@digestseo/mcp-gsc 0.4.20 → 0.4.22

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.22] - 2026-09-22
+
+### Added
+- The repository's Cursor plugin now bundles native `gsc-weekly-review`, `gsc-indexing-triage`, and `gsc-search-opportunities` Agent Skills that compose existing MCP tools into evidence-safe Search Console workflows without adding a second tool surface.
+
+### Fixed
+- The production Wrangler floor is now 4.136.3, and the Cloudflare Vitest plugin floor is 1.2.3, so runtime/test installs use Cloudflare's patched Wrangler line for the bundled `smol-toml` denial-of-service advisories GHSA-7w5x-hrqm-74c2 and GHSA-v3rj-xjv7-4jmq.
+
+## [0.4.21] - 2026-09-22
+
+### Fixed
+- The published npm launcher now fails before starting Wrangler when any required Google OAuth/token-encryption environment variable is missing or blank, reporting only the missing variable names instead of allowing a broken local OAuth session to start.
+- URL Inspection and Indexing API authorization now follow Search Console's literal URL-prefix property semantics instead of inventing a path-segment boundary when a provider-returned property identifier does not end in `/`.
+
 ## [0.4.20] - 2026-09-22
 
 ### Fixed

package/README.md

@@ -22,7 +22,7 @@ The self-hosting launcher is available as [`@digestseo/mcp-gsc`](https://www.npm
 npx -y @digestseo/mcp-gsc
 ```
 
-The npm launcher starts a loopback-only **Streamable HTTP** Worker on `127.0.0.1` (port `8080` by default); it is not a stdio MCP process. You can run the `npx` command from any directory because the launcher resolves its bundled Worker configuration from the installed package. Clients that launch the package should connect to `http://127.0.0.1:8080/mcp` after supplying the Google OAuth and token-encryption environment variables described in [SETUP.md](SETUP.md). The launcher keeps `GOOGLE_CLIENT_SECRET` and `TOKEN_ENCRYPTION_KEY` in the child process environment and Wrangler loads them through declared local secrets; their values are not copied into Wrangler `--var` command-line arguments. Before the first OAuth sign-in, authorize the exact callback `http://127.0.0.1:8080/google/callback` in Google Cloud (or use the same custom `PORT` you launch with); the launcher prints both URLs at startup.
+The npm launcher starts a loopback-only **Streamable HTTP** Worker on `127.0.0.1` (port `8080` by default); it is not a stdio MCP process. You can run the `npx` command from any directory because the launcher resolves its bundled Worker configuration from the installed package. Clients that launch the package should connect to `http://127.0.0.1:8080/mcp` after supplying the Google OAuth and token-encryption environment variables described in [SETUP.md](SETUP.md). The launcher exits before starting Wrangler if `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, or `TOKEN_ENCRYPTION_KEY` is missing or blank, naming only the missing variables so a broken OAuth session is not started. It keeps secret values in the child process environment and Wrangler loads them through declared local secrets; their values are not copied into Wrangler `--var` command-line arguments. Before the first OAuth sign-in, authorize the exact callback `http://127.0.0.1:8080/google/callback` in Google Cloud (or use the same custom `PORT` you launch with); the launcher prints both URLs at startup.
 
 Local KV and Durable Object state, including the encrypted Google session, is stored in `~/.mcp-gsc/state` by default instead of inside the versioned npm cache. That keeps the local connection available across package upgrades and ordinary npm cache cleanup. Set `MCP_GSC_STATE_DIR` to use another directory; keep the same `TOKEN_ENCRYPTION_KEY` when reusing existing state because stored refresh tokens are encrypted with that key. The launcher prints the effective state directory at startup. The first release with this stable path may require one Google reconnect because older launcher releases stored local state under the npm package cache.
 
@@ -56,6 +56,8 @@ claude mcp add --transport http gsc http://127.0.0.1:8080/mcp
 
 [![Add to Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=gsc&config=eyJ1cmwiOiJodHRwOi8vMTI3LjAuMC4xOjgwODAvbWNwIn0%3D)
 
+When this repository is installed as a Cursor plugin, Cursor also auto-discovers three bundled Agent Skills that compose the MCP tools into evidence-safe workflows: `gsc-weekly-review`, `gsc-indexing-triage`, and `gsc-search-opportunities`. The **Add to Cursor** button above installs the MCP connection only; the bundled skills are part of the repository's Cursor plugin package.
+
 **Kiro**
 
 [![Add to Kiro](https://kiro.dev/images/add-to-kiro.svg)](https://kiro.dev/launch/mcp/add?name=mcp-gsc&config=%7B%22url%22%3A%22http%3A%2F%2F127.0.0.1%3A8080%2Fmcp%22%2C%22disabled%22%3Afalse%2C%22autoApprove%22%3A%5B%5D%7D)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {
@@ -76,11 +76,11 @@
     "@cloudflare/workers-oauth-provider": "^0.10.3",
     "@modelcontextprotocol/server": "2.0.0",
     "agents": "^0.24.0",
-    "wrangler": "^4.135.0",
+    "wrangler": "^4.136.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cloudflare/vitest-plugin": "^1.1.13",
+    "@cloudflare/vitest-plugin": "^1.2.3",
     "@cloudflare/workers-types": "^5.20260919.1",
     "tsx": "^4.20.0",
     "typescript": "^6.0.3",

package/scripts/glama-start.mjs

@@ -4,6 +4,21 @@ import { constants, homedir } from 'node:os';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+const requiredEnvironmentVariables = [
+  'GOOGLE_CLIENT_ID',
+  'GOOGLE_CLIENT_SECRET',
+  'TOKEN_ENCRYPTION_KEY',
+];
+const missingRequiredEnvironmentVariables = requiredEnvironmentVariables.filter(
+  (name) => !process.env[name]?.trim(),
+);
+if (missingRequiredEnvironmentVariables.length > 0) {
+  console.error(
+    `[mcp-gsc] Missing required environment variables: ${missingRequiredEnvironmentVariables.join(', ')}. See SETUP.md for local launcher configuration.`,
+  );
+  process.exit(1);
+}
+
 const port = process.env.PORT || '8080';
 const localBaseUrl = `http://127.0.0.1:${port}`;
 const mcpUrl = `${localBaseUrl}/mcp`;

package/src/indexing-property-authorization.ts

@@ -60,16 +60,9 @@ function normalizeSiteUrl(siteUrl: string): string {
 function isWithinUrlPrefix(target: URL, property: URL): boolean {
   if (target.origin !== property.origin) return false;
 
-  const propertyPath = property.pathname;
-  if (propertyPath === '/') return true;
-  const descendantPrefix = propertyPath.endsWith('/')
-    ? propertyPath
-    : `${propertyPath}/`;
-
-  return (
-    target.pathname === propertyPath ||
-    target.pathname.startsWith(descendantPrefix)
-  );
+  // Search Console URL-prefix properties are literal URL prefixes. Do not
+  // strengthen a provider-returned prefix into an invented path boundary.
+  return target.href.startsWith(property.href);
 }
 
 function isWithinDomainProperty(target: URL, domain: string): boolean {