Open-Source GEO & AEO Tools (2026)

Last updated: September 27, 2026

AEO (answer engine optimization) and GEO (generative engine optimization) both describe the practice of optimizing content to appear in AI-generated answers.

Open-source AI search tooling expanded quickly in 2026. Purpose-built AEO and GEO CLIs now sit beside established web-audit projects such as Lighthouse, axe-core, and Lychee. The important boundary is no longer whether a command is available on GitHub. Buyers need to know what runs locally, what calls a hosted service, and which parts can measure real answer-engine outcomes.

This guide evaluates eight open-source tools that form one practical Answer Engine Optimization audit workflow in 2026. foglift-scan, published under the MIT license, connects a terminal to the hosted Technical Audit and authenticated monitoring APIs. The remaining seven cover browser auditing, accessibility, structured-data authoring, field performance, security headers, and link integrity. This is a workflow selection, not an exhaustive catalog of every open-source AEO project.

The case for an open-source stack is inspectable orchestration. A 2025 SE Ranking analysis of 129,000 domains found ChatGPT cites only 15% of the pages it retrieves, and the top 10 domains for a topic capture 46% of citations. A public client lets a team inspect the request, authentication, flags, and output contract used in its pipeline. Provider-side crawling, scoring, and model queries remain service boundaries and should be disclosed as such.

1. foglift-scan (Editor's Pick)

foglift-scan is the CLI underneath Foglift. It is published on npm under the MIT license. The client sends a URL to the hosted public /api/v1/scan endpoint and prints the returned Technical Audit as terminal output or JSON. Basic scans need no account or API key, but they do require a network connection and transmit the target URL to foglift.io.

The same client also reaches batch audits, AI Visibility checks, historical results, prompt management, sentiment, usage, and recognized AI-referral analytics after authentication. That breadth is its advantage in this stack: one command surface spans readiness, answer monitoring, and downstream human visits. The repository makes the request and output contract inspectable; the hosted service remains the execution boundary for crawling and scoring.

What it scans

• Hosted Technical Audit: Site Technical Health is the equal mean of SEO, performance, security, and accessibility; AI Readiness is reported separately
• SEO fundamentals: titles, meta descriptions, canonicals, headings, internal linking
• Security posture: HTTPS, HSTS, CSP, and related response-header checks, reported as their own audit dimension
• AI crawler access: role-aware robots.txt policy for OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, GPTBot, ClaudeBot, and Google-Extended
• JSON output: --json flag for CI pipelines and agent workflows, with a score-contract version in the hosted response

Pricing & availability

• CLI: MIT-licensed, installable via npm i -g foglift-scan. Basic hosted scans require no API key.
• Free tier on foglift.io: unlimited single-page Technical Audits, Google Search Console integration, AI Crawler Analytics, and active-use weekly Perplexity monitoring for 1 brand. Monitoring pauses after more than 42 days without qualifying activity.
• Launch ($49/mo): 4,000 tokens per month, 3 brands, 3 team members, all five engines, and API, CLI, and MCP access. Onboarding starts weekly; the plan allows daily monitoring.
• Growth ($129/mo): 11,500 tokens per month, 10 brands, 10 team members, daily onboarding, and a twice-daily ceiling.
• Enterprise (custom pricing and allowances): hourly monitoring with custom token and brand allowances.

Best for: agencies that want repeatable hosted checks; developers who want an in-editor Technical Audit loop; CI pipelines that need JSON plus threshold exits; and teams that want audit, monitoring, prompt, history, sentiment, and referral commands behind one authenticated client.

2. Google Lighthouse

Google Lighthouse is the default entry point for any web audit. It is Apache-2.0 licensed, shipped as both a Chrome DevTools panel and a standalone Node CLI. Version 13.5.0, released September 18, 2026, covers Performance, Accessibility, Best Practices, and SEO, then adds an Agent Resource Discovery audit alongside llms.txt and WebMCP checks in its agent-discovery work. It remains the strongest local browser-audit foundation in this stack.

Running Lighthouse alongside foglift-scan is the standard pattern. Lighthouse supplies a local browser trace and individual audit results. foglift-scan supplies the hosted five-dimension Technical Audit plus authenticated answer-monitoring workflows. Their performance, accessibility, SEO, and agent-discovery checks overlap in places, but their execution model and downstream evidence differ.

Key specs

• License: Apache-2.0
• Latest release reviewed: v13.5.0 (September 18, 2026)
• Agent-discovery checks: Agent Resource Discovery, llms.txt, and WebMCP
• Other signals: performance, SEO fundamentals, accessibility, and best practices
• CLI: npm i -g lighthouse; JSON output flag available

Best for: every audit stack. Lighthouse is the baseline. Run it first, then layer AI-search-specific tools on top.

3. MDN HTTP Observatory

The MDN HTTP Observatory (github.com/mdn/mdn-http-observatory) is the Node.js replacement for the original Mozilla Observatory, which was archived in November 2024. It scores a site's HTTP security-header configuration on an A+ through F scale and exposes the same grade publicly at developer.mozilla.org/en-US/observatory.

Security headers are a separate technical-health concern. They protect browsers and users; they do not prove that an answer engine will cite a page. The MDN Observatory is useful here because it gives a focused, reproducible security grade instead of asking an AI-readiness score to stand in for a security audit.

Key specs

• License: MPL-2.0
• CLI: runnable via npx mdn-http-observatory
• Technical signals: HSTS, CSP, X-Frame-Options, Referrer-Policy, and Subresource Integrity
• Successor to the archived python-based Mozilla Observatory

Best for: CI pipelines that need a grade-letter security gate; teams migrating off the archived Mozilla Observatory repo.

4. axe-core

axe-core is the accessibility-testing engine maintained by Deque Systems under the Mozilla Public License 2.0. It is the engine that Lighthouse uses for its Accessibility category, which pa11y wraps, and which nearly every headless accessibility checker on GitHub depends on. As of v4.13.0 (August 2026), axe-core ships a minor release every three to five months and supports security updates for versions up to eighteen months old.

Accessibility work improves the page for people and often produces cleaner semantic HTML. That overlap is useful for audits, but axe-core does not measure citation selection or prove that an AI crawler will extract a page. Use it for its documented WCAG and best-practice rules.

Key specs

• License: MPL-2.0
• Latest release: v4.13.0 (August 2026)
• Documented signals: WCAG rules, ARIA semantics, headings, landmarks, and focus behavior
• Integration: direct library usage in Node or the browser; also underpins Lighthouse, pa11y, and dozens of other wrappers

Best for: teams that need a programmatic accessibility engine to embed in their own audit tooling, and any AI search pipeline that values the downstream heading-clarity signal.

5. web-vitals

web-vitals is Google's official client-side library for measuring Core Web Vitals (CLS, INP, LCP) and supporting metrics (FCP, TTFB) against real user sessions. It is Apache-2.0 licensed, brotli-compressed to roughly 2 KB, and is the canonical measurement surface for anything beyond a synthetic Lighthouse run. The repo is actively maintained as of v5.

Core Web Vitals describe real user experience rather than answer-engine citation selection. Lighthouse supplies a controlled lab run; web-vitals records field measurements from production browsers. Keep the two datasets separate so a strong lab result does not hide a slow experience for actual visitors.

Key specs

• License: Apache-2.0
• Bundle size: ~2 KB (brotli)
• Field measurements: CLS, INP, and LCP from real browser sessions
• Integration: browser library; shippable as a dependency in any analytics layer

Best for: real-user measurement. Synthetic Lighthouse scores will not get you to the same ground truth.

6. schema-dts

schema-dts provides TypeScript definitions for the full Schema.org vocabulary in JSON-LD form. It is Apache-2.0 licensed, hosted under the google/ GitHub organization, and released through v2.0.0 in March 2026. The repository carries an explicit disclaimer that it is not an officially supported Google product, worth noting for enterprise procurement, but the project's release cadence is healthier than most officially-supported Google OSS projects of similar age.

schema-dts catches misnamed properties and invalid type unions before deployment. That reduces authoring errors in JSON-LD, but type safety does not prove that a search or answer engine will use the markup. Pair compile-time checks with rendered-page validation and measure citation outcomes separately.

Key specs

• License: Apache-2.0
• Latest release: v2.0.0 (March 2026)
• Structured-data role: compile-time JSON-LD typing against the Schema.org vocabulary
• Caveat: not an officially supported Google product, despite the google/ org

Best for: TypeScript projects (Next.js, Remix, SvelteKit) authoring JSON-LD in-source. The type-checking value is substantial, and it composes with the runtime Schema.org Validator that Google itself provides at schema.org/validator.

7. Lychee

Lychee is a Rust-native broken-link checker that scans Markdown, HTML, reStructuredText, and crawled web pages for dead URLs and mail addresses. It is dual-licensed under Apache-2.0 or MIT, and ships actively, with v0.24.2 released in May 2026. Its asynchronous Rust implementation and CI integrations make it practical for recurring checks across large documentation and content repositories.

Lychee finds two maintenance defects in one pass: dead outbound sources that readers cannot verify and broken internal destinations that waste crawl paths. Fixing those defects improves the evidence trail and site architecture. It does not by itself prove an AI citation lift.

Key specs

• License: Apache-2.0 OR MIT (dual)
• Latest stable release: v0.24.2 (May 2026)
• Audit role: internal 404s and dead outbound source links
• Language: Rust; available via cargo, Homebrew, and as a GitHub Action

Best for: content-heavy sites where stale outbound citations are a recurring problem; any CI pipeline that wants a zero-config broken-link gate.

8. pa11y

pa11y is a CLI-first accessibility-testing runner that wraps axe-core and HTML_CodeSniffer behind a uniform command-line interface. Version 10.0.0 requires Node.js 22.13.0 or newer and updates its underlying browser automation to Puppeteer 25 and axe-core 4.13. It is LGPL-3.0-only licensed, which is the one copyleft entry on this list the LGPL is worth flagging for commercial integrators who need to avoid derivative-license exposure, though CLI invocation from a pipeline does not trigger the copyleft clause.

The reason pa11y earns a spot instead of being collapsed into axe-core is the workflow it unlocks. axe-core is a library; pa11y is a CLI and a dashboard (pa11y-dashboard) that a non-engineer on the content team can run against a URL and get a WCAG report out of, without needing to write Node code. For AI search work, content or design teams often own the accessibility side of the audit while engineering owns implementation, and pa11y respects that split.

Key specs

• License: LGPL-3.0-only
• Latest release: v10.0.0 (August 2026)
• Runtime: Node.js 22.13.0 or newer
• Accessibility signals: WCAG issues behind a CLI and Node API
• Integrations: CLI, Node API, and pa11y-dashboard web UI

Best for: content and design teams running accessibility audits without a Node stack; any pipeline that wants axe-core results behind a simpler CLI surface.

Comparison table

A composable AI search audit pipeline

The pipeline below chains five of the eight tools into a single audit script. Copy it into a shell file and point it at any public URL. The execution boundary is mixed: Lighthouse, Lychee, and pa11y run on your machine, while foglift-scan sends the URL to the hostedFoglift scan endpoint. MDN HTTP Observatory can use its CLI or public service, depending on how you configure it.

#!/usr/bin/env bash
# audit.sh: open-source AI search audit
# Usage: ./audit.sh https://example.com
set -euo pipefail
URL="$1"
OUT="$(mktemp -d)"

# 1. Hosted Technical Audit through the open-source client
npx -y foglift-scan scan "$URL" --json > "$OUT/aeo.json"

# 2. SEO / performance / accessibility baseline
npx -y lighthouse "$URL" --output=json --quiet > "$OUT/lighthouse.json"

# 3. Security headers
npx -y mdn-http-observatory --host "$(echo "$URL" | awk -F/ '{print $3}')" > "$OUT/security.txt"

# 4. Broken-link sweep
npx -y lychee --format json "$URL" > "$OUT/links.json" || true

# 5. Accessibility CLI (optional, overlaps Lighthouse but deeper)
npx -y pa11y --reporter json "$URL" > "$OUT/a11y.json" || true

echo "audit artifacts: $OUT"

Five open-source clients can produce one set of build artifacts, but open source does not mean every step executes offline. The basicFoglift Technical Audit needs no account; authenticated monitoring commands need an API key. The Free plan runs weekly Perplexity checks, while Launch adds all five supported engines plus API, CLI, and MCP access. That makes the hosted Foglift service the bridge from a technical audit to evidence about which engines mention, cite, or send visitors to a brand.

What this list deliberately excludes

• Every purpose-built AEO CLI. This is a frozen, composable eight-tool workflow rather than an exhaustive directory. Other open-source projects available by September 2026 include @cucuwang/aeo-cli, @didrod2539/aeolint, Aeolo's aeo, and Advance Labs' AEO Toolkit. They should be benchmarked independently before adoption because their scopes, scoring rules, and maintenance histories differ.
• Closed-source AI search dashboards. Profound, AthenaHQ, Peec.ai, Otterly, Rankability, and Semrush AI Toolkit are covered in Best AI Search Tools for Developers. They are valid tools, just not open source.
• The archived Mozilla Observatory repo (mozilla/http-observatory): archived November 2024; use the MDN replacement listed above.
• The deprecated structured-data-testing-tool (GoogleChromeLabs). The repo is no longer reachable as of April 2026; schema-dts at compile time plus Google's Rich Results Test at runtime are the current recommended path.
• Commercial SEO tools with an open-source wrapper. A handful of Screaming Frog and Semrush automations exist on GitHub under permissive licenses, but they call back to a paid service, which is not open-source AI search tooling in any meaningful sense.

FAQ

Is there an open-source tool that scans websites specifically for AI search readiness?

Yes. Several open-source projects now target AEO or GEO directly, including foglift-scan, @cucuwang/aeo-cli,@didrod2539/aeolint, Aeolo's aeo, and Advance Labs' AEO Toolkit. foglift-scan is an MIT-licensed client for the hosted Foglift Technical Audit. Its public result contract reports Site Technical Health as the equal mean of SEO, performance, security, and accessibility. AI Readiness is reported separately. Authenticated commands add batch scans, prompt checks, historical results, sentiment, prompt management, and AI-referral reporting.

Can I build a full AI search audit using only open-source tools?

You can assemble the audit client and supporting checks from open-source tools, but the complete workflow is not offline.foglift-scan sends scan requests to Foglift's hosted API; Lighthouse, axe-core, pa11y, and Lychee can run locally; and live URL checks still request the target site. Monitoring whether ChatGPT, Perplexity, Google AI Overview, Claude, and Gemini mention or cite a brand also requires provider access and usage budget. Open source makes the client and orchestration inspectable. It does not make remote crawling or model queries offline.

Why are most AI search tools closed source?

Open clients and hosted services solve different problems. The client can expose request syntax, machine-readable output, and orchestration code. The service still pays for remote crawling, storage, scheduling, and model-provider access. Publishing a client therefore does not remove the operating cost or expose a vendor's scoring implementation. A useful evaluation asks which layer is open, which layer is hosted, and what data crosses that boundary.

What is the difference between foglift-scan and Google Lighthouse?

Lighthouse is a general-purpose audit tool that produces SEO, performance, accessibility, and best-practices scores. Lighthouse 13.5 also added agent-discovery audits for llms.txt, Agent Resource Discovery, and WebMCP. foglift-scan calls a hosted audit that reports Site Technical Health as the equal mean of SEO, performance, security, and accessibility. It reports AI Readiness separately, then exposes authenticated monitoring commands through the same client. Lighthouse runs a local browser audit. The two tools overlap on some technical checks, but their execution boundaries and downstream workflows differ.

Can I run an offline AI search audit without sending data to a third party?

Not with foglift-scan. It sends the target URL toFoglift's hosted /api/v1/scan endpoint and requires a network connection. Lighthouse, axe-core, pa11y, and Lychee can run locally, although scanning a public URL still contacts that site. Use local-only tools against a local build when the URL cannot leave your environment, and reserve the hosted audit for URLs you are permitted to transmit.

Is schema-dts an officially supported Google product?

No. schema-dts is published under the google/ GitHub organization and released under Apache-2.0, but the repository README includes an explicit disclaimer that it is not an officially supported Google product. For teams authoring JSON-LD in TypeScript, the type-checking value is high enough that unofficial status is a reasonable tradeoff.

What replaced Mozilla's original HTTP Observatory?

Mozilla archived the original python-based HTTP Observatory in November 2024 and recommended migrating to the Node.js-based replacement at github.com/mdn/mdn-http-observatory. The new implementation retains MPL-2.0 licensing and the A+ through F grade-letter scoring, exposes a public service at developer.mozilla.org/en-US/observatory, and ships a CLI callable via npx for CI pipelines.

Sources & Further Reading

1. Aggarwal, Murahari, Rajpurohit, Kalyan, Narasimhan, Deshpande, "GEO: Generative Engine Optimization" (KDD 2024, arXiv:2311.09735). Introduces GEO-Bench (10,000 queries) and shows source-level optimization lifts generative-engine citation visibility by up to 40%.
2. SE Ranking / Search Engine Journal: "Top Factors Influencing ChatGPT Citations" (2025, 129,000-domain analysis). ChatGPT cites only 15% of retrieved pages; top 10 domains take 46% of all citations in a topic.
3. Stack Overflow 2025 Developer Survey (n > 49,000 respondents). 76% of developers are using or planning to use AI tools in their development workflow.
4. Gartner: "Search Engine Volume Will Drop 25% by 2026, Due to AI Chatbots and Other Virtual Agents" (February 2024).
5. Lighthouse 13.5.0 release notes (September 18, 2026). Source for Agent Resource Discovery, llms.txt, and WebMCP audit coverage.
6. foglift-scan npm package and its public repository. Sources for the MIT license, current command surface, and hosted API boundary.
7. axe-core v4.13.0 release (August 5, 2026). Source for the reviewed accessibility-engine version.
8. Lychee v0.24.2 release (May 1, 2026). Source for the reviewed stable link-checker version.
9. pa11y v10.0.0 release (August 28, 2026). Source for the reviewed CLI version and runtime requirements.
10. Current open-source AEO CLI landscape: @cucuwang/aeo-cli, @didrod2539/aeolint, aeolo-ai/aeo, and Advance-Labs/aeo-toolkit.
11. Anthropic Model Context Protocol specification (modelcontextprotocol.io, November 2024). Defines the open interface that lets agentic tools call external servers; referenced for category-timing context.
12. Mozilla Foundation: HTTP Observatory archival notice (November 2024). Source for the migration recommendation to the MDN-maintained replacement.
13. OpenAI, Publishers and Developers FAQ. Source for the separate OAI-SearchBot search and GPTBot potential-training controls.
14. Anthropic crawler controls. Source for Claude-SearchBot, ClaudeBot, and Claude-User roles.
15. Perplexity crawler documentation. Source for PerplexityBot and Perplexity-User roles.
16. Google crawler documentation. Source for Google-Extended's standalone control-token behavior and lack of a separate HTTP user-agent string.

Fundamentals: Learn about GEO (Generative Engine Optimization) and AEO (Answer Engine Optimization) (the two frameworks for optimizing your content for AI search engines).