@digestseo/mcp-gsc 0.4.18 → 0.4.20

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.20] - 2026-09-22
+
+### Fixed
+- Modern MCP requests that use the 2026-07-28 `Mcp-Method` header now fail with the required HTTP 400 `HeaderMismatch` error when `MCP-Protocol-Version` is missing, while legacy initialization without the modern header remains compatible.
+- Repo-owned onboarding and support documentation no longer advertises the intentionally unavailable owner-hosted/automatic-weekly-email service, and Cursor guidance now identifies the one-click path as the local npm launcher.
+- `GET /` now returns deployment-neutral discovery text with the derived MCP endpoint and canonical setup link instead of calling every deployment hosted or telling loopback users to connect it directly from Claude.ai.
+
+## [0.4.19] - 2026-09-22
+
+### Fixed
+- Search Analytics freshness metadata now normalizes Google's camelCase `firstIncompleteDate` / `firstIncompleteHour` wire fields into the stable MCP `first_incomplete_date` / `first_incomplete_hour` response contract.
+- The npm launcher now exits deterministically after its Wrangler child terminates by signal instead of re-signalling itself while its own `SIGINT`/`SIGTERM` listeners are installed, preventing wrapper processes from lingering after Ctrl+C or supervisor shutdown on POSIX systems.
+- ChatGPT local-launcher guidance now explicitly requires Secure MCP Tunnel for the loopback `127.0.0.1` endpoint, or a separately deployed remote Worker, instead of implying that ChatGPT can connect directly to localhost.
+
 ## [0.4.18] - 2026-09-22
 
 ### Fixed

package/README.md

@@ -62,14 +62,12 @@ claude mcp add --transport http gsc http://127.0.0.1:8080/mcp
 
 Start the npm launcher before using either install button. Complete its Google OAuth flow on first use.
 
-**ChatGPT** — add it as a custom MCP app in developer mode; see [Connect in your AI client](#connect-in-your-ai-client) below.
+**ChatGPT** — ChatGPT cannot connect directly to this loopback `127.0.0.1` endpoint. Use OpenAI's **Secure MCP Tunnel** for the local launcher, or deploy your own remote Cloudflare Worker and add that `/mcp` URL as a custom MCP app in Developer mode; see [Connect in your AI client](#connect-in-your-ai-client) below.
 
 A self-hostable [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for **Google Search Console**. Connect it to Claude.ai, Cursor, ChatGPT, or any MCP-compatible client and ask your AI assistant about your site's organic search performance — impressions, clicks, top queries, index status, and sitemap health — straight from your own Google account.
 
 It runs on [Cloudflare Workers](https://workers.cloudflare.com/) and ships with one-click Google OAuth onboarding: connect the server in your client, sign in with Google once, grant the requested Google Search Console permissions, and you're done. No API keys to copy around and no service-account JSON to manage.
 
-> **Prefer zero setup?** The hosted version — with automatic weekly email digests delivered to your inbox — is at **[digestseo.com](https://digestseo.com)**. This repository is the open-source core you can run yourself.
-
 ## Tools
 
 By default (`GSC_ACCESS_MODE=readwrite`), this server exposes 22 tools. Read-only analytics and reporting tools are marked with MCP's `readOnlyHint`; the write tools below can change Search Console properties, sitemaps, or indexing state. Set `GSC_ACCESS_MODE=readonly` to request only the Search Console read-only scope and expose the 16 tools that do not require either write access or the separate Indexing API scope.
@@ -126,7 +124,7 @@ https://<your-worker>.workers.dev/mcp
 ```
 
 - **Claude.ai / Claude Desktop** — go to **Customize → Connectors**, click **+ → Add custom connector**, enter a name and paste the `/mcp` URL. Leave the optional advanced OAuth Client ID/Secret fields blank. On Team/Enterprise, an Owner or Primary Owner must first add the custom Web connector from **Organization settings → Connectors**; members then connect it from Customize → Connectors. On first connection, Claude opens the Google sign-in flow.
-- **Cursor** — add a remote **Streamable HTTP** MCP server pointing at the same `/mcp` URL; Cursor supports OAuth for remote HTTP MCP servers. The hosted Add to Cursor button above uses this endpoint directly.
+- **Cursor** — add a remote **Streamable HTTP** MCP server pointing at the same `/mcp` URL; Cursor supports OAuth for remote HTTP MCP servers. The Add to Cursor button above targets the local npm launcher's loopback endpoint instead.
 - **ChatGPT** — enable **Developer mode**, then create a custom MCP **app** from **Settings → Apps → Create** (admins/owners can also use **Workspace settings → Apps → Create**). Provide the `/mcp` endpoint, select the applicable authentication option, **Scan Tools**, complete OAuth, then create the app. Full MCP including write/modify tools is currently available to Business and Enterprise/Edu; Pro custom MCP access is read/fetch-only, so use `GSC_ACCESS_MODE=readonly` for that path.
 
 The `/mcp` endpoint is the same across clients, but each host has its own setup and permission flow.
@@ -166,4 +164,4 @@ Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ---
 
-*Built and maintained by [Tomi Šeregi](https://tomiseregi.si), the builder behind [digestseo.com](https://digestseo.com) — weekly SEO digests for non-technical site owners.*
+*Built and maintained by [Tomi Šeregi](https://tomiseregi.si), the builder behind [DigestSEO](https://digestseo.com) - open-source SEO tooling and search visibility software.*

package/SETUP.md

@@ -84,7 +84,6 @@ npx wrangler login
    - The `npx` launcher persists its local KV and Durable Object state in `~/.mcp-gsc/state` by default so npm package upgrades or cache cleanup do not discard the encrypted Google session. Set `MCP_GSC_STATE_DIR` to use another directory, and keep the same `TOKEN_ENCRYPTION_KEY` when reusing existing state. The first release with this stable path may require one Google reconnect because older launcher releases stored local state under the npm package cache.
    - The Worker derives Google's redirect URI from the MCP request URL. Google requires an exact authorized-URI match, so keep the same scheme, host, port, and `/google/callback` path. `localhost` and `127.0.0.1` are different hosts for this check.
    - The path must be exactly `/google/callback` — that's the route this server handles.
-   - The DigestSEO-hosted instance also requires this exact callback URI in the OAuth client configured on its Worker: `https://mcp-gsc.digestseo.com/google/callback`.
 4. Click **Create**. Copy the **Client ID** and **Client secret** — you'll set them as secrets in the next step.
 
 ---
@@ -208,8 +207,6 @@ To remove all three limits you must move the app to **Publishing status: In prod
 
 **Bottom line:** for personal use with one or two Google accounts, Testing mode is fine as long as you don't mind reconnecting roughly every 7 days. For anything shared or automated, you'll want to complete Google's verification — and that, not the code, is the heaviest part of self-hosting a Google Search Console MCP.
 
-> Don't want to deal with verification at all? The hosted version at **[digestseo.com](https://digestseo.com)** has already been through it (and adds automatic weekly email digests on top).
-
 ---
 
 ## Troubleshooting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.18",
+  "version": "0.4.20",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {

package/scripts/glama-start.mjs

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
-import { homedir } from 'node:os';
+import { constants, homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -51,7 +51,8 @@ process.on('SIGTERM', () => forwardSignal('SIGTERM'));
 
 child.on('exit', (code, signal) => {
   if (signal) {
-    process.kill(process.pid, signal);
+    const signalNumber = constants.signals[signal];
+    process.exit(signalNumber === undefined ? 1 : 128 + signalNumber);
   } else {
     process.exit(code ?? 1);
   }

package/src/google.ts

@@ -407,6 +407,11 @@ export interface SearchAnalyticsResponseMetadata {
   first_incomplete_hour?: string;
 }
 
+interface GoogleSearchAnalyticsResponseMetadata {
+  firstIncompleteDate?: string;
+  firstIncompleteHour?: string;
+}
+
 export interface SearchAnalyticsResponse {
   rows: SearchAnalyticsRow[];
   responseAggregationType?: string;
@@ -610,14 +615,25 @@ export async function querySearchAnalytics(
   const data = (await resp.json()) as {
     rows?: SearchAnalyticsRow[];
     responseAggregationType?: string;
-    metadata?: SearchAnalyticsResponseMetadata;
+    metadata?: GoogleSearchAnalyticsResponseMetadata;
   };
+  const metadata: SearchAnalyticsResponseMetadata | undefined =
+    data.metadata === undefined
+      ? undefined
+      : {
+          ...(data.metadata.firstIncompleteDate !== undefined
+            ? { first_incomplete_date: data.metadata.firstIncompleteDate }
+            : {}),
+          ...(data.metadata.firstIncompleteHour !== undefined
+            ? { first_incomplete_hour: data.metadata.firstIncompleteHour }
+            : {}),
+        };
   return {
     rows: data.rows ?? [],
     ...(data.responseAggregationType !== undefined
       ? { responseAggregationType: data.responseAggregationType }
       : {}),
-    ...(data.metadata !== undefined ? { metadata: data.metadata } : {}),
+    ...(metadata !== undefined ? { metadata } : {}),
   };
 }
 

package/src/index.ts

@@ -2055,7 +2055,44 @@ export async function createGscMcpServer(
 }
 
 export const mcpApiHandler = {
-  fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    if (
+      request.method === 'POST' &&
+      request.headers.has('Mcp-Method') &&
+      !request.headers.has('MCP-Protocol-Version')
+    ) {
+      let id: string | number | null = null;
+      let isRequest = false;
+      try {
+        const body = (await request.clone().json()) as { id?: unknown };
+        if (Object.prototype.hasOwnProperty.call(body, 'id')) {
+          isRequest = true;
+          if (typeof body.id === 'string' || typeof body.id === 'number') {
+            id = body.id;
+          }
+        }
+      } catch {
+        // Let the SDK handle malformed bodies; this guard targets valid modern requests.
+      }
+
+      if (isRequest) {
+        return new Response(
+          JSON.stringify({
+            jsonrpc: '2.0',
+            id,
+            error: {
+              code: -32020,
+              message: 'HeaderMismatch: MCP-Protocol-Version header is required for modern MCP requests.',
+            },
+          }),
+          {
+            status: 400,
+            headers: { 'content-type': 'application/json; charset=utf-8' },
+          },
+        );
+      }
+    }
+
     const handler = createMcpHandler(() => createGscMcpServer(env), {
       route: '/mcp',
     });
@@ -2119,9 +2156,9 @@ export const defaultHandler = {
         });
       }
       return new Response(
-        'mcp-gsc — Hosted MCP server for Google Search Console.\n' +
-          'Connect this URL as a custom MCP connector in Claude.ai:\n' +
-          `${url.origin}/mcp\n`,
+        'mcp-gsc — Google Search Console MCP server.\n' +
+          `MCP endpoint: ${url.origin}/mcp\n` +
+          'Setup: https://github.com/AKzar1el/mcp-gsc#readme\n',
         { headers: { 'content-type': 'text/plain; charset=utf-8' } },
       );
     }