Google Search Console

Google Search Console MCP server

Bring your search performance into the conversation.

Investigate queries, pages, indexing and sitemaps through a read-only MCP server.

Watch the film · What's new · Install · Tool reference · Try hosted getmcpads

[Play the 45-second film](https://www.getmcpads.com/home/film/get-mcp-ads-brand-film-1080p.mp4)

The film shows hosted getmcpads with sample data. Its MCP Apps, from creative galleries and alerts to Google Sheets exports and bulk launches, belong to the hosted product. This repository provides the standalone native API tools.

20 read tools · Read-only by design.

Run locally with your own platform credentials and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the platform. For managed connections, including supported ChatGPT setups, use the hosted option.

What's new

[v2.1.1: Zod 4 security update](https://github.com/get-mcp-ads/google-search-console-mcp-server/releases/tag/v2.1.1) · October 26, 2026

• Update zod to 4.6.7. Every Zod release before 4.6.6 is covered by the high-severity advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory, and no Zod 3 release carries the fix. npm audit --omit=dev reports no vulnerability again.
• Keep the Zod 3 validation behaviour. A parameter default is still validated and completed before use, so an omitted object must still supply its required fields.
• Keep each parameter's own description when the parameter is optional or has a default. Zod 4 stores a description on the wrapped schema only, so the shared fallback description could otherwise replace it.
• Tool names, parameters and descriptions published over MCP are unchanged. server-card.json is regenerated with Zod 4's JSON Schema output, which spells some constraints differently.

Earlier releases

Full changelog · All releases

Source synchronization: SOURCE_SYNC.md.

Upgrade notes

Requires Node.js 22.23.4, 24.22.1 or 26.12.1, or a newer release of one of these lines. Older releases lack the October 2026 security fixes, and the server prints a warning on stderr when it starts on one. CI covers Node 22, 24 and 26.

This release makes no breaking change to the configuration. One change is announced for 3.0.0: GSC_SITE_URLS is optional in 2.x and becomes required. When set, every tool is limited to the listed properties, and GSC_SITE_URL must be one of them. When unset, the server starts as before and prints one line on stderr recommending it. The 20 tools, their schemas and the bounded reporting limits are unchanged.

Install this release

This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned npx examples later in this document select the version currently available on npm.

git clone --branch v2.1.1 --depth 1 https://github.com/get-mcp-ads/google-search-console-mcp-server.git

cd google-search-console-mcp-server npm ci npm run build

Configure your MCP client to run node with the absolute path to dist/cli.js and the platform credentials documented below.

Prefer a managed connection? Use Google Search Console with hosted getmcpads. Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.

What you get

What it does beyond fetching rows

Search Console answers questions about rows. Most real questions are about change: which queries did we lose, which pages compete for the same term, is indexing drifting.

These tools do that work rather than leaving it to the model:

One thing to know before you trust a number

Search Console returns a top N, not a site total.

When you query with a dimension such as query or page, the API returns the highest ranked rows up to your row limit, ordered by clicks. Summing the clicks of those rows does not give you the site total: the long tail is missing, and on a large site it can be most of the traffic.

To get a real total, query without dimensions. To compare periods, compare like with like: same dimensions, same row limit, same search type.

gsc_query_search_analytics reports what it actually returned, and gsc_validate_query checks a combination before it runs. But the arithmetic mistake is yours to avoid, and it is the most common one in Search Console analysis.

Two other limits worth carrying in your head:

• Roughly 16 months of history. Anything older is gone, not slow.
• Data settles over about three days. gsc_get_data_freshness tells you what is final.

Read-only, and why it stays that way

There are no write tools, and no environment variable that adds any. The Search Console API can submit and delete sitemaps, add and remove properties, and request indexing. This server exposes none of that.

The scope it asks for reflects that: webmasters.readonly, not webmasters. Even if the model tried, the token cannot write.

Our ad platform servers, where writes make sense, do have them, guarded by a mandatory preview: Meta Ads · Google Ads · TikTok Ads

The hosted version at getmcpads.com keeps the same rule: Search Console stays read-only there too.

Getting credentials

Three values, obtained once.

1. OAuth client

In a Google Cloud project, enable the Google Search Console API, then create an OAuth client under APIs & Services → Credentials. Choose Desktop app for local use. Note the client ID and client secret.

2. Refresh token

Run the OAuth consent flow once, signed in as a Google account that owns or can read your properties, and keep the refresh token. Request webmasters.readonly and nothing more.

📖 Google OAuth for installed apps

The refresh token does not expire. Use an OAuth client dedicated to this server so you can revoke it on its own.

For a quick trial you can set GSC_ACCESS_TOKEN to a short-lived token instead, but it expires within the hour and is useless for daily work.

If setting up an OAuth client is more than you want to do for one property, getmcpads.com handles the consent flow for you and gives you the same tools behind a hosted endpoint.

3. Site URL, optional

Set GSC_SITE_URL to avoid passing it on every call. Both property forms work:

List what you can reach with gsc_list_sites, and run `gsc_health_check` as your first call. It verifies the credentials without printing any secret.

Setup

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{

"mcpServers": { "search-console": { "command": "npx", "args": ["-y", "@getmcpads/google-search-console-mcp-server"], "env": { "GSC_CLIENT_ID": "your-client-id", "GSC_CLIENT_SECRET": "your-client-secret", "GSC_REFRESH_TOKEN": "your-refresh-token", "GSC_SITE_URLS": "sc-domain:example.com" } } } }

Restart Claude Desktop. Ask it: *"which queries did we lose last month?"*.

Claude Code

claude mcp add search-console --env GSC_CLIENT_ID=... --env GSC_CLIENT_SECRET=... --env GSC_REFRESH_TOKEN=... -- npx -y @getmcpads/google-search-console-mcp-server

Cursor

.cursor/mcp.json in your project, same shape as the Claude Desktop config above.

From source

git clone https://github.com/get-mcp-ads/google-search-console-mcp-server.git

cd google-search-console-mcp-server npm install && npm run build cp .env.example .env # then fill in your credentials npm start

Configuration

| GSC_SITE_URLS | *unset* | Recommended. Comma-separated properties