@digestseo/mcp-gsc 0.4.19 → 0.4.20

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.20] - 2026-09-22
+
+### Fixed
+- Modern MCP requests that use the 2026-07-28 `Mcp-Method` header now fail with the required HTTP 400 `HeaderMismatch` error when `MCP-Protocol-Version` is missing, while legacy initialization without the modern header remains compatible.
+- Repo-owned onboarding and support documentation no longer advertises the intentionally unavailable owner-hosted/automatic-weekly-email service, and Cursor guidance now identifies the one-click path as the local npm launcher.
+- `GET /` now returns deployment-neutral discovery text with the derived MCP endpoint and canonical setup link instead of calling every deployment hosted or telling loopback users to connect it directly from Claude.ai.
+
 ## [0.4.19] - 2026-09-22
 
 ### Fixed

package/README.md

@@ -68,8 +68,6 @@ A self-hostable [Model Context Protocol](https://modelcontextprotocol.io) (MCP)
 
 It runs on [Cloudflare Workers](https://workers.cloudflare.com/) and ships with one-click Google OAuth onboarding: connect the server in your client, sign in with Google once, grant the requested Google Search Console permissions, and you're done. No API keys to copy around and no service-account JSON to manage.
 
-> **Prefer zero setup?** The hosted version — with automatic weekly email digests delivered to your inbox — is at **[digestseo.com](https://digestseo.com)**. This repository is the open-source core you can run yourself.
-
 ## Tools
 
 By default (`GSC_ACCESS_MODE=readwrite`), this server exposes 22 tools. Read-only analytics and reporting tools are marked with MCP's `readOnlyHint`; the write tools below can change Search Console properties, sitemaps, or indexing state. Set `GSC_ACCESS_MODE=readonly` to request only the Search Console read-only scope and expose the 16 tools that do not require either write access or the separate Indexing API scope.
@@ -126,7 +124,7 @@ https://<your-worker>.workers.dev/mcp
 ```
 
 - **Claude.ai / Claude Desktop** — go to **Customize → Connectors**, click **+ → Add custom connector**, enter a name and paste the `/mcp` URL. Leave the optional advanced OAuth Client ID/Secret fields blank. On Team/Enterprise, an Owner or Primary Owner must first add the custom Web connector from **Organization settings → Connectors**; members then connect it from Customize → Connectors. On first connection, Claude opens the Google sign-in flow.
-- **Cursor** — add a remote **Streamable HTTP** MCP server pointing at the same `/mcp` URL; Cursor supports OAuth for remote HTTP MCP servers. The hosted Add to Cursor button above uses this endpoint directly.
+- **Cursor** — add a remote **Streamable HTTP** MCP server pointing at the same `/mcp` URL; Cursor supports OAuth for remote HTTP MCP servers. The Add to Cursor button above targets the local npm launcher's loopback endpoint instead.
 - **ChatGPT** — enable **Developer mode**, then create a custom MCP **app** from **Settings → Apps → Create** (admins/owners can also use **Workspace settings → Apps → Create**). Provide the `/mcp` endpoint, select the applicable authentication option, **Scan Tools**, complete OAuth, then create the app. Full MCP including write/modify tools is currently available to Business and Enterprise/Edu; Pro custom MCP access is read/fetch-only, so use `GSC_ACCESS_MODE=readonly` for that path.
 
 The `/mcp` endpoint is the same across clients, but each host has its own setup and permission flow.
@@ -166,4 +164,4 @@ Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ---
 
-*Built and maintained by [Tomi Šeregi](https://tomiseregi.si), the builder behind [digestseo.com](https://digestseo.com) — weekly SEO digests for non-technical site owners.*
+*Built and maintained by [Tomi Šeregi](https://tomiseregi.si), the builder behind [DigestSEO](https://digestseo.com) - open-source SEO tooling and search visibility software.*

package/SETUP.md

@@ -84,7 +84,6 @@ npx wrangler login
    - The `npx` launcher persists its local KV and Durable Object state in `~/.mcp-gsc/state` by default so npm package upgrades or cache cleanup do not discard the encrypted Google session. Set `MCP_GSC_STATE_DIR` to use another directory, and keep the same `TOKEN_ENCRYPTION_KEY` when reusing existing state. The first release with this stable path may require one Google reconnect because older launcher releases stored local state under the npm package cache.
    - The Worker derives Google's redirect URI from the MCP request URL. Google requires an exact authorized-URI match, so keep the same scheme, host, port, and `/google/callback` path. `localhost` and `127.0.0.1` are different hosts for this check.
    - The path must be exactly `/google/callback` — that's the route this server handles.
-   - The DigestSEO-hosted instance also requires this exact callback URI in the OAuth client configured on its Worker: `https://mcp-gsc.digestseo.com/google/callback`.
 4. Click **Create**. Copy the **Client ID** and **Client secret** — you'll set them as secrets in the next step.
 
 ---
@@ -208,8 +207,6 @@ To remove all three limits you must move the app to **Publishing status: In prod
 
 **Bottom line:** for personal use with one or two Google accounts, Testing mode is fine as long as you don't mind reconnecting roughly every 7 days. For anything shared or automated, you'll want to complete Google's verification — and that, not the code, is the heaviest part of self-hosting a Google Search Console MCP.
 
-> Don't want to deal with verification at all? The hosted version at **[digestseo.com](https://digestseo.com)** has already been through it (and adds automatic weekly email digests on top).
-
 ---
 
 ## Troubleshooting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.19",
+  "version": "0.4.20",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {

package/src/index.ts

@@ -2055,7 +2055,44 @@ export async function createGscMcpServer(
 }
 
 export const mcpApiHandler = {
-  fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    if (
+      request.method === 'POST' &&
+      request.headers.has('Mcp-Method') &&
+      !request.headers.has('MCP-Protocol-Version')
+    ) {
+      let id: string | number | null = null;
+      let isRequest = false;
+      try {
+        const body = (await request.clone().json()) as { id?: unknown };
+        if (Object.prototype.hasOwnProperty.call(body, 'id')) {
+          isRequest = true;
+          if (typeof body.id === 'string' || typeof body.id === 'number') {
+            id = body.id;
+          }
+        }
+      } catch {
+        // Let the SDK handle malformed bodies; this guard targets valid modern requests.
+      }
+
+      if (isRequest) {
+        return new Response(
+          JSON.stringify({
+            jsonrpc: '2.0',
+            id,
+            error: {
+              code: -32020,
+              message: 'HeaderMismatch: MCP-Protocol-Version header is required for modern MCP requests.',
+            },
+          }),
+          {
+            status: 400,
+            headers: { 'content-type': 'application/json; charset=utf-8' },
+          },
+        );
+      }
+    }
+
     const handler = createMcpHandler(() => createGscMcpServer(env), {
       route: '/mcp',
     });
@@ -2119,9 +2156,9 @@ export const defaultHandler = {
         });
       }
       return new Response(
-        'mcp-gsc — Hosted MCP server for Google Search Console.\n' +
-          'Connect this URL as a custom MCP connector in Claude.ai:\n' +
-          `${url.origin}/mcp\n`,
+        'mcp-gsc — Google Search Console MCP server.\n' +
+          `MCP endpoint: ${url.origin}/mcp\n` +
+          'Setup: https://github.com/AKzar1el/mcp-gsc#readme\n',
         { headers: { 'content-type': 'text/plain; charset=utf-8' } },
       );
     }