiest self-hosting route uses a published container image and a compose file. Copy the environment template, add the DataForSEO credential, start Compose, and the app listens on port 3001 by default. The guide is explicit that this mode sets AUTH_MODE=local_noauth and injects admin@localhost. It should stay on a trusted machine, private network, or authenticated reverse proxy.
That warning is load-bearing. Setting ALLOWED_HOST only lets the Vite preview accept a hostname; it does not create user authentication. The guide advises an auth-protected proxy or tunnel before exposing Docker. It also documents /api/health, image pinning, log inspection, and recreation after environment changes. Telemetry sends aggregate install and feature counts on a schedule unless OPENSEO_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 is set.
What happened when we ran it
Our sandbox installed commit cd6a782 in 40 seconds. Pnpm added 984 packages and occupied 1,599 MB. The build completed successfully in 67 seconds, followed by a successful 36-second test step. Among the requested Node repositories, this was the only one where install, build, and tests all reached a successful outcome in the supplied root workflow.
The checkout itself contained 1,276 files, about 141,045 lines of source, and 18.3 MB. It is a workspace monorepo with 4 CI workflow files and a Compose file, but no tests directory found by the harness. Those structural signals do not contradict the passing test command; they show that test placement and orchestration do not follow a simple root tests/ convention.
Our run used an unprivileged Node 22 Debian container with 3 CPUs, 8 GB of RAM, and no secrets. We did not enter a DataForSEO credential, deploy Cloudflare resources, crawl a site, or connect an MCP client. The 1,599 MB figure covers installed repository dependencies, not browser data, D1 storage, R2 objects, API charges, or generated audit history.
Cloudflare trades local simplicity for managed access
The recommended internet-facing route provisions a Worker, D1 database, KV namespaces, an R2 bucket, migrations, and a Cloudflare Access application. It requires Node 22.6 or newer, a Cloudflare account, R2 activation, and a payment method even when usage stays within the R2 free tier. The deploy policy limits access to the email addresses listed in configuration.
All allowed users enter one shared workspace and see the same projects. That may be perfect for a small agency pod, but it is not tenant isolation. Dashboard edits to the managed Access policy are overwritten on redeploy, so membership belongs in configuration. The destroy command removes the Worker, D1, KV, R2, and Access resources, including stored data. Backups and export procedures should exist before treating the deployment as the system of record.
SAM currently sends its model work to OpenRouter
The core dashboard does not require OpenRouter, but AI features such as SAM do. Issue 102 says the chat path is fixed to OpenRouter and lacks a configurable OpenAI-compatible base URL. The report specifically mentions prompts containing project domains, keywords, and Search Console-derived context leaving a self-hosted machine. For a team that chose self-hosting to keep client data inside its network, this is a direct product boundary rather than an abstract privacy concern.
MCP access also deserves normal secret handling. Issue 233 reported that a newly created MCP API key could be captured by PostHog session replay because the one-time reveal was plain text outside the configured masks. Pull request 236 adds DOM masking and network-body redaction. Check that the fix is in the version you deploy, disable analytics where policy requires it, and rotate any key that may have appeared in a recording.
v0.1.6 is active and still has product edges
Release v0.1.6 shipped on August 19, 2026 with shared project context, early skills inside SAM, optional Lighthouse work, and Google Analytics data. GitHub recorded a last repository push on August 24, 13,588 stars, and 113 open issues and pull requests. New issue activity includes a broken Claude Code plugin manifest and a hosted Lighthouse job that reportedly charged credits after partial completion.
OpenSEO is credible because our 40-second install led to both a passing build and passing tests. The self-hosting docs also say plainly where auth is absent and where third-party costs begin. Use it when you want to own and modify the dashboard, database, MCP tools, and audit workflow. If you mainly want a proprietary backlink index with contractual support, the application source will not substitute for Ahrefs or Semrush.