@digestseo/mcp-gsc 0.3.1

package/.dev.vars.example

@@ -0,0 +1,8 @@
+# Local development secrets for `wrangler dev`.
+# Copy this file to `.dev.vars` (gitignored) and fill in your own values.
+# In production these are set with `wrangler secret put <NAME>` instead.
+# See SETUP.md for how to obtain each value.
+
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+TOKEN_ENCRYPTION_KEY=

package/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] - 2026-06-10
+
+### Added
+- `get_capabilities` tool — returns the tool catalog and a non-destructive auth-status probe for better first-run discovery in lazy-loading clients.
+- **Pagination** for `query_search_analytics`: new `start_row` parameter (Google's `startRow`), plus a `next_start_row` field in the response whenever a full page came back.
+- **Parameter descriptions on every tool input** — including the `sc-domain:` vs URL-prefix property format trap, the YYYY-MM-DD date format, and the 2–3 day GSC data lag — so MCP clients make correct calls on the first try.
+- **MCP tool annotations**: all five tools now declare `readOnlyHint: true` and human-readable titles.
+- **Offline unit tests** (`npm run test:unit`, 15 tests): crypto roundtrip/tamper checks, OAuth URL construction, refresh-token error mapping, and Search Console request encoding — no deployment needed.
+- **GitHub Actions CI**: typecheck + unit tests on every push and pull request.
+- `SECURITY.md` with a private-reporting channel and a full data-handling inventory.
+
+### Changed
+- `query_search_analytics` now returns compact JSON shaped as `{ row_count, start_row, rows, next_start_row? }` instead of a pretty-printed bare array — roughly 3× fewer tokens for the same data.
+- Default `row_limit` lowered from 1000 to **100**. Most conversational questions need far fewer rows; bulk consumers can still request up to 25,000 and paginate.
+- Input validation tightened: dates must be `YYYY-MM-DD`, `row_limit` must be an integer in 1–25000.
+- Error messages no longer hardcode Claude.ai — they now say "your MCP client (e.g. Claude.ai → Settings → Connectors)".
+- The version reported by the MCP server and `get_capabilities` is now read from `package.json` (single source of truth).
+- A failure inside the OAuth provider's `completeAuthorization` now returns a clean 500 instead of an unhandled exception.
+
+### Fixed
+- Server name: the MCP server now identifies as `mcp-gsc` (in the `McpServer` name and the `GET /` response body) to match the repo, package, and worker name — it was previously `hosted-gsc-mcp`.
+- A transient Google error no longer deletes a user's stored credentials. `refreshAccessToken` now treats only a definitive `invalid_grant` as a revocation; other non-OK responses (bare 400/401, 5xx, network) propagate as plain errors, so a temporary blip can no longer trigger `deleteUser`.
+
+## [0.1.0] - 2026-06-02
+
+Initial public release — a hosted MCP server for Google Search Console, self-hostable on Cloudflare Workers.
+
+### Added
+- One-click Google OAuth onboarding (`/authorize` → Google → `/google/callback`): connect with your Google account, no API keys to copy.
+- Four read-only tools: `list_sites`, `query_search_analytics`, `inspect_url`, `list_sitemaps`.
+- Bring-your-own Google OAuth credentials and Cloudflare KV — see [SETUP.md](SETUP.md).
+- AES-GCM encryption of stored Google refresh tokens (`src/crypto.ts`).
+- Structural smoke tests (`npm run test:smoke`).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DigestSEO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,139 @@
+# mcp-gsc
+
+<!-- Logo asset for marketplace submissions: assets/logo-400.png (400x400). -->
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![MCP](https://img.shields.io/badge/MCP-remote%20server-8A2BE2)](https://modelcontextprotocol.io)
+[![MCP Registry](https://img.shields.io/badge/MCP%20Registry-io.github.AKzar1el%2Fmcp--gsc-blue)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.AKzar1el/mcp-gsc)
+[![CI](https://github.com/AKzar1el/mcp-gsc/actions/workflows/ci.yml/badge.svg)](https://github.com/AKzar1el/mcp-gsc/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/%40digestseo%2Fmcp-gsc.svg)](https://www.npmjs.com/package/@digestseo/mcp-gsc)
+[![smithery badge](https://smithery.ai/badge/digestseo/mcp-gsc)](https://smithery.ai/servers/digestseo/mcp-gsc)
+
+Part of the **[DigestSEO](https://digestseo.com/)** suite of open-source SEO tools.
+
+- Product: [digestseo.com/gsc-mcp](https://digestseo.com/gsc-mcp/)
+- Support: [digestseo.com/support](https://digestseo.com/support/)
+- Privacy: [digestseo.com/privacy](https://digestseo.com/privacy/)
+
+The self-hosting launcher is available as [`@digestseo/mcp-gsc`](https://www.npmjs.com/package/@digestseo/mcp-gsc):
+
+```bash
+npx -y @digestseo/mcp-gsc
+```
+
+For Google OAuth and Cloudflare deployment configuration, follow [SETUP.md](SETUP.md).
+
+### Connect in 30 seconds
+
+Every deployed instance exposes the same endpoint shape:
+
+```
+https://<your-worker>.workers.dev/mcp
+```
+
+The DigestSEO-hosted instance is available at:
+
+```
+https://mcp-gsc.digestseo.com/mcp
+```
+
+**Claude Code**
+
+```bash
+claude mcp add --transport http gsc https://<your-worker>.workers.dev/mcp
+```
+
+**Cursor**
+
+[![Add to Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=gsc&config=eyJ1cmwiOiJodHRwczovL21jcC1nc2MuZGlnZXN0c2VvLmNvbS9tY3AifQ%3D%3D)
+
+**ChatGPT** — add it as a custom connector; see [Connect in your AI client](#connect-in-your-ai-client) below.
+
+A self-hostable [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for **Google Search Console**. Connect it to Claude.ai, Cursor, ChatGPT, or any MCP-compatible client and ask your AI assistant about your site's organic search performance — impressions, clicks, top queries, index status, and sitemap health — straight from your own Google account.
+
+It runs on [Cloudflare Workers](https://workers.cloudflare.com/) and ships with one-click Google OAuth onboarding: connect the server in your client, sign in with Google once, grant the requested Google Search Console permissions, and you're done. No API keys to copy around and no service-account JSON to manage.
+
+> **Prefer zero setup?** The hosted version — with automatic weekly email digests delivered to your inbox — is at **[digestseo.com](https://digestseo.com)**. This repository is the open-source core you can run yourself.
+
+## Tools
+
+This server exposes 17 tools. Read-only analytics and reporting tools are marked with MCP's `readOnlyHint`; the write tools below can change Search Console properties, sitemaps, or indexing state.
+
+| Tool | Access | What it does |
+|---|---|---|
+| **`server.capabilities`** | Read | List every tool this server exposes and report whether your Google connection is currently authenticated (`connected` / `not_connected`). Takes no arguments — a good first call for discovery. |
+| **`sites.list`** | Read | List the Search Console properties the connected Google account can access (`siteUrl`, `permissionLevel`). |
+| **`analytics.query`** | Read | Impressions, clicks, CTR, and average position over a date range, with dimensions, filters, pagination, and selectable search type. |
+| **`urls.inspect`** | Read | Google's URL Inspection report for a single page. |
+| **`sitemaps.list`** / **`sitemaps.get`** | Read | List submitted sitemaps or retrieve one sitemap's details. |
+| **`insights.quick_wins`** / **`insights.cannibalization`** / **`insights.content_decay`** | Read | Surface optimization opportunities, competing pages, and declining content. |
+| **`indexing.list_pages`** / **`analytics.compare`** | Read | Analyze pages receiving impressions and compare two periods. |
+| **`reports.weekly_digest`** | Read | Generate a plain-language seven-day performance report with movers, top pages, and one recommended action. |
+| **`sites.add`** / **`sites.delete`** | Write | Add or remove a Search Console property. |
+| **`sitemaps.submit`** / **`sitemaps.delete`** | Write | Submit or remove a sitemap. |
+| **`indexing.request`** | Write | Request indexing for an eligible URL through the Google Indexing API. |
+
+The server requests Google Search Console and Indexing API scopes. Use a Google account with only the property access you intend to delegate, and review write-tool calls before approving them.
+
+## What you can ask
+
+Once connected, ask your assistant things like:
+
+- *"What are my top 20 queries by clicks in the last 28 days?"*
+- *"Compare impressions for example.com this month vs last month — which pages dropped?"*
+- *"Is `https://example.com/pricing` indexed? When was it last crawled?"*
+- *"Which queries does my blog rank position 5–15 for? Those are my quick wins."*
+- *"Give me a weekly digest for `sc-domain:example.com` ending today."*
+- *"Do any of my sitemaps have errors or warnings?"*
+- *"Split my clicks into brand vs non-brand using a regex on the query."*
+- *"How is my site doing in Google Discover vs regular web search?"*
+
+## Connect in your AI client
+
+Once you've deployed the server (see **[SETUP.md](SETUP.md)**), connect it by pasting your Worker's `/mcp` URL into your client:
+
+```
+https://<your-worker>.workers.dev/mcp
+```
+
+- **Claude.ai** — Settings → Connectors → **Add custom connector** → paste the `/mcp` URL. Leave Client ID and Client Secret blank. On first use, Claude opens a Google sign-in flow; grant read access and the connector turns green.
+- **Cursor** — add it as a custom MCP server pointing at the same `/mcp` URL.
+- **ChatGPT** (with connector/MCP support) — add a custom connector with the `/mcp` URL.
+
+Any MCP-compatible client works — they all point at the same `/mcp` endpoint and share the same OAuth flow.
+
+## Setup
+
+Self-hosting means bringing your own Google OAuth credentials and Cloudflare account. The full, copy-pasteable walkthrough is in **[SETUP.md](SETUP.md)** — including an important note about Google's OAuth verification and the 7-day refresh-token limit while your app is unverified.
+
+Quick shape:
+
+```bash
+git clone https://github.com/<you>/mcp-gsc.git
+cd mcp-gsc
+npm install
+cp wrangler.example.jsonc wrangler.jsonc       # then paste in your KV ids
+# set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET / TOKEN_ENCRYPTION_KEY as secrets
+npm run deploy
+```
+
+See **[SETUP.md](SETUP.md)** for every step in detail.
+
+## Development
+
+```bash
+npm install
+npm test              # typecheck + offline unit tests (what CI runs)
+npm run dev           # wrangler dev (local)
+npm run test:smoke    # structural smoke tests against a deployment
+```
+
+Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+[MIT](LICENSE) © 2026 DigestSEO.
+
+---
+
+*Built and maintained by [Tomi Šeregi](https://tomiseregi.si), the builder behind [digestseo.com](https://digestseo.com) — weekly SEO digests for non-technical site owners.*

package/SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not open a public issue** for security problems. Instead, use
+[GitHub's private vulnerability reporting](https://github.com/AKzar1el/mcp-gsc/security/advisories/new)
+on this repository. You'll get a response within a few days.
+
+## What this server stores and how
+
+A deployed instance of `mcp-gsc` handles Google OAuth credentials on behalf of
+its users. The full data inventory:
+
+| Data | Where | Protection |
+|---|---|---|
+| Google **refresh token** (per user) | Workers KV (`USER_KV`) | Encrypted at rest with **AES-256-GCM** (`src/crypto.ts`) using the `TOKEN_ENCRYPTION_KEY` secret; a fresh random IV per encryption. |
+| Google account **id and email** (per user) | Workers KV (`USER_KV`) | Stored in plaintext alongside the encrypted token, used only to key and label the record. |
+| Pending OAuth state | Workers KV (`OAUTH_KV`) | Single-use nonce, expires automatically after 10 minutes. |
+| MCP client tokens | Workers KV (`OAUTH_KV`) | Managed by [`@cloudflare/workers-oauth-provider`](https://github.com/cloudflare/workers-oauth-provider). |
+| Google **access tokens** | In-memory only (Durable Object) | Never written to storage; expire within an hour. |
+
+Notes:
+
+- The server requests only the **read-only** scope
+  `https://www.googleapis.com/auth/webmasters.readonly` (plus `openid email`
+  for identifying the account). It cannot modify Search Console data.
+- Secrets (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `TOKEN_ENCRYPTION_KEY`)
+  are read from Worker secrets / `.dev.vars`, never from the repository.
+- When Google reports a refresh token as revoked (`invalid_grant`), the stored
+  user record is deleted immediately.
+- Search Console data is fetched on demand and returned to the MCP client;
+  it is never persisted by this server.
+
+## Supported versions
+
+Only the latest release on `main` is supported with security fixes.

package/SETUP.md

@@ -0,0 +1,201 @@
+# Setup — self-hosting mcp-gsc
+
+This guide walks you through deploying your own instance of `mcp-gsc` on Cloudflare Workers with your own Google OAuth credentials ("bring your own OAuth"). Budget about 30–40 minutes the first time.
+
+By the end you'll have a Worker at `https://<your-worker>.workers.dev/mcp` that you can connect as a custom MCP connector in Claude.ai, Cursor, or ChatGPT.
+
+> **Read [Step 7](#step-7--important-google-verification) before you start.** While your Google OAuth app is unverified, refresh tokens expire after **7 days** and you're capped at **100 users**. This is the single biggest reason self-hosting a Google Search Console MCP is heavier than a key-based MCP — it's how Google's OAuth works for the sensitive `webmasters` and `indexing` scopes, not a limitation of this project.
+
+## Prerequisites
+
+- A [Cloudflare account](https://dash.cloudflare.com/sign-up) (the free Workers plan is enough to start).
+- A [Google account](https://accounts.google.com/) with access to the Search Console properties you want to query.
+- Node.js 20+ and npm.
+- The Wrangler CLI — installed for you by `npm install`; invoke it with `npx wrangler …`.
+
+Clone and install:
+
+```bash
+git clone https://github.com/<you>/mcp-gsc.git
+cd mcp-gsc
+npm install
+```
+
+Authenticate Wrangler with Cloudflare (opens a browser):
+
+```bash
+npx wrangler login
+```
+
+---
+
+## Step 1 — Create a Google Cloud project and enable the Search Console API
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/).
+2. Create a new project (top bar → project dropdown → **New Project**). Name it anything, e.g. `mcp-gsc`.
+3. With that project selected, enable the **Google Search Console API**:
+   - Go to **APIs & Services → Library**.
+   - Search for **"Google Search Console API"**.
+   - Open it and click **Enable**.
+
+   Direct link: <https://console.cloud.google.com/apis/library/searchconsole.googleapis.com>
+
+---
+
+## Step 2 — Configure the OAuth consent screen
+
+1. Go to **APIs & Services → OAuth consent screen**.
+2. Choose **User type: External**, then **Create**.
+3. Fill in the required app info (app name, user support email, developer contact email). The app name is what users see on the Google sign-in screen.
+4. On the **Scopes** step, click **Add or remove scopes** and add these scopes:
+
+   ```
+   https://www.googleapis.com/auth/webmasters
+   https://www.googleapis.com/auth/indexing
+   ```
+
+   These are **sensitive** scopes. They grant read-write access to Search Console data and the Google Indexing API (required to manage sites, sitemaps, and request URL crawling).
+5. On the **Test users** step, click **Add users** and add your own Google email address (and any teammates who need access while the app is in Testing).
+6. Save. Leave the **Publishing status** as **Testing** for now — see [Step 7](#step-7--important-google-verification).
+
+---
+
+## Step 3 — Create an OAuth client (Web application)
+
+1. Go to **APIs & Services → Credentials → Create credentials → OAuth client ID**.
+2. **Application type: Web application.**
+3. Under **Authorized redirect URIs**, add both of these:
+
+   ```
+   https://<your-worker>.workers.dev/google/callback
+   http://localhost:8787/google/callback
+   ```
+
+   - Replace `<your-worker>` with your Worker's name + subdomain. If you don't know it yet, deploy once (Step 6) to see the assigned `*.workers.dev` URL, then come back and add it here. The default Worker name is `mcp-gsc` (set in `wrangler.jsonc`).
+   - The `http://localhost:8787/google/callback` entry is for local development with `npm run dev`.
+   - The path must be exactly `/google/callback` — that's the route this server handles.
+   - The DigestSEO-hosted instance also requires this exact callback URI in the OAuth client configured on its Worker: `https://mcp-gsc.digestseo.com/google/callback`.
+4. Click **Create**. Copy the **Client ID** and **Client secret** — you'll set them as secrets in the next step.
+
+---
+
+## Step 4 — Set the Worker secrets
+
+This server reads three secrets. **Never commit these to git** — set them with `wrangler secret put`, which stores them encrypted in Cloudflare:
+
+```bash
+npx wrangler secret put GOOGLE_CLIENT_ID
+# paste the Client ID from Step 3
+
+npx wrangler secret put GOOGLE_CLIENT_SECRET
+# paste the Client secret from Step 3
+
+npx wrangler secret put TOKEN_ENCRYPTION_KEY
+# paste the key generated below
+```
+
+`TOKEN_ENCRYPTION_KEY` is the **AES-256 key** used by `src/crypto.ts` to encrypt each user's Google refresh token before it's stored in KV. Generate a fresh 32-byte key, base64-encoded:
+
+```bash
+openssl rand -base64 32
+```
+
+Paste that value when prompted. Keep it safe — if you lose it, the refresh tokens already in KV become undecryptable and every user has to reconnect.
+
+For **local development**, put the same three values in `.dev.vars` instead — copy `.dev.vars.example` to `.dev.vars` (it's gitignored):
+
+```
+GOOGLE_CLIENT_ID=...
+GOOGLE_CLIENT_SECRET=...
+TOKEN_ENCRYPTION_KEY=...
+```
+
+---
+
+## Step 5 — Create the KV namespaces
+
+The server uses two Workers KV namespaces: `OAUTH_KV` (pending OAuth state and issued tokens) and `USER_KV` (encrypted refresh tokens, keyed per user).
+
+```bash
+npx wrangler kv namespace create OAUTH_KV
+npx wrangler kv namespace create USER_KV
+```
+
+Each command prints an `id`. Copy the template to your real config and paste the two ids in:
+
+```bash
+cp wrangler.example.jsonc wrangler.jsonc
+```
+
+Then edit `wrangler.jsonc` and replace the placeholders:
+
+```jsonc
+"kv_namespaces": [
+  { "binding": "OAUTH_KV", "id": "YOUR_OAUTH_KV_ID" },   // ← paste OAUTH_KV id
+  { "binding": "USER_KV",  "id": "YOUR_USER_KV_ID" }      // ← paste USER_KV id
+]
+```
+
+`wrangler.jsonc` is gitignored because it contains your account's namespace ids. The `wrangler.example.jsonc` template stays in git.
+
+---
+
+## Step 6 — Apply migrations, deploy, and verify
+
+The Durable Object migration declared in `wrangler.jsonc` (`migrations` → tag `v1`, `new_sqlite_classes: ["GscMcpAgent"]`) is applied automatically the first time you deploy. Deploy:
+
+```bash
+npm run deploy
+```
+
+Wrangler prints your Worker URL, e.g. `https://mcp-gsc.<your-subdomain>.workers.dev`. If you didn't know that host in Step 3, add `https://<that-host>/google/callback` to the Authorized redirect URIs now, then deploy again.
+
+Smoke-check the deployment:
+
+```bash
+curl https://<your-worker>.workers.dev/healthz
+# → ok
+```
+
+Opening the root URL in a browser also prints the `/mcp` connect URL.
+
+Now connect it in **Claude.ai**:
+
+1. Settings → **Connectors** → **Add custom connector**.
+2. Paste `https://<your-worker>.workers.dev/mcp`.
+3. Leave **Client ID** and **Client Secret** blank.
+4. Click through; Claude opens a Google sign-in flow. Sign in with a Google account you added as a **test user** in Step 2, and grant read access to your Search Console properties.
+5. The connector turns green. Ask: *"What sites do I have in Search Console?"*
+
+The same `/mcp` URL works in Cursor and ChatGPT.
+
+---
+
+## Step 7 — Important: Google verification
+
+**Read this carefully — it determines whether your self-hosted instance keeps working past a week.**
+
+While your OAuth app's **Publishing status** is **Testing** (where it starts, and where Step 2 leaves it), three limits apply:
+
+- **Unverified-app screen.** Users see Google's *"Google hasn't verified this app"* warning during sign-in and must click **Advanced → Go to \<app\> (unsafe)** to continue. That's expected for an unverified app — it isn't a problem with this server.
+- **100-user cap.** At most 100 Google accounts can ever authorize the app.
+- **Refresh tokens expire after 7 days.** This is the big one. In Testing mode, Google expires every refresh token **7 days** after it's issued. When that happens the tools start returning *"Google access revoked. Please reconnect this connector in Claude.ai"*, and the user has to reconnect to get a fresh token. **Any automation or scheduled job you build on top will break every 7 days** until you fix this.
+
+To remove all three limits you must move the app to **Publishing status: In production**:
+
+- In **APIs & Services → OAuth consent screen**, click **Publish app**.
+- Because `webmasters` and `indexing` are **sensitive scopes**, Google requires **OAuth verification**: you submit the app for review, justify the scopes, and (for sensitive/restricted scopes) may need to verify domain ownership and complete a security assessment. **This review can take days to several weeks.**
+- Once the app is **In production and verified**, the unverified-app screen goes away, the 100-user cap is lifted, and refresh tokens stop expiring on the 7-day clock.
+
+**Bottom line:** for personal use with one or two Google accounts, Testing mode is fine as long as you don't mind reconnecting roughly every 7 days. For anything shared or automated, you'll want to complete Google's verification — and that, not the code, is the heaviest part of self-hosting a Google Search Console MCP.
+
+> Don't want to deal with verification at all? The hosted version at **[digestseo.com](https://digestseo.com)** has already been through it (and adds automatic weekly email digests on top).
+
+---
+
+## Troubleshooting
+
+- **`redirect_uri_mismatch`** — the redirect URI in Step 3 must match your Worker host exactly, including `https://` and the `/google/callback` path. Check for typos and trailing slashes.
+- **`Google did not return a refresh_token`** — you need a fresh consent. This server requests `access_type=offline` with `prompt=consent`, but if you've authorized before, remove the app from your [Google Account permissions](https://myaccount.google.com/permissions) and reconnect to force a new refresh token.
+- **"Google access revoked" after about a week** — that's the 7-day Testing-mode expiry from Step 7. Reconnect, or move the app to production.
+- **401 on `/mcp`** — expected when unauthenticated. Connect through your MCP client's OAuth flow rather than calling `/mcp` directly in a browser.

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@digestseo/mcp-gsc",
+  "version": "0.3.1",
+  "private": false,
+  "main": "scripts/glama-start.mjs",
+  "bin": {
+    "mcp-gsc": "scripts/glama-start.mjs"
+  },
+  "license": "MIT",
+  "description": "Self-hostable Google Search Console MCP server for analytics, URL inspection, sitemaps, indexing, and SEO reporting on Cloudflare Workers.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AKzar1el/mcp-gsc.git"
+  },
+  "homepage": "https://digestseo.com/gsc-mcp/",
+  "author": {
+    "name": "DigestSEO",
+    "url": "https://digestseo.com/"
+  },
+  "bugs": {
+    "url": "https://github.com/AKzar1el/mcp-gsc/issues"
+  },
+  "files": [
+    "src",
+    "scripts/glama-start.mjs",
+    "wrangler.example.jsonc",
+    ".dev.vars.example",
+    "README.md",
+    "SETUP.md",
+    "SECURITY.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "google-search-console",
+    "google-search-console-mcp",
+    "search-console",
+    "search-analytics",
+    "indexing-api",
+    "seo",
+    "cloudflare-workers",
+    "claude"
+  ],
+  "scripts": {
+    "dev": "wrangler dev",
+    "deploy": "wrangler deploy",
+    "build": "npm run typecheck",
+    "start": "node scripts/glama-start.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run typecheck && npm run test:unit",
+    "test:unit": "tsx --test tests/unit.test.ts",
+    "test:smoke": "node --test tests/smoke.test.mjs",
+    "prepublishOnly": "npm test"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "mcpName": "io.github.AKzar1el/mcp-gsc",
+  "dependencies": {
+    "@cloudflare/workers-oauth-provider": "^0.8.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "agents": "^0.13.1",
+    "wrangler": "^4.93.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20260520.1",
+    "tsx": "^4.20.0",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/scripts/glama-start.mjs

@@ -0,0 +1,36 @@
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const port = process.env.PORT || '8080';
+const forwardedVariables = ['GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET', 'TOKEN_ENCRYPTION_KEY'];
+const args = [
+  'dev',
+  '--config',
+  'wrangler.example.jsonc',
+  '--local',
+  '--ip',
+  '0.0.0.0',
+  '--port',
+  port,
+];
+
+for (const name of forwardedVariables) {
+  if (process.env[name]) {
+    args.push('--var', `${name}:${process.env[name]}`);
+  }
+}
+
+const wranglerCli = createRequire(import.meta.url).resolve('wrangler/bin/wrangler.js');
+const child = spawn(process.execPath, [wranglerCli, ...args], { stdio: 'inherit' });
+
+const forwardSignal = (signal) => child.kill(signal);
+process.on('SIGINT', () => forwardSignal('SIGINT'));
+process.on('SIGTERM', () => forwardSignal('SIGTERM'));
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+  } else {
+    process.exit(code ?? 1);
+  }
+});

package/src/crypto.ts

@@ -0,0 +1,58 @@
+function base64Decode(b64: string): Uint8Array<ArrayBuffer> {
+  const binary = atob(b64);
+  const buf = new ArrayBuffer(binary.length);
+  const bytes = new Uint8Array(buf);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+function base64Encode(bytes: Uint8Array): string {
+  let binary = '';
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+
+async function importKey(base64Key: string): Promise<CryptoKey> {
+  const keyBytes = base64Decode(base64Key);
+  return crypto.subtle.importKey(
+    'raw',
+    keyBytes,
+    { name: 'AES-GCM' },
+    false,
+    ['encrypt', 'decrypt'],
+  );
+}
+
+export async function encryptToken(
+  plaintext: string,
+  base64Key: string,
+): Promise<{ ciphertext: string; iv: string }> {
+  const key = await importKey(base64Key);
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: 'AES-GCM', iv },
+    key,
+    encoded,
+  );
+  return {
+    ciphertext: base64Encode(new Uint8Array(ciphertext)),
+    iv: base64Encode(iv),
+  };
+}
+
+export async function decryptToken(
+  ciphertext: string,
+  iv: string,
+  base64Key: string,
+): Promise<string> {
+  const key = await importKey(base64Key);
+  const ctBytes = base64Decode(ciphertext);
+  const ivBytes = base64Decode(iv);
+  const decrypted = await crypto.subtle.decrypt(
+    { name: 'AES-GCM', iv: ivBytes },
+    key,
+    ctBytes,
+  );
+  return new TextDecoder().decode(decrypted);
+}