CLAUDE SEO V2.3.1:
ONE REVIEW. THREE RELEASES. EVERY PR TESTED.

Claude SEO v2.3.1 is the current public release. It closes a day that started with a full review of the repository and ended with three tags: v2.2.6, v2.3.0 and v2.3.1, all published on September 10, 2026. The v2.3.1 tag resolves to commit 55c7914.

This post explains why one review produced three releases, what each one changes for you, and what the verification caught along the way, including two mistakes on my side that were fixed before anything reached the public branch.

Why three releases in one day?

The queue had grown to 46 open pull requests and 17 open issues since v2.2.5. Instead of merging by feel, I ran one review that tested every pull request at its exact head commit, read every diff, and re-verified every claim in the descriptions. Nine parallel review lanes did the work; two fresh-context reviewers then tried to refute the verdicts that would lead to a merge.

The review found three problems that were not pull requests at all:

• No working way to report a vulnerability. Private vulnerability reporting was disabled and the email fallback in SECURITY.md was unreachable. A reporter was holding a medium-severity finding with nowhere to send it. This was fixed in the repository settings before v2.2.6 shipped.
• A security fix that never reached main. A commit on my own multi-fix pull request closed a cache-path traversal in commoncrawl_graph.py and an unvalidated WHOIS referral in domain_history.py. Both exploits were re-run against main and still worked.
• The claude.ai-hosted install path was broken. Hosted marketplaces reject any plugin that ships a top-level bin/ directory, which is exactly where the launcher lived. The CLI path worked, so nobody noticed until issue #298 proved the cause on a fork.

Those three problems could not wait for the rest of the queue, so v2.2.6 shipped first as a patch. The larger community and Google-currency work became v2.3.0. A second patch, v2.3.1, closed the follow-ups the same evening.

v2.2.6: security and the hosted install

The launcher moved from bin/claude-seo to scripts/claude-seo. Every skill, agent and document now calls it as "${CLAUDE_PLUGIN_ROOT}/scripts/claude-seo" run <script>, which follows the form the Claude Code plugin documentation recommends for both CLI and hosted installs. Manual installs are unchanged in behavior (see the installation guide): install.sh and install.ps1 copy the launcher and rewrite that token to the absolute path. A layout test keeps bin/ from coming back.

Three security changes landed with it:

• url_safety now refuses the RFC 6598 shared address space (100.64.0.0/10), where Alibaba Cloud serves instance metadata, and judges IPv4-mapped IPv6 literals by their embedded address. The same range belongs to Tailscale, which matters below.
• The cache-path traversal and WHOIS referral fixes described above, with their tests.
• WeasyPrint moved to 70.0 (PYSEC-2026-3940) and requests to 2.34.2; pip-audit now runs in CI.

The rest of v2.2.6 is reliability. The DataForSEO and Banana cost ledgers no longer lose concurrent writes, and PageSpeed Insights responses with a null category score no longer crash. preload_check.py exits 0 on a completed run, FLOW lock hashes survive CRLF checkouts, and the full test suite runs on Windows and macOS in CI.

/plugin marketplace add AgriciDaniel/claude-seo
/plugin install claude-seo@agricidaniel-claude-seo
/seo setup
/seo doctor

v2.3.0: Google currency and community fixes

Version 2.3.0 landed eleven community pull requests, each as the author's own commit with a review fix on top, and re-implemented two more from their reports. The pattern was the same every time: the change was right, and one specific defect kept it from merging as-is. Four examples:

• A quote-aware tokenizer for the JSON-LD hook, because an attribute containing > used to truncate the tag.
• Persian and Devanagari joiners preserved by the watermark stripper.
• A coverage field, so a Korean page's score is not presented as comparable to an English one.
• Case-insensitive rel tokens in the HTML parser.

Two changes are worth knowing if you audit anything private:

• CLAUDE_SEO_LOCAL_TARGETS is an explicit allowlist of top-level targets (host or host:port). It lets you audit a local dev server, a staging host, or a Tailscale address that v2.2.6 started refusing. It applies only to the first URL you pass: redirects and browser subresources stay fail-closed, and metadata addresses can never be allowlisted. The details are in SECURITY.md.
• A configured HTTP proxy is validated before it is exempted from the pinned resolver, and re-checked when it resolves, so the proxy works and cannot become a bypass.

The AI crawler guidance was corrected against the vendors' own pages. ClaudeBot is Anthropic's training crawler and Claude-SearchBot governs search citability; GPTBot trains while OAI-SearchBot decides ChatGPT search inclusion; Google-Extended does not affect Google Search. All 14 agents that fetch external content now treat it as untrusted data, and the audit agents write a partial findings file early so a turn-budget stop no longer loses the work.

v2.3.1: agents on Opus and the follow-ups

Five judgment-heavy agents (seo-content, seo-geo, seo-sxo, seo-cluster, seo-drift) now declare model: opus; the other thirteen stay on Sonnet. A full audit therefore costs more than it did on v2.3.0, and the README documents how to change the model per agent.

The rest of v2.3.1 is follow-through. Keywords Everywhere (Open PageRank) joins as a free backlinks fallback for users without a Moz key. Its live API path is unverified: no account was available to exercise the real endpoint end to end. Setup failures now show the failing stage's own output instead of a bare exit code. The remaining extension installers write ~/.claude.json atomically, and the templated-metadata detector that v2.3.0 shipped is now registered with the launcher; it had been unreachable through claude-seo run.

Google guidance through September 10, 2026

The update ledger gained three entries, each confirmed on a Google-owned page:

• Google's spam policies page (updated August 28, 2026) now says site reputation abuse may draw a manual action for searchers outside the EEA, while for users inside the EEA the pages may be categorized as separate from the main domain. The E-E-A-T reference, the programmatic skill and the parasite-risk scanner state the split.
• The Search Central changelog for September 8, 2026 documents regional differences in Search: aggregator units, supplier units and carousels for hotel, flight, transport and product queries in the EEA, South Africa and Turkiye.
• AI Mode added flight price tracking, hotel booking and points display on August 27, 2026. A product surface, not a ranking change.

The Core Web Vitals reference cites the August 2026 Chrome UX Report dataset: 55.6% of origins pass all three metrics, with Chrome flagging the continued INP regression. Lighthouse 13.4.1 is still the current release as checked on September 10, 2026.

How were the releases verified?

Every pull request in the queue was tested at its exact head in an isolated worktree before it was judged. Each release branch then went through a fresh-context review of the whole diff and a public pull request so the Windows, macOS, PowerShell 5.1 and dependency-audit legs ran before the tag moved. The v2.3.1 pull request passed nine distinct CI checks across the test, smoke and audit workflows.

That process earned its keep three times:

• The Windows suite caught a real PowerShell 5.1 bug in uninstall.ps1 (a three-argument Join-Path that only PowerShell 7 accepts) before v2.3.0 shipped.
• A fresh-context review of v2.3.0 found that the new hook tokenizer could hang on an unclosed script tag with many apostrophes, a blocker in a hook that runs on every edit.
• Another fresh-context review, of v2.3.1, found that three PowerShell installers created mcpServers as a hashtable, which serializes as {} when ~/.claude.json has no such key yet, so the server entry was silently dropped on a first install.

Locally the suite grew from 441 passing tests on the v2.2.5 main branch before the review to 522 on v2.2.6, 743 on v2.3.0 and 763 on v2.3.1, each with three network-only tests skipped. The consistency and portability gates, pip-audit, and strict plugin validation passed on every release.

Two things went wrong on my side and are recorded in the private repository. A partial sync head carried the private v2.3.1 tag for a few minutes before the sync completed and the tag was moved. Twice, a commit landed on a release branch with failing tests because a command chain did not stop on the result. Both were fixed in follow-up commits before the branch went public.

What is next?

Version 2.4.0 is staged with the Matomo extension, verified live against a self-hosted Matomo instance, and will wait for the Shopify signed-crawl contribution if its author addresses the review items soon. Six provider pull requests were closed with the exact conditions that would reopen them. The Creaitor GEO extension is still open and undecided.

On September 10, 2026 the repository had 16,704 stars and 2,448 forks, 3 open pull requests and 7 open issues.