@digestseo/mcp-gsc 0.4.3 → 0.4.5

package/CHANGELOG.md

@@ -5,7 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.4.5] - 2026-09-21
+
+### Fixed
+- Search Console property inputs now reject malformed, relative, unsupported-scheme, credential-bearing, and malformed `sc-domain:` identifiers locally across all tools instead of deferring obvious property-identifier errors to Google.
+- Sitemap get/list-filter/submit/delete inputs now reject malformed, relative, and non-HTTP(S) sitemap URLs locally instead of deferring obvious contract errors to Google.
+
+## [0.4.4] - 2026-09-21
+
+### Fixed
+- Search Analytics requests grouped by `hour` now require the documented `hourly_all` data state and reject hourly windows longer than Google's documented 10-day limit before calling the provider.
+- Search Analytics outputs now distinguish local pagination completeness from Google's provider-level limitation that only top rows are guaranteed, preventing agents from treating a fully fetched local window as an exhaustive dataset.
 
 ## [0.4.3] - 2026-09-21
 

package/README.md

@@ -73,7 +73,7 @@ By default (`GSC_ACCESS_MODE=readwrite`), this server exposes 21 tools. Read-onl
 | **`server.capabilities`** | Read | List every tool this server exposes and report whether your Google connection is currently authenticated (`connected` / `not_connected`). Takes no arguments — a good first call for discovery. |
 | **`sites.list`** | Read | List the Search Console properties the connected Google account can access (`siteUrl`, `permissionLevel`). |
 | **`sites.get`** | Read | Retrieve one exact Search Console property and the connected account's permission level for it. |
-| **`analytics.query`** | Read | Impressions, clicks, CTR, and average position over a date range, with dimensions, filters, safe pagination, and selectable search type. Pass `dimensions: []` for true site totals; Google's aggregate row may omit `keys`. |
+| **`analytics.query`** | Read | Impressions, clicks, CTR, and average position over a date range, with dimensions, filters, safe pagination, and selectable search type. Pass `dimensions: []` for true site totals; Google's aggregate row may omit `keys`. Search Analytics does not guarantee every data row and can return only top rows, so exhausting local pagination is not proof that the provider dataset is exhaustive. |
 | **`insights.page_queries`** / **`insights.query_pages`** | Read | Drill from one exact page to its Search Console queries, or from one exact query to the pages Google surfaced for it, with `row_limit` / `start_row` pagination. |
 | **`urls.inspect`** | Read | Google's URL Inspection report for the version of one page currently known in Google's index. It is not a live URL test; mobile-usability output is deprecated. |
 | **`urls.inspect_many`** | Read | Inspect Google's indexed versions of up to 10 URLs sequentially in one call. Each URL still consumes one Google URL Inspection request and one unit of the server's shared inspection safety budget; this does not run live URL tests. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {

package/src/google.ts

@@ -239,11 +239,28 @@ export interface SearchAnalyticsQuery {
   dimensionFilterGroups?: DimensionFilterGroup[];
 }
 
+function inclusiveCalendarDayCount(startDate: string, endDate: string): number {
+  const [startYear, startMonth, startDay] = startDate.split('-').map(Number);
+  const [endYear, endMonth, endDay] = endDate.split('-').map(Number);
+  const startUtc = Date.UTC(startYear, startMonth - 1, startDay);
+  const endUtc = Date.UTC(endYear, endMonth - 1, endDay);
+  return Math.floor((endUtc - startUtc) / 86_400_000) + 1;
+}
+
 export function assertSearchAnalyticsQueryCompatible(body: SearchAnalyticsQuery): void {
   if (new Set(body.dimensions).size !== body.dimensions.length) {
     throw new Error('Search Analytics dimensions must not contain duplicates.');
   }
 
+  const hasHourDimension = body.dimensions.includes('hour');
+  const usesHourlyData = body.dataState === 'hourly_all';
+  if (hasHourDimension && !usesHourlyData) {
+    throw new Error('Search Analytics hour dimension requires dataState hourly_all.');
+  }
+  if (hasHourDimension && inclusiveCalendarDayCount(body.startDate, body.endDate) > 10) {
+    throw new Error('Search Analytics hourly queries support at most 10 inclusive calendar days.');
+  }
+
   const filters = body.dimensionFilterGroups?.flatMap((group) => group.filters) ?? [];
   const hasPageGroupingOrFilter =
     body.dimensions.includes('page') || filters.some((filter) => filter.dimension === 'page');

package/src/index.ts

@@ -56,6 +56,11 @@ import {
 import { CONTENT_DECAY_COMPARE_DAYS_SCHEMA } from './content-decay-schema';
 import { resolveIndexedPagesDateRange } from './indexed-pages-range';
 import { createQuickWinsInputSchema } from './quick-wins-schema';
+import { SITEMAP_URL_SCHEMA } from './sitemap-url-schema';
+import {
+  SEARCH_CONSOLE_PROPERTY_DESCRIPTION,
+  SEARCH_CONSOLE_PROPERTY_SCHEMA,
+} from './search-console-property-schema';
 import { WRITE_TOOL_ANNOTATIONS } from './write-tool-annotations';
 import {
   getToolCatalogForAccessMode,
@@ -104,9 +109,6 @@ const READ_ONLY_ANNOTATIONS = {
   openWorldHint: true,
 } as const;
 
-const SITE_URL_DESCRIPTION =
-  "The Search Console property identifier, exactly as returned by sites.list. Two formats exist: domain properties use 'sc-domain:example.com'; URL-prefix properties use the full URL including protocol and trailing slash, e.g. 'https://www.example.com/'. Passing the wrong format returns a permission error even when the user owns the site — call sites.list first if unsure.";
-
 const METRIC_OUTPUT_SCHEMA = {
   clicks: z.number(),
   impressions: z.number(),
@@ -202,6 +204,10 @@ const SEARCH_ANALYTICS_OUTPUT_SCHEMA = {
   row_count: z.number().int().nonnegative(),
   start_row: z.number().int().nonnegative(),
   rows: z.array(z.object(SEARCH_ROW_OUTPUT_SCHEMA)),
+  provider_exhaustiveness_guaranteed: z.literal(false).describe(
+    'False because the Search Analytics API does not guarantee every data row; Google can return only top rows even after local pagination is exhausted.',
+  ),
+  provider_note: z.string(),
   next_start_row: z.number().int().nonnegative().optional(),
   has_more: z.boolean(),
   truncated: z.boolean(),
@@ -232,6 +238,10 @@ const SEARCH_ANALYTICS_PAGINATION_OUTPUT_SCHEMA = z.object({
   rows_fetched: z.number().int().nonnegative(),
   pages_fetched: z.number().int().positive(),
   local_limit_reached: z.boolean(),
+  provider_exhaustiveness_guaranteed: z.literal(false).describe(
+    'False because Google does not guarantee that Search Analytics exposes every data row.',
+  ),
+  provider_note: z.string(),
 });
 
 const RESULT_PAGE_OUTPUT_SCHEMA = z.object({
@@ -425,11 +435,16 @@ function toolResponse<T extends Record<string, unknown>>(
   };
 }
 
+const SEARCH_ANALYTICS_PROVIDER_NOTE =
+  'Google Search Analytics does not guarantee all data rows and can return only top rows. Local pagination fields describe what this server fetched or bounded; they do not prove provider-level exhaustiveness.';
+
 function paginationMetadata(result: PaginatedSearchAnalyticsResult) {
   return {
     rows_fetched: result.rows.length,
     pages_fetched: result.pagesFetched,
     local_limit_reached: result.localLimitReached,
+    provider_exhaustiveness_guaranteed: false as const,
+    provider_note: SEARCH_ANALYTICS_PROVIDER_NOTE,
   };
 }
 
@@ -513,7 +528,7 @@ const TOOL_CATALOG = [
   {
     name: 'analytics.query',
     description:
-      'Query Search Console search analytics (impressions, clicks, CTR, average position) over a date range, broken down by query, page, country, device, date, or search appearance. Supports filters and pagination.',
+      'Query Search Console search analytics (impressions, clicks, CTR, average position) over a date range, broken down by query, page, country, device, date, or search appearance. Supports filters and pagination. Google does not guarantee every data row and can return only top rows.',
   },
   {
     name: 'insights.page_queries',
@@ -707,7 +722,7 @@ class GscMcpRuntime {
         description:
           "Retrieve one exact Google Search Console property and the connected account's permission level for it. Use this when the user has already named a property and you need to confirm that exact property or its access level without listing every property first.",
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: SITE_DETAIL_OUTPUT_SCHEMA,
         annotations: READ_ONLY_ANNOTATIONS,
@@ -726,7 +741,7 @@ class GscMcpRuntime {
         title: 'Inspect URL index status',
         description: `Inspect the version of a single URL currently known in Google's index. Returns Google's index-status analysis, last crawl, page-fetch/indexing state, canonicals, and rich-results/AMP analysis where available. This API does not test the live URL or prove current live-page indexability, and its mobile-usability result is deprecated. Use this when the user asks 'is X indexed?' or wants Google's indexed-state evidence for one page. For a bounded group of 2-10 URLs, prefer urls.inspect_many; Google still processes one URL Inspection request per URL and applies the same quota semantics.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           inspection_url: z
             .string()
             .describe(
@@ -766,7 +781,7 @@ class GscMcpRuntime {
         title: 'Inspect multiple URLs',
         description: `Inspect the versions of up to 10 URLs currently known in Google's index from one Search Console property. This API does not run live URL tests. Google still processes one URL Inspection request per URL, so every requested URL consumes one quota unit and one unit of this server's shared URL-inspection safety budget. Requests are sent sequentially to avoid unnecessary bursts. Use this for a small group of important or debugging-target URLs; do not use it to crawl an entire site.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           inspection_urls: z
             .array(z.string().url())
             .min(1)
@@ -829,10 +844,8 @@ class GscMcpRuntime {
         description:
           'List sitemaps submitted for a Search Console property. Optionally filter to entries included by one sitemap index. Returns sitemap URLs, last submitted/downloaded dates, submitted URL counts, warning and error counts, and sitemap status. Google\'s deprecated sitemap indexed count is intentionally omitted. Use this when the user asks about sitemap health, submission status, wants to audit which sitemaps are working, or needs the child sitemaps belonging to a specific sitemap index.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          sitemap_index: z
-            .string()
-            .url()
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          sitemap_index: SITEMAP_URL_SCHEMA
             .optional()
             .describe(
               'Optional sitemap index URL. When supplied, Google returns sitemap entries included in that index.',
@@ -855,13 +868,18 @@ class GscMcpRuntime {
         title: 'Query search analytics',
         description: [
           'Query Google Search Console search analytics data. Returns',
-          '{ row_count, start_row, rows, has_more, truncated, byte_limit_reached }',
+          '{ row_count, start_row, rows, provider_exhaustiveness_guaranteed,',
+          '  provider_note, has_more, truncated, byte_limit_reached }',
           'where dimensioned rows have keys plus clicks, impressions, ctr, and',
           'position. Aggregate rows from dimensions: [] may omit keys because',
           'Google itself omits that field. When has_more is true, the response',
           'includes next_start_row — pass it back as start_row to fetch the next',
           'safe page. Large requested row_limit values are automatically split',
           'into bounded MCP responses rather than failing structured output.',
+          'Google does not guarantee that Search Analytics exposes every data',
+          'row; it can return only top rows. Local has_more/pagination fields',
+          'therefore describe this server\'s fetch window, not provider-level',
+          'exhaustiveness.',
           'When Google provides',
           'them, response_aggregation_type and metadata are also included;',
           'metadata may identify the first incomplete date or hour.',
@@ -898,7 +916,9 @@ class GscMcpRuntime {
           '  "NEWS_SHOWCASE" filter. Do not group/filter by page or add',
           '  another searchAppearance filter for that aggregation mode.',
           '- For hourly breakdowns, include "hour" in dimensions and set',
-          '  data_state to "hourly_all". Hourly data is preliminary.',
+          '  data_state to "hourly_all". The hourly date range can span at',
+          '  most 10 inclusive days, and hourly data',
+          '  is preliminary.',
           '- Use dimension_filter_groups to filter by country, device, query',
           '  content, page URL, or search feature. includingRegex and',
           '  excludingRegex use RE2 syntax. For brand vs non-brand splits,',
@@ -908,7 +928,7 @@ class GscMcpRuntime {
           '  non-preliminary data.',
         ].join('\n'),
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe(
             'End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day data lag: the most recent complete date is usually 3 days ago.',
@@ -927,7 +947,7 @@ class GscMcpRuntime {
             )
             .default(['query'])
             .describe(
-              'Dimensions to group rows by. Pass [] (empty array) to get a single row of true site-level totals. Google Discover does not support the query dimension.',
+              "Dimensions to group rows by. Pass [] (empty array) to get a single row of true site-level totals. The 'hour' dimension requires data_state 'hourly_all' and an inclusive date range of at most 10 days. Google Discover does not support the query dimension.",
             ),
           row_limit: z
             .number()
@@ -950,7 +970,7 @@ class GscMcpRuntime {
             .enum(['all', 'final', 'hourly_all'])
             .default('all')
             .describe(
-              "'all' includes fresh (preliminary) data and matches the GSC dashboard; 'final' returns only finalized data; 'hourly_all' returns hourly preliminary data and should be paired with the 'hour' dimension.",
+              "'all' includes fresh (preliminary) data and matches the GSC dashboard; 'final' returns only finalized data; 'hourly_all' includes hourly preliminary data and must be used when grouping by the 'hour' dimension. Hour-grouped requests can span at most 10 inclusive days.",
             ),
           search_type: z
             .enum(['web', 'image', 'video', 'news', 'discover', 'googleNews'])
@@ -1039,6 +1059,8 @@ class GscMcpRuntime {
           row_count: bounded.items.length,
           start_row,
           rows: bounded.items,
+          provider_exhaustiveness_guaranteed: false,
+          provider_note: SEARCH_ANALYTICS_PROVIDER_NOTE,
           has_more: bounded.resultPage.has_more,
           truncated: bounded.resultPage.truncated,
           byte_limit_reached: bounded.resultPage.byte_limit_reached,
@@ -1064,7 +1086,7 @@ class GscMcpRuntime {
         title: 'Find queries for a page',
         description: 'For one exact page URL, return the Search Console queries that produced impressions for it over a date range. This wraps an exact page dimension filter so agents do not need to construct analytics.query filter groups manually. Exact page matching is case-sensitive in Search Console. Use row_limit and start_row to page through bounded results; Search Console can still omit anonymized queries. Google Discover is intentionally unavailable because Discover does not expose query data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           page_url: z.string().url().describe('Exact fully-qualified page URL to filter on, e.g. https://example.com/guides/seo/. Search Console exact page filters are case-sensitive.'),
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
@@ -1142,7 +1164,7 @@ class GscMcpRuntime {
         title: 'Find pages for a query',
         description: 'For one exact search query, return the site pages that received impressions for it over a date range. This wraps an exact query dimension filter so agents do not need to construct analytics.query filter groups manually. Exact query matching is case-sensitive in Search Console. Use row_limit and start_row to page through bounded results and verify which URL Google is surfacing before diagnosing cannibalization or content targeting. Google Discover is intentionally unavailable because Discover does not expose query data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           query: z.string().min(1).describe('Exact Search Console query text to filter on. Exact query filters are case-sensitive.'),
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
@@ -1221,7 +1243,7 @@ class GscMcpRuntime {
         title: 'Add Search Console property',
         description: 'Add a new website property to your Google Search Console account. Note: Domain properties require sc-domain prefix (e.g., sc-domain:example.com), URL-prefix properties require full URL (e.g., https://example.com/).',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sites.add'],
@@ -1243,7 +1265,7 @@ class GscMcpRuntime {
         title: 'Delete Search Console property',
         description: 'Remove an existing website property from your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sites.delete'],
@@ -1265,8 +1287,8 @@ class GscMcpRuntime {
         title: 'Submit sitemap',
         description: 'Submit a new sitemap to your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file to submit, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file to submit, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sitemaps.submit'],
@@ -1288,8 +1310,8 @@ class GscMcpRuntime {
         title: 'Delete sitemap',
         description: 'Remove/delete a submitted sitemap from your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file to delete, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file to delete, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sitemaps.delete'],
@@ -1312,8 +1334,8 @@ class GscMcpRuntime {
         title: 'Get sitemap details',
         description: 'Get status and details of a single sitemap submitted to Google Search Console.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: { sitemap: SITEMAP_OUTPUT_SCHEMA },
         annotations: READ_ONLY_ANNOTATIONS,
@@ -1331,7 +1353,7 @@ class GscMcpRuntime {
       {
         title: 'Identify SEO Quick Wins',
         description: 'Find observed query/page Search Analytics rows with at least the requested impressions whose average position falls in a configurable opportunity range (8-20 by default). Average position is an aggregate Search Console metric, not a literal current rank; CTR is returned for context and is not an eligibility filter. Results are ordered deterministically by impressions, then bounded with limit/start_row and explicit result_page metadata. Source pagination separately flags the local 100,000-row safety ceiling.',
-        inputSchema: createQuickWinsInputSchema(SITE_URL_DESCRIPTION),
+        inputSchema: createQuickWinsInputSchema(),
         outputSchema: z.object(QUICK_WIN_OUTPUT_SCHEMA),
         annotations: READ_ONLY_ANNOTATIONS,
       },
@@ -1365,7 +1387,7 @@ class GscMcpRuntime {
         title: 'Detect Keyword Cannibalization',
         description: 'Analyze query/page Search Analytics to find queries split across multiple pages. Candidates are ranked deterministically by the observed query/page impression sum, each candidate bounds its page list, and limit/start_row plus result_page provide safe pagination. total_clicks, total_impressions, and impression_share are calculated from observed query/page rows and are not true query-level property aggregates; multiple pages can make that row sum exceed the query-level Search Console total. Multiple ranking URLs can also reflect legitimate locale or intent differences, so treat candidates as evidence to investigate rather than proof of harmful cannibalization.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
           min_impressions: CANNIBALIZATION_MIN_IMPRESSIONS_SCHEMA,
@@ -1423,7 +1445,7 @@ class GscMcpRuntime {
         title: 'Detect Content Decay',
         description: 'Assess page-level click declines across two contiguous periods without treating every small click change as content decay. Each result is classified as likely_decay, weak_insufficient_evidence, or improving_visibility_with_click_volatility using deterministic click-volume, impression, and average-position signals. This is a heuristic assessment, not statistical proof. Results are bounded with limit/start_row; source pagination is reported separately.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           compare_days: CONTENT_DECAY_COMPARE_DAYS_SCHEMA,
           limit: ANALYSIS_RESULT_LIMIT_SCHEMA,
           start_row: RESULT_START_ROW_SCHEMA,
@@ -1497,7 +1519,7 @@ class GscMcpRuntime {
         title: 'Request Indexing',
         description: "Requests indexing through Google's Indexing API for a URL within an owner-level Search Console property accessible to the connected Google account. Google currently restricts this API to pages containing JobPosting structured data or livestream pages containing BroadcastEvent inside VideoObject. It is not available for general webpage submission.",
         inputSchema: {
-          site_url: z.string().describe(`${SITE_URL_DESCRIPTION} The connected Google account must be an owner of this property.`),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA.describe(`${SEARCH_CONSOLE_PROPERTY_DESCRIPTION} The connected Google account must be an owner of this property.`),
           url: z.string().superRefine((value, ctx) => {
             try {
               assertIndexingRequestUrl(value);
@@ -1535,7 +1557,7 @@ class GscMcpRuntime {
         title: 'List Search-Visible Pages',
         description: `${SEARCH_VISIBLE_PAGES_DESCRIPTION} When one date boundary is omitted, the server derives the other to target an inclusive 30-day range; generated end dates are capped at the latest complete date. Responses are bounded and pageable with row_limit/start_row.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.optional().describe('Start date (inclusive) in YYYY-MM-DD format. If end_date is omitted, the generated end date is 29 days later, capped at the latest complete date.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.optional().describe('End date (inclusive) in YYYY-MM-DD format. If start_date is omitted, the generated start date is 29 days earlier. Defaults to 3 days ago. Note the 2-3 day data lag.'),
           row_limit: z.number().int().min(1).max(25000).default(1000).describe(`Maximum pages requested for this logical response (1-25000). Output is safely bounded; continue with result_page.next_start_row while result_page.has_more is true.`),
@@ -1595,7 +1617,7 @@ class GscMcpRuntime {
         title: 'Compare Performance Between Periods',
         description: 'Compare Search Console performance metrics (clicks, impressions, CTR, average position) between two distinct date ranges (Period A vs Period B) for a selected dimension (query, page, country, device). Apply the same search type and optional dimension filters to both periods. Results are ranked by largest absolute click change, then impression change, and safely paged with limit/start_row. Percentage change is null when the baseline is zero and the comparison value differs. Discover is intentionally unavailable because this comparison contract includes average position, which the Discover report does not support.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date_a: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date of Period A (recent, YYYY-MM-DD)'),
           end_date_a: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date of Period A (recent, YYYY-MM-DD)'),
           start_date_b: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date of Period B (previous, YYYY-MM-DD)'),
@@ -1701,7 +1723,7 @@ class GscMcpRuntime {
         description:
           'Generate a plain-language weekly SEO report for one Google Search Console property. Returns a markdown digest covering the 7 days ending on end_date, with week-over-week comparison, top pages, queries gaining or losing traction, and one specific action item. Defaults end_date to 3 days ago so the report uses the latest usually-complete Search Console data; pass end_date explicitly to include fresher preliminary data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           end_date: SEARCH_CONSOLE_DATE_SCHEMA
             .optional()
             .describe('End date (inclusive) in YYYY-MM-DD format. Defaults to 3 days ago, which is usually the latest complete Search Console date. Pass a more recent date explicitly to include preliminary data.'),

package/src/quick-wins-schema.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { SEARCH_CONSOLE_DATE_SCHEMA } from './date-validation';
+import { SEARCH_CONSOLE_PROPERTY_SCHEMA } from './search-console-property-schema';
 import {
   DEFAULT_ANALYSIS_RESULT_LIMIT,
   MAX_ANALYSIS_RESULT_LIMIT,
@@ -16,10 +17,10 @@ const QUICK_WINS_THRESHOLDS_SHAPE = {
   max_position: z.number().positive().default(20).describe('Maximum Search Console average position for the opportunity range (inclusive). This is an aggregate metric, not a literal current rank. Must be greater than 0. Default is 20.'),
 };
 
-export function createQuickWinsInputSchema(siteUrlDescription: string) {
+export function createQuickWinsInputSchema() {
   return z
     .object({
-      site_url: z.string().describe(siteUrlDescription),
+      site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
       start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
       end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
       ...QUICK_WINS_THRESHOLDS_SHAPE,

package/src/search-console-property-schema.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+
+export const SEARCH_CONSOLE_PROPERTY_DESCRIPTION =
+  "The Search Console property identifier, exactly as returned by sites.list. Domain properties use 'sc-domain:example.com'; URL-prefix properties use an HTTP or HTTPS URL, typically including the trailing slash, e.g. 'https://www.example.com/'. Passing the wrong property form can return a permission error even when the user owns the site - call sites.list first if unsure.";
+
+function isDomainPropertyIdentifier(value: string): boolean {
+  if (!value.startsWith('sc-domain:')) return false;
+  const domain = value.slice('sc-domain:'.length);
+  return (
+    domain.length > 0 &&
+    !/\s/.test(domain) &&
+    !domain.includes('/') &&
+    !domain.includes('?') &&
+    !domain.includes('#') &&
+    !domain.includes('@') &&
+    !domain.includes(':')
+  );
+}
+
+function isUrlPrefixPropertyIdentifier(value: string): boolean {
+  if (value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const parsed = new URL(value);
+    return (
+      (parsed.protocol === 'http:' || parsed.protocol === 'https:') &&
+      parsed.hostname.length > 0 &&
+      parsed.username === '' &&
+      parsed.password === ''
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function isSearchConsolePropertyIdentifier(value: string): boolean {
+  return isDomainPropertyIdentifier(value) || isUrlPrefixPropertyIdentifier(value);
+}
+
+export const SEARCH_CONSOLE_PROPERTY_SCHEMA = z
+  .string()
+  .refine(isSearchConsolePropertyIdentifier, {
+    message:
+      "Expected a Search Console property identifier such as 'sc-domain:example.com' or an HTTP/HTTPS URL-prefix property such as 'https://www.example.com/'.",
+  })
+  .describe(SEARCH_CONSOLE_PROPERTY_DESCRIPTION);

package/src/sitemap-url-schema.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+
+export const SITEMAP_URL_SCHEMA = z
+  .string()
+  .url()
+  .refine((value) => {
+    try {
+      const protocol = new URL(value).protocol;
+      return protocol === 'http:' || protocol === 'https:';
+    } catch {
+      return false;
+    }
+  }, 'Sitemap URL must use http:// or https://.');