MCP Google Search Console

io.github.crunchtoolsPublished by GitHub account crunchtoolsv0.1.0Updated Nov 3, 2026

Secure MCP server for Google Search Console analytics, sitemaps, and URL inspection

VerifiedSTDIODesktop onlyWeb Search & ScrapingData & Analytics

Overview

AI-generated overview

Local MCP server that lets an assistant query Google Search Console search analytics, manage sitemaps, inspect URL indexing and manage site properties.

What you can do
  • Query search analytics data such as clicks, impressions, CTR and position
  • List, get, add and delete Search Console site properties
  • List, get, submit and delete sitemaps
  • Inspect the indexing status of a specific URL
When to use it
Useful when you want an assistant to pull Search Console performance numbers, check why a page is or is not indexed, or keep sitemaps and verified properties in order without opening the Google console by hand.
Requirements
Runs as a local Python process (uvx or pip) or a container. Needs a Google Cloud OAuth client with the Search Console API enabled and the webmasters scope, plus credentials supplied as GSC_CLIENT_ID, GSC_CLIENT_SECRET and either a browser OAuth flow or GSC_REFRESH_TOKEN; optional GSC_CREDENTIALS_DIR and GSC_OAUTH_REDIRECT_URI. Network access to Google APIs.
Before you install
Requires Google OAuth secrets (GSC_CLIENT_ID, GSC_CLIENT_SECRET, GSC_REFRESH_TOKEN) that grant access to your Search Console properties; store the env file with restricted permissions. Several tools change state: add_site, delete_site, submit_sitemap and delete_sitemap modify your Search Console configuration. The browser OAuth flow needs a reachable callback URL and persists tokens to a credentials file.

Installation

In SourceWeft

  1. Open MCP Google Search Console in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-google-search-console-crunchtools

Secure MCP server for Google Search Console. Query search analytics (clicks, impressions, CTR, position), manage sitemaps, inspect URL indexing status, and manage site properties.

[CI] [PyPI] [License: AGPL v3]

Installation

uvx (recommended, zero-install)

bash
claude mcp add mcp-google-search-console-crunchtools \    --env GSC_CLIENT_ID=your_client_id \    --env GSC_CLIENT_SECRET=your_client_secret \    --env GSC_REFRESH_TOKEN=your_refresh_token \    -- uvx mcp-google-search-console-crunchtools

pip

bash
pip install mcp-google-search-console-crunchtools

Container (Podman/Docker)

bash
podman run -d -p 8017:8017 \    --env-file ~/.config/mcp-env/mcp-google-search-console.env \    quay.io/crunchtools/mcp-google-search-console \    --transport streamable-http --host 0.0.0.0

OAuth Setup

This server supports two authentication methods: browser-based OAuth (recommended) and environment variable (fallback).

Option A: Browser-Based OAuth (Recommended)

Browser-based OAuth handles token exchange automatically. When credentials expire, visit the /auth URL and click through Google's consent screen — no manual code exchange needed.

Step 1: Create a Google Cloud OAuth App
  1. Go to Google Cloud Console
  2. Create a new project (or select an existing one)
  3. Navigate to APIs & Services > Library
  4. Search for Google Search Console API and click Enable
  5. Navigate to APIs & Services > Credentials
  6. Click + CREATE CREDENTIALS > OAuth client ID
  7. If prompted, configure the OAuth consent screen first:
    • User type: External (or Internal if using Google Workspace)
    • App name: anything (e.g., "MCP Search Console")
    • Scopes: add https://www.googleapis.com/auth/webmasters
    • Test users: add your Google account email
  8. Back on Create OAuth client ID:
    • Application type: Web application
    • Name: anything (e.g., "MCP Search Console")
    • Authorized redirect URIs: add your server's callback URL (e.g., https://mcp-gsc.example.com/oauth2callback)
  9. Click Create — copy the Client ID and Client Secret
Step 2: Configure and Start

Create an env file:

bash
cat > ~/.config/mcp-env/mcp-google-search-console.env << 'EOF'GSC_CLIENT_ID=your_client_idGSC_CLIENT_SECRET=your_client_secretGSC_CREDENTIALS_DIR=/dataGSC_OAUTH_REDIRECT_URI=https://mcp-gsc.example.com/oauth2callbackEOFchmod 600 ~/.config/mcp-env/mcp-google-search-console.env

Start the server with a persistent volume for credentials:

bash
podman run -d -p 8017:8017 \    --env-file ~/.config/mcp-env/mcp-google-search-console.env \    -v mcp-gsc-data:/data:Z \    quay.io/crunchtools/mcp-google-search-console \    --transport streamable-http --host 0.0.0.0
Step 3: Authenticate

Visit https://mcp-gsc.example.com/auth in your browser. You'll be redirected to Google's consent screen. Grant access and the server will save credentials automatically.

When tokens expire, any tool call will return the /auth URL. Click it to re-authenticate — no container restart needed.

Option B: Environment Variable (Fallback)

If you prefer static credentials or can't expose a callback URL, set GSC_REFRESH_TOKEN in your env file. See the manual OAuth flow below.

Manual OAuth flow
bash
export GSC_CLIENT_ID="your_client_id_here"export GSC_CLIENT_SECRET="your_client_secret_here"
echo "https://accounts.google.com/o/oauth2/v2/auth?client_id=${GSC_CLIENT_ID}&redirect_uri=http://127.0.0.1&response_type=code&scope=https://www.googleapis.com/auth/webmasters&access_type=offline&prompt=consent"
  1. Open the URL in your browser, sign in, and click Allow
  2. Copy the code= value from the redirect URL
  3. Exchange the code:
bash
curl -s -X POST https://oauth2.googleapis.com/token \    -d "client_id=${GSC_CLIENT_ID}" \    -d "client_secret=${GSC_CLIENT_SECRET}" \    -d "code=PASTE_CODE_HERE" \    -d "grant_type=authorization_code" \    -d "redirect_uri=http://127.0.0.1" | python3 -m json.tool
  1. Copy the refresh_token from the response and add GSC_REFRESH_TOKEN=... to your env file.

How it works at runtime

The server checks for credentials in this order:

  1. File-based credentials from GSC_CREDENTIALS_DIR/credentials.json (written by the browser-based flow)
  2. Environment variable GSC_REFRESH_TOKEN (fallback)

On each API call, the server exchanges the refresh token for a short-lived access token (~1 hour), cached in memory and refreshed automatically. Updated tokens are persisted to the credentials file for reuse across container restarts.

Available Tools (10)

CategoryCountTools
Sites4list_sites, get_site, add_site, delete_site
Search Analytics1query_search_analytics
Sitemaps4list_sitemaps, get_sitemap, submit_sitemap, delete_sitemap
URL Inspection1inspect_url

Security

  • OAuth2 credentials stored as SecretStr (never logged)
  • File-based credentials written with 0o600 permissions (atomic writes)
  • Automatic token scrubbing from error messages
  • Pydantic input validation with extra="forbid"
  • No filesystem access, shell execution, or code evaluation
  • TLS certificate validation (httpx default)
  • Request timeouts and response size limits
  • Built on Hummingbird container images

See SECURITY.md for the full security design document.

Development

bash
uv sync --all-extrasuv run ruff check src testsuv run mypy srcuv run pytest -vgourmand --full .podman build -f Containerfile .

License

AGPL-3.0-or-later

Source: README.md at commit dde91a8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts