Google Search Console

mcp-gsc

Part of the [DigestSEO](https://digestseo.com/) suite of open-source SEO tools.

• Product: digestseo.com/gsc-mcp
• Engineering case study: DigestSEO MCP Suite — AI visibility, Search Console, web validation, and trend intelligence
• Support: digestseo.com/support
• Privacy: digestseo.com/privacy

The self-hosting launcher is available as @digestseo/mcp-gsc. For new analytics/reporting-only connections, explicitly start in read-only mode:

GSC_ACCESS_MODE=readonly npx -y @digestseo/mcp-gsc

On Windows PowerShell, use $env:GSC_ACCESS_MODE = 'readonly' followed by npx -y @digestseo/mcp-gsc instead. Supply your own Google OAuth and encryption settings from SETUP.md before starting either command.

The npm launcher starts a loopback-only Streamable HTTP Worker on 127.0.0.1 (port 8080 by default); it is not a stdio MCP process. You can run the npx command from any directory because the launcher resolves its bundled Worker configuration from the installed package. Clients that launch the package should connect to http://127.0.0.1:8080/mcp after supplying the Google OAuth and token-encryption environment variables described in SETUP.md. The launcher exits before starting Wrangler if GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, or TOKEN_ENCRYPTION_KEY is missing or blank, and it also rejects a nonblank TOKEN_ENCRYPTION_KEY unless it is valid base64 that decodes to exactly 32 bytes. Errors identify only the invalid or missing setting, never its secret value, so a broken OAuth session is not started. It keeps secret values in the child process environment and Wrangler loads them through declared local secrets; their values are not copied into Wrangler --var command-line arguments. Before the first OAuth sign-in, authorize the exact callback http://127.0.0.1:8080/google/callback in Google Cloud (or use the same custom PORT you launch with); the launcher prints both URLs at startup.

Docker/Glama network binding. The ordinary npx launcher stays loopback-only by default (MCP_GSC_BIND_IP=127.0.0.1). The Docker image explicitly sets MCP_GSC_BIND_IP=0.0.0.0 inside the container, because Docker port forwarding cannot reach a service bound only to the container's loopback interface. When publishing a Docker port on your computer, prefer -p 127.0.0.1:8080:8080 to restrict host access; expose it beyond the host only with appropriate HTTPS/OAuth deployment configuration and an authorized Google redirect URI. MCP_GSC_BIND_IP accepts only 127.0.0.1 or 0.0.0.0; do not use all-interface binding for ordinary local npm usage.

Local KV and Durable Object state, including the encrypted Google session, is stored in ~/.mcp-gsc/state by default instead of inside the versioned npm cache. That keeps the local connection available across package upgrades and ordinary npm cache cleanup. Set MCP_GSC_STATE_DIR to use another directory; keep the same TOKEN_ENCRYPTION_KEY when reusing existing state because stored refresh tokens are encrypted with that key. The launcher prints the effective state directory at startup. The first release with this stable path may require one Google reconnect because older launcher releases stored local state under the npm package cache.

The launcher's implicit fallback remains GSC_ACCESS_MODE=readwrite for backward compatibility. The read-only commands above and checked-in self-hosting templates explicitly select readonly: Google OAuth then requests only the read-only Search Console scope, and the six mutation tools stay unregistered. Opt into readwrite only for workflows that actually require changes to Search Console properties, sitemaps or eligible Indexing API URLs.

For Google OAuth and Cloudflare deployment configuration, follow SETUP.md.

Connect the local launcher

For the current verified quick-connect path, supply the Google OAuth and token-encryption environment variables described in SETUP.md, then start the npm launcher using the appropriate read-only command above (or deliberately choose readwrite for a privileged workflow).

Then connect your MCP client to the launcher's loopback endpoint:

http://127.0.0.1:8080/mcp

Self-hosted Cloudflare Worker deployments continue to use https:// .workers.dev/mcp. The repo does not currently advertise the owner-hosted remote as a quick-connect path because its deployed tool contract is behind the published package.

Claude Code

claude mcp add --transport http gsc http://127.0.0.1:8080/mcp

OpenAI Codex CLI / IDE

codex mcp add gsc --url http://127.0.0.1:8080/mcp

Codex CLI and the Codex IDE extension share MCP configuration, so registering the server once makes the same local connection available to both clients. Start the npm launcher before using the connection; Codex will open the server's OAuth flow when authentication is required.

Visual Studio Code (GitHub Copilot)

The button adds only the local Streamable HTTP connection; it does not start the npm launcher or configure Google OAuth. Follow SETUP.md and start the launcher above on the same machine as VS Code before connecting and signing in. Remote VS Code environments cannot reach your computer's 127.0.0.1 endpoint.

Cursor

When this repository is installed as a Cursor plugin, Cursor also auto-discovers three bundled Agent Skills that compose the MCP tools into evidence-safe workflows: gsc-weekly-review, gsc-indexing-triage, and gsc-search-opportunities. The Add to Cursor button above installs the MCP connection only; the bundled skills are part of the repository's Cursor plugin package.

The button and plugin MCP configuration above are for Cursor running on the same machine as the npm launcher. Cursor Cloud Agents run in isolated cloud VMs, so they cannot reach `127.0.0.1` on your computer. For Cloud Agents, deploy your own externally reachable HTTPS Worker and add its /mcp URL from the MCP controls at cursor.com/agents; Cursor supports HTTP MCP servers and OAuth there. Do not reuse the loopback URL for a Cloud Agent.

GitHub Copilot CLI

copilot plugin marketplace add AKzar1el/mcp-gsc

copilot plugin install mcp-gsc@digestseo

The marketplace path makes the plugin discoverable and updateable through Copilot's marketplace workflow. Direct repository install also remains supported with copilot plugin install AKzar1el/mcp-gsc. The Copilot plugin bundles the same three Agent Skills plus the local loopback MCP configuration. Start the npm launcher before using the plugin's MCP server; the plugin does not start or deploy mcp-gsc for you.

Gemini CLI

gemini extensions install https://github.com/AKzar1el/mcp-gsc

The Gemini CLI extension bundles the verified local loopback MCP configuration plus the same three Agent Skills: gsc-weekly-review, gsc-indexing-triage, and gsc-search-opportunities. Start the npm launcher before using the extension; the extension does not start or deploy mcp-gsc for you.

Kiro

Start the npm launcher before using either install button or the Copilot plugin. Complete its Google OAuth flow on first use.

ChatGPT — ChatGPT cannot connect directly to this loopback 127.0.0.1 endpoint. For private/local use, create an OpenAI Secure MCP Tunnel, then run tunnel-client on the same machine as the launcher so it can reach http://127.0.0.1:8080/mcp; when creating the ChatGPT app, choose the Tunnel connection and select that tunnel. The tunnel setup requires an OpenAI tunnel_id and runtime API key; see OpenAI's Secure MCP Tunnel guide. The tunnel keeps the MCP server private and is intended for private/developer-mode connectivity, not public plugin distribution.

Alternatively, deploy your own remote Cloudflare Worker and add its HTTPS /mcp URL as a custom MCP app in Developer mode; see Connect in your AI client below.

A self-hostable Model Context Protocol (MCP) server for Google Search Console. Connect it to Claude.ai, Cursor, ChatGPT, or any MCP-compatible client and ask your AI assistant about your site's organic search performance — impressions, clicks, top queries, index status, and sitemap health — straight from your own Google account.

It runs on Cloudflare Workers and ships with Google OAuth onboarding: connect the server in your client, review the mcp-gsc consent page that identifies the requesting MCP client and permissions, then sign in with Google and grant the requested Google Search Console permissions. No API keys to copy around and no service-account JSON to manage.

Tools

By default (GSC_ACCESS_MODE=readwrite), this server exposes 23 tools. Read-only analytics and reporting tools are marked with MCP's readOnlyHint; the write tools below can change Search Console properties, sitemaps, or indexing state. Set GSC_ACCESS_MODE=readonly to request only the Search Console read-only scope and expose the 16 tools that do not require either write access or the separate Indexing API scope.

| `analytics.query` | Read | Impressions, clicks, CTR, and average position over a date range, with dimensions, filters, safe pagination, and selectable search type. Pass dimensions: [] for true site totals; Google's aggregate row