What's New in Claude SEO v2.2.0

Claude SEO v2.2.0 is a hardening release. It closes two security issues, fixes correctness problems in Google Search Console reporting, repairs extension package wiring, and adds a CI gate that fails on leaked credentials. It stays free, MIT licensed, and compatible with existing workflows.

KEY TAKEAWAYS
  • Security hardening: installer credential injection is closed across extension installers, uninstallers, and config probes.
  • SSRF protection: the parser-differential authority-confusion bypass reported as issue #110 is rejected at parse time for every caller.
  • Reliability fixes: GSC site totals no longer show a false 0 clicks result on low-volume queries, tracked as issue #130.
  • Extension repairs: Unlighthouse and Ahrefs now point at real pinned packages instead of invalid package or binary targets.
  • Release gate: a secret-scan CI gate now fails the build on leaked credentials.
Three-month Google Search Console clicks growth for claude-seo.md
Figure 1. The release keeps the project focused on real search outcomes while tightening the reliability layer underneath.

v2.2.0 is not a feature fireworks release. It is a trust release: fewer ways to leak secrets, fewer ways for URL parsing to disagree across call sites, and fewer false numbers in reports. That is the right kind of release for an SEO tool that reads the open web, handles API credentials, and turns crawl data into recommendations.

Security Hardening

The largest change is credential and request safety. Claude SEO v2.2.0 closes installer credential injection across every extension installer, uninstaller, and config probe. That means the paths that set up optional integrations now use the same stricter handling instead of leaving individual extension scripts to get it right one by one.

The SSRF parser-differential authority-confusion bypass reported as issue #110 is now rejected at parse time for all callers. The important detail is consistency. Every caller sees the same authority decision before a request can move forward, which removes parser disagreement as an attack surface.

Claude SEO orchestrator routing audits to specialist agents
Figure 2. The orchestrator routes work to specialist agents, so shared request and credential rules matter more than scattered checks.

Google and Bing API keys are also kept out of request URLs and error output. A leaked key in a URL can end up in logs, terminal history, dashboards, or issue reports. v2.2.0 removes that failure path and adds a secret-scan CI gate that fails the build on leaked credentials. The full git history and tracked tree were verified secret-free.

Reliability and Correctness

v2.2.0 fixes the numbers and the extension entry points. Google Search Console site totals no longer report a false 0 clicks value on low-volume queries, tracked as issue #130. Low-volume data still needs careful interpretation, but the site total should not collapse into a misleading zero.

The Unlighthouse extension had been calling an npm package that does not exist, and the Ahrefs extension had been calling an invalid binary. Both now point at real pinned packages. That matters because optional extensions should fail because of missing credentials or unavailable third-party data, not because their installer target was wrong.

The interactive seo-cluster template now ships with the release. It had been excluded by an over-broad ignore rule. The FLOW prompt library also received a durability pass: 82 broken links were repaired and made durable against future syncs.

Built to Stay Current for AI Search

AI search guidance in v2.2.0 separates citation surfaces instead of treating them as one blob. AI Mode is modeled as a distinct citation engine from AI Overviews, so Claude SEO can reason about where a page needs to be cited, not just whether it is visible somewhere in an AI result.

Claude SEO four-stage SEO methodology
Figure 3. The methodology keeps technical SEO, content quality, authority signals, and AI citation readiness in one workflow.

The schema and GEO guidance also reflect two concrete 2026 changes: the May 7, 2026 retirement of FAQ rich results and Google I/O 2026. FAQPage markup is still included in this post because it remains useful as an AI and entity signal, even after the rich-result surface changed.

How to Install

The install flow is unchanged. In Claude Code, add the marketplace, then install the plugin:

/plugin marketplace add AgriciDaniel/claude-seo
/plugin install claude-seo@agricidaniel-claude-seo

Prefer to inspect the code first? Clone the repository and run the installer, which is the safer alternative to piping a remote script into your shell:

git clone --depth 1 https://github.com/AgriciDaniel/claude-seo.git
bash claude-seo/install.sh

There are no breaking changes in v2.2.0, so existing users can update without changing their audit, GEO, schema, or extension workflows.

How Claude SEO v2.2.0 Holds Up

The release ships with 326 tests and no paid gate. Claude SEO v2.2.0 is MIT licensed, free, and still organized around 25 sub-skills, 18 subagents, and 8 optional MCP extensions. The important part is not only the count. It is that security, extension correctness, and release hygiene are now covered by stricter automation.

Claude SEO 25 sub-skill ecosystem
Figure 4. The 25 sub-skill ecosystem stays intact in v2.2.0, with the hardening work happening underneath the workflow surface.

Read the official GitHub release for v2.2.0 or review the CHANGELOG for the version-by-version record.