search-console-mcp

Name: search-console-mcp
Author: saurabhsharma2u

Issues

Search & analytics data as infrastructure — MCP server for Google Search Console, Bing Webmaster Tools, and GA4, designed for AI agents and automation.

215stars

22forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/saurabhsharma2u/search-console-mcp

Getting Started

Guides for using ai agents skills like search-console-mcp.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportIssues

Last scanned: 5/30/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@tootallnate/once: @tootallnate/once vulnerable to Incorrect Control Flow Scoping",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-05-30T16:10:57.769Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is search-console-mcp?

search-console-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by saurabhsharma2u. Search & analytics data as infrastructure — MCP server for Google Search Console, Bing Webmaster Tools, and GA4, designed for AI agents and automation. It has 215 GitHub stars.

Is search-console-mcp safe to use?

search-console-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install search-console-mcp?

Clone the repository with "git clone https://github.com/saurabhsharma2u/search-console-mcp" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is search-console-mcp written in?

search-console-mcp is primarily written in TypeScript. It is open-source under saurabhsharma2u on GitHub, so you can review or fork the full source.

Are there alternatives to search-console-mcp?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh search-console-mcp against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

superpowers

by obra

An agentic skills framework & software development methodology that works.

234,966

platform Awareness-Local

🔍 Search Console MCP

Google Search Console + Bing Webmaster Tools + GA4 — in one context window.

Stop exporting CSVs. Start asking your AI agent questions.

📚 Docs · Quick Start · Tools · Security

Why this exists

SEO data lives in three different silos. Answering one question — "did my traffic drop because of a ranking loss or a UX issue?" — usually means logging into three dashboards, exporting three CSVs, and doing VLOOKUPs by hand.

Search Console MCP puts GSC, Bing, and GA4 behind one set of tools your AI agent can call directly, and does the SEO math (cannibalization, anomaly detection, opportunity scoring) before the data ever reaches your context window — so your agent gets insights, not spreadsheets.

	Before	After
Data	3 dashboards, manual exports	1 unified context
Analysis	Manual VLOOKUPs & pivot tables	Deterministic SEO math, done server-side
Accounts	Constant re-login	20+ accounts, auto-resolved per site
Insight	Raw rows, agent guesses	Curated signals (opportunity scores, anomalies)

⚡ Quick Start

npx search-console-mcp setup

This opens your browser, authorizes your Google account, and stores your credentials securely (see Security). Then add it to your MCP client config (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "search-console": {
      "command": "npx",
      "args": ["search-console-mcp"]
    }
  }
}

Restart your client — and try one of the prompts below.

💬 Try it

Paste these straight into your agent:

"My traffic dropped this week vs. last. Find exactly when it started and which pages are responsible."

"Find keywords for example.com ranking positions 8–15 with 1,000+ impressions — my best quick wins."

"Check for keyword cannibalization — are two of my pages competing for the same query?"

"Run opportunity_matrix on my top 20 pages: which have high search visibility but poor on-site engagement?"

"Run a full SEO health check, segmented by Brand vs Non-Brand, with 3 high-impact actions."
"Fetch my top 5 pages by impressions and run a PageSpeed audit — any correlation with declining rankings?"
"Compare Google vs Bing performance for the last 30 days — where is Bing winning?"
"Am I too dependent on Google? Flag keywords where 85%+ of clicks come from one engine."

🔌 Connect your accounts

Platform	Method	Setup
Google Search Console	OAuth (recommended)	`npx search-console-mcp setup`
Google Search Console	Service Account	Set `GOOGLE_APPLICATION_CREDENTIALS` — details
Bing Webmaster Tools	API Key	`export BING_API_KEY="..."` — get a key
Google Analytics 4	Service Account	`npx search-console-mcp setup --engine=ga4`

Manage everything from the CLI:

npx search-console-mcp accounts list
npx search-console-mcp accounts add-site --account=you@company.com --site=example.com
npx search-console-mcp accounts remove --account=you@company.com

When your agent queries a site, the server auto-resolves which account owns it — no manual switching. Multi-account docs →

Create a service account in the Google Cloud Console
Generate a JSON key
Add the service account email as a user in Search Console with "Full" or "Restricted" access
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json"

🛠 Tools

40+ tools across five categories. A few flagship ones:

Tool	What it does
`opportunity_matrix`	Ranks pages by combining GSC visibility with GA4 engagement — where's the ROI?
`seo_striking_distance`	Keywords ranking 8–15 — your fastest wins
`seo_cannibalization`	Pages competing for the same query, with a recommended primary
`analytics_anomalies`	Statistical traffic drop/spike detection
`sites_health_check`	One-shot WoW performance + sitemap + anomaly check
`compare_engines`	Google vs Bing performance, side by side

Analytics & Trends

analytics_query · analytics_trends · analytics_anomalies · analytics_drop_attribution · analytics_time_series · analytics_compare_periods · seo_brand_vs_nonbrand

SEO Opportunities

seo_low_hanging_fruit · seo_striking_distance · seo_low_ctr_opportunities · seo_cannibalization · seo_lost_queries

SEO Primitives (building blocks for agent logic)

seo_primitive_ranking_bucket · seo_primitive_traffic_delta · seo_primitive_is_brand · seo_primitive_is_cannibalized

Sites & Sitemaps

sites_list · sites_add · sites_delete · sites_health_check · sitemaps_list · sitemaps_submit

Inspection & Validation

inspection_inspect · pagespeed_analyze · schema_validate

URL Indexing

indexing_submit_url · indexing_remove_url · indexing_status · indexing_batch_submit · bing_url_submission_quota

Bing Webmaster Tools

bing_sites_list · bing_analytics_query · bing_opportunity_finder · bing_seo_recommendations · bing_url_info · bing_index_now · bing_crawl_issues · bing_analytics_detect_anomalies · bing_analytics_time_series · bing_seo_lost_queries · bing_brand_analysis · bing_sitemaps_list · bing_sitemaps_submit

Google Analytics 4

analytics_page_performance · analytics_traffic_sources · analytics_organic_landing_pages · analytics_content_performance · analytics_conversion_funnel · analytics_user_behavior · analytics_audience_segments · analytics_realtime · analytics_ecommerce · analytics_pagespeed_correlation

Cross-Platform Intelligence

opportunity_matrix · page_analysis · traffic_health_check · brand_analysis · compare_engines

🔒 Security

OS keychain first — tokens stored in macOS Keychain, Windows Credential Manager, or Linux Secret Service
AES-256-GCM fallback — encrypted with a key derived from your machine's hardware ID; a stolen file is useless on another device
Minimal storage — only refresh_token and expiry_date are persisted, at mode 600
Silent refresh — tokens renew automatically in the background

License

MIT · Contributing guide

If this saves you a spreadsheet, consider ⭐ starring the repo.