@digestseo/mcp-gsc 0.4.32 → 0.4.34

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.34] - 2026-09-24
+
+### Fixed
+- `analytics.query` now rejects documented-invalid cross-field request combinations before reserving local Search Analytics safety budget or resolving Google credentials, while retaining the lower-level provider compatibility guard for internal callers.
+- `indexing.status`, `indexing.request`, and `indexing.remove` now reject URLs outside the supplied Search Console property before reserving local safety budget, resolving Google credentials, or calling Search Console for owner authorization.
+
+## [0.4.33] - 2026-09-24
+
+### Changed
+- `analytics.query` responses now echo the ordered requested `dimensions` and `search_type`, so `rows[].keys` remain self-describing when responses are saved, forwarded, or consumed outside the original request context.
+
+### Fixed
+- `analytics.query` now rejects duplicate grouping dimensions and mixed `searchAppearance` grouping at MCP input validation, before local rate-limit, Google credential, or provider work.
+
 ## [0.4.32] - 2026-09-24
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.32",
+  "version": "0.4.34",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {

package/src/index.ts

@@ -34,6 +34,7 @@ import {
   getIndexingNotificationMetadata,
   processPerformanceComparison,
   assertSearchAnalyticsFilterCompatible,
+  assertSearchAnalyticsQueryCompatible,
   type PaginatedSearchAnalyticsResult,
 } from './google';
 import {
@@ -365,6 +366,24 @@ const SEARCH_ANALYTICS_OUTPUT_SCHEMA = {
   row_count: z.number().int().nonnegative(),
   start_row: z.number().int().nonnegative(),
   rows: z.array(z.object(SEARCH_ROW_OUTPUT_SCHEMA)),
+  dimensions: z
+    .array(
+      z.enum([
+        'query',
+        'page',
+        'country',
+        'device',
+        'date',
+        'hour',
+        'searchAppearance',
+      ]),
+    )
+    .describe(
+      'Ordered labels for rows[].keys. Each key position corresponds to the dimension at the same index. Empty for aggregate dimensions: [] queries.',
+    ),
+  search_type: z
+    .enum(['web', 'image', 'video', 'news', 'discover', 'googleNews'])
+    .describe('The Search Analytics search type requested for this response.'),
   data_state: z.enum(['all', 'final', 'hourly_all']).describe(
     'The Search Analytics dataState requested from Google for this response.',
   ),
@@ -1188,10 +1207,13 @@ class GscMcpRuntime {
         title: 'Query search analytics',
         description: [
           'Query Google Search Console search analytics data. Returns',
-          '{ row_count, start_row, rows, provider_exhaustiveness_guaranteed,',
-          '  provider_note, has_more, truncated, byte_limit_reached }',
+          '{ row_count, start_row, rows, dimensions, search_type,',
+          '  provider_exhaustiveness_guaranteed, provider_note, has_more,',
+          '  truncated, byte_limit_reached }',
           'where dimensioned rows have keys plus clicks, impressions, ctr, and',
-          'position. Aggregate rows from dimensions: [] may omit keys because',
+          'position. The echoed dimensions array labels rows[].keys in order,',
+          'so saved or forwarded responses remain self-describing. Aggregate',
+          'rows from dimensions: [] may omit keys because',
           'Google itself omits that field. When has_more is true, the response',
           'includes next_start_row — pass it back as start_row to fetch the next',
           'safe page. Large requested row_limit values are automatically split',
@@ -1292,6 +1314,20 @@ class GscMcpRuntime {
                 'searchAppearance',
               ]),
             )
+            .superRefine((dimensions, ctx) => {
+              if (new Set(dimensions).size !== dimensions.length) {
+                ctx.addIssue({
+                  code: 'custom',
+                  message: 'Search Analytics dimensions must not contain duplicates.',
+                });
+              }
+              if (dimensions.includes('searchAppearance') && dimensions.length > 1) {
+                ctx.addIssue({
+                  code: 'custom',
+                  message: 'Search Analytics searchAppearance must be the only grouping dimension.',
+                });
+              }
+            })
             .default(['query'])
             .describe(
               "Dimensions to group rows by. Pass [] (empty array) to get a single row of true site-level totals. searchAppearance must be the only grouping dimension; discover an appearance value with ['searchAppearance'], then filter to that value in a separate query when grouping by another dimension. The 'hour' dimension requires data_state 'hourly_all' and an inclusive date range of at most 10 days. Google Discover and Google News do not support the query dimension.",
@@ -1352,12 +1388,8 @@ class GscMcpRuntime {
         dimension_filter_groups,
       }) => {
         assertDateRange(start_date, end_date);
-        const googleId = this.requireGoogleId();
-        const rateLimitError = await this.rateLimitError(googleId, 'analytics.query');
-        if (rateLimitError) return rateLimitError;
-        const accessToken = await this.getAccessToken(googleId);
         const sourceRowLimit = Math.min(row_limit, MAX_DIRECT_SOURCE_ROWS);
-        const response = await querySearchAnalytics(accessToken, site_url, {
+        const query = {
           startDate: start_date,
           endDate: end_date,
           dimensions,
@@ -1369,7 +1401,13 @@ class GscMcpRuntime {
           ...(dimension_filter_groups !== undefined
             ? { dimensionFilterGroups: dimension_filter_groups }
             : {}),
-        });
+        };
+        assertSearchAnalyticsQueryCompatible(query);
+        const googleId = this.requireGoogleId();
+        const rateLimitError = await this.rateLimitError(googleId, 'analytics.query');
+        if (rateLimitError) return rateLimitError;
+        const accessToken = await this.getAccessToken(googleId);
+        const response = await querySearchAnalytics(accessToken, site_url, query);
         // Search Analytics pagination is complete only after Google returns an
         // explicit empty page. A short non-empty page can still be followed by
         // later rows, so preserve a continuation for dimensioned queries.
@@ -1386,6 +1424,8 @@ class GscMcpRuntime {
           row_count: bounded.items.length,
           start_row,
           rows: bounded.items,
+          dimensions,
+          search_type,
           data_state,
           preliminary_data_possible: data_state !== 'final',
           position_supported:
@@ -1920,6 +1960,7 @@ class GscMcpRuntime {
         annotations: READ_ONLY_ANNOTATIONS,
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.status');
         if (rateLimitError) return rateLimitError;
@@ -1963,6 +2004,7 @@ class GscMcpRuntime {
         annotations: WRITE_TOOL_ANNOTATIONS['indexing.request'],
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.request');
         if (rateLimitError) return rateLimitError;
@@ -2004,6 +2046,7 @@ class GscMcpRuntime {
         annotations: WRITE_TOOL_ANNOTATIONS['indexing.remove'],
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.remove');
         if (rateLimitError) return rateLimitError;