@digestseo/mcp-gsc 0.4.33 → 0.4.34

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.34] - 2026-09-24
+
+### Fixed
+- `analytics.query` now rejects documented-invalid cross-field request combinations before reserving local Search Analytics safety budget or resolving Google credentials, while retaining the lower-level provider compatibility guard for internal callers.
+- `indexing.status`, `indexing.request`, and `indexing.remove` now reject URLs outside the supplied Search Console property before reserving local safety budget, resolving Google credentials, or calling Search Console for owner authorization.
+
 ## [0.4.33] - 2026-09-24
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.33",
+  "version": "0.4.34",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {

package/src/index.ts

@@ -34,6 +34,7 @@ import {
   getIndexingNotificationMetadata,
   processPerformanceComparison,
   assertSearchAnalyticsFilterCompatible,
+  assertSearchAnalyticsQueryCompatible,
   type PaginatedSearchAnalyticsResult,
 } from './google';
 import {
@@ -1387,12 +1388,8 @@ class GscMcpRuntime {
         dimension_filter_groups,
       }) => {
         assertDateRange(start_date, end_date);
-        const googleId = this.requireGoogleId();
-        const rateLimitError = await this.rateLimitError(googleId, 'analytics.query');
-        if (rateLimitError) return rateLimitError;
-        const accessToken = await this.getAccessToken(googleId);
         const sourceRowLimit = Math.min(row_limit, MAX_DIRECT_SOURCE_ROWS);
-        const response = await querySearchAnalytics(accessToken, site_url, {
+        const query = {
           startDate: start_date,
           endDate: end_date,
           dimensions,
@@ -1404,7 +1401,13 @@ class GscMcpRuntime {
           ...(dimension_filter_groups !== undefined
             ? { dimensionFilterGroups: dimension_filter_groups }
             : {}),
-        });
+        };
+        assertSearchAnalyticsQueryCompatible(query);
+        const googleId = this.requireGoogleId();
+        const rateLimitError = await this.rateLimitError(googleId, 'analytics.query');
+        if (rateLimitError) return rateLimitError;
+        const accessToken = await this.getAccessToken(googleId);
+        const response = await querySearchAnalytics(accessToken, site_url, query);
         // Search Analytics pagination is complete only after Google returns an
         // explicit empty page. A short non-empty page can still be followed by
         // later rows, so preserve a continuation for dimensioned queries.
@@ -1957,6 +1960,7 @@ class GscMcpRuntime {
         annotations: READ_ONLY_ANNOTATIONS,
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.status');
         if (rateLimitError) return rateLimitError;
@@ -2000,6 +2004,7 @@ class GscMcpRuntime {
         annotations: WRITE_TOOL_ANNOTATIONS['indexing.request'],
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.request');
         if (rateLimitError) return rateLimitError;
@@ -2041,6 +2046,7 @@ class GscMcpRuntime {
         annotations: WRITE_TOOL_ANNOTATIONS['indexing.remove'],
       },
       async ({ site_url, url }) => {
+        assertUrlWithinSearchConsoleProperty(url, site_url);
         const googleId = this.requireGoogleId();
         const rateLimitError = await this.rateLimitError(googleId, 'indexing.remove');
         if (rateLimitError) return rateLimitError;