@digestseo/mcp-gsc 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.6] - 2026-09-21
+
+### Fixed
+- Package metadata and install guidance now advertise the actual Node.js ranges accepted by bundled runtime dependencies (`^22.18.0 || >=24.11.0`) instead of claiming all Node.js 22+ releases are supported.
+- Indexing API eligibility preflight now recognizes static JSON-LD, Microdata, and RDFa type markup, including schema.org URL type spellings, instead of rejecting otherwise eligible static pages solely because they do not use the narrow JSON-LD form previously detected.
+- URL Inspection now rejects malformed/non-HTTP(S) URLs and URLs outside the supplied Search Console property locally before consuming the server's inspection safety budget or calling Google.
+
+## [0.4.5] - 2026-09-21
+
+### Fixed
+- Search Console property inputs now reject malformed, relative, unsupported-scheme, credential-bearing, and malformed `sc-domain:` identifiers locally across all tools instead of deferring obvious property-identifier errors to Google.
+- Sitemap get/list-filter/submit/delete inputs now reject malformed, relative, and non-HTTP(S) sitemap URLs locally instead of deferring obvious contract errors to Google.
+
 ## [0.4.4] - 2026-09-21
 
 ### Fixed

package/README.md

@@ -89,7 +89,7 @@ Read-write mode requests the Google Search Console read-write and Indexing API s
 
 Large analytics responses are bounded at the MCP boundary instead of being generated and then discarded by clients with structured-content limits. List-style tools expose `start_row` / `next_start_row` where applicable; ranked analytical tools expose `limit`, `start_row`, and `result_page` metadata including `has_more`, `truncated`, and `byte_limit_reached`. Continue paging while `has_more` is true rather than assuming one response is complete.
 
-> **`indexing.request` eligibility.** Google's Indexing API is not a general-purpose page submission tool — as of this writing, Google's own documentation limits it to two content types: pages with `JobPosting` structured data, and livestream pages with `BroadcastEvent` structured data nested inside `VideoObject`. Before submitting, the server fetches the target URL and checks its JSON-LD for one of those two types; if neither is present (or the page can't be fetched), it returns an error explaining why the URL is ineligible instead of calling the Indexing API. A successful submission is only an acknowledgment that Google received the notification — it does not guarantee the URL will be indexed.
+> **`indexing.request` eligibility.** Google's Indexing API is not a general-purpose page submission tool — as of this writing, Google's own documentation limits it to two content types: pages with `JobPosting` structured data, and livestream pages with `BroadcastEvent` structured data nested inside `VideoObject`. Before submitting, the server fetches the target URL and checks static JSON-LD, Microdata, and RDFa markup for one of those two types; if neither is present (or the page can't be fetched), it returns an error explaining why the URL is ineligible instead of calling the Indexing API. Structured data injected only after client-side JavaScript runs cannot be confirmed by this bounded preflight and therefore fails closed. A successful submission is only an acknowledgment that Google received the notification — it does not guarantee the URL will be indexed.
 
 ## What you can ask
 

package/SETUP.md

@@ -10,7 +10,7 @@ By the end you'll have a Worker at `https://<your-worker>.workers.dev/mcp` that
 
 - A [Cloudflare account](https://dash.cloudflare.com/sign-up) (the free Workers plan is enough to start).
 - A [Google account](https://accounts.google.com/) with access to the Search Console properties you want to query.
-- Node.js 22+ and npm. The bundled Wrangler 4 runtime requires Node 22 or newer.
+- Node.js 22.18+ within the 22.x line, or Node.js 24.11+ with npm. The bundled runtime dependency graph includes Babel 8 packages with this stricter Node support range.
 - The Wrangler CLI — installed for you by `npm install`; invoke it with `npx wrangler …`.
 
 Clone and install:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {
@@ -87,6 +87,6 @@
     "vitest": "^4.1.11"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": "^22.18.0 || >=24.11.0"
   }
 }

package/src/google.ts

@@ -985,6 +985,15 @@ const INDEXING_SCOPE_MESSAGE =
   'and livestream pages (BroadcastEvent structured data inside VideoObject). ' +
   'It is not available for general webpage submission.';
 
+function normalizeSchemaType(value: string): string {
+  const trimmed = value.trim().replace(/[\/#]+$/, '');
+  const schemaUrl = trimmed.match(
+    /^https?:\/\/(?:www\.)?schema\.org\/([^/?#\s]+)$/i,
+  );
+  if (schemaUrl) return schemaUrl[1];
+  return trimmed;
+}
+
 function collectSchemaTypes(node: unknown, types: Set<string>): void {
   if (Array.isArray(node)) {
     for (const item of node) collectSchemaTypes(item, types);
@@ -993,9 +1002,11 @@ function collectSchemaTypes(node: unknown, types: Set<string>): void {
   if (!node || typeof node !== 'object') return;
   const obj = node as Record<string, unknown>;
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   for (const [key, value] of Object.entries(obj)) {
     if (key === '@type') continue;
@@ -1010,9 +1021,11 @@ function containsBroadcastEvent(node: unknown): boolean {
   const obj = node as Record<string, unknown>;
   const types = new Set<string>();
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   if (types.has('BroadcastEvent')) return true;
   return Object.values(obj).some(containsBroadcastEvent);
@@ -1025,14 +1038,134 @@ function hasEligibleVideoBroadcast(node: unknown): boolean {
   const obj = node as Record<string, unknown>;
   const types = new Set<string>();
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   if (types.has('VideoObject') && containsBroadcastEvent(obj)) return true;
   return Object.values(obj).some(hasEligibleVideoBroadcast);
 }
 
+const VOID_HTML_TAGS = new Set([
+  'area',
+  'base',
+  'br',
+  'col',
+  'embed',
+  'hr',
+  'img',
+  'input',
+  'link',
+  'meta',
+  'param',
+  'source',
+  'track',
+  'wbr',
+]);
+
+function htmlAttribute(attributes: string, name: string): string | undefined {
+  const pattern = new RegExp(
+    `\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'=<>]+))`,
+    'i',
+  );
+  const match = pattern.exec(attributes);
+  return match?.[1] ?? match?.[2] ?? match?.[3];
+}
+
+function isSchemaVocabulary(value: string | undefined): boolean {
+  return Boolean(value && /^https?:\/\/(?:www\.)?schema\.org\/?$/i.test(value.trim()));
+}
+
+function explicitSchemaType(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (/^https?:\/\/(?:www\.)?schema\.org\//i.test(trimmed)) {
+    return normalizeSchemaType(trimmed);
+  }
+  return undefined;
+}
+
+function htmlStructuredTypes(
+  attributes: string,
+  schemaVocabularyInScope: boolean,
+): Set<string> {
+  const types = new Set<string>();
+
+  const itemType = htmlAttribute(attributes, 'itemtype');
+  if (itemType) {
+    for (const token of itemType.split(/\s+/)) {
+      const normalized = explicitSchemaType(token);
+      if (normalized) types.add(normalized);
+    }
+  }
+
+  const rdfaType = htmlAttribute(attributes, 'typeof');
+  if (rdfaType) {
+    for (const token of rdfaType.split(/\s+/)) {
+      const explicit = explicitSchemaType(token);
+      if (explicit) types.add(explicit);
+      else if (schemaVocabularyInScope && token.trim()) {
+        types.add(normalizeSchemaType(token));
+      }
+    }
+  }
+
+  return types;
+}
+
+/**
+ * Recognize static Microdata/RDFa eligibility without turning this preflight
+ * into a general-purpose HTML validator. The stack is only used to enforce
+ * Google's VideoObject -> BroadcastEvent nesting requirement.
+ */
+function hasEligibleHtmlStructuredData(html: string): boolean {
+  const staticMarkup = html
+    .replace(/<!--(?:[\s\S]*?)-->/g, '')
+    .replace(/<(script|style|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, '');
+  const stack: Array<{
+    tag: string;
+    schemaVocabulary: boolean;
+    videoObjectInScope: boolean;
+  }> = [];
+  const tagPattern = /<\s*(\/?)\s*([a-zA-Z][\w:-]*)([^>]*)>/g;
+  let match: RegExpExecArray | null;
+
+  while ((match = tagPattern.exec(staticMarkup)) !== null) {
+    const closing = match[1] === '/';
+    const tag = match[2].toLowerCase();
+    const attributes = match[3];
+
+    if (closing) {
+      for (let index = stack.length - 1; index >= 0; index -= 1) {
+        if (stack[index].tag === tag) {
+          stack.length = index;
+          break;
+        }
+      }
+      continue;
+    }
+
+    const parent = stack.at(-1);
+    const schemaVocabulary =
+      isSchemaVocabulary(htmlAttribute(attributes, 'vocab')) ||
+      parent?.schemaVocabulary === true;
+    const types = htmlStructuredTypes(attributes, schemaVocabulary);
+    if (types.has('JobPosting')) return true;
+
+    const videoObjectInScope =
+      types.has('VideoObject') || parent?.videoObjectInScope === true;
+    if (types.has('BroadcastEvent') && videoObjectInScope) return true;
+
+    const selfClosing = /\/\s*$/.test(attributes);
+    if (!selfClosing && !VOID_HTML_TAGS.has(tag)) {
+      stack.push({ tag, schemaVocabulary, videoObjectInScope });
+    }
+  }
+
+  return false;
+}
+
 export interface IndexingEligibility {
   eligible: boolean;
   reason?: string;
@@ -1112,9 +1245,9 @@ async function readBoundedResponseText(response: Response): Promise<string> {
 /**
  * Checks whether `url` carries the structured data Google's Indexing API
  * currently supports (JobPosting, or BroadcastEvent nested in VideoObject),
- * by inspecting its JSON-LD. Best-effort: if the page can't be fetched or
- * parsed, eligibility can't be confirmed and the URL is treated as
- * ineligible rather than silently submitted.
+ * by inspecting static JSON-LD, Microdata, and RDFa markup. Best-effort: if
+ * the page can't be fetched or parsed, eligibility can't be confirmed and the
+ * URL is treated as ineligible rather than silently submitted.
  */
 export async function checkIndexingEligibility(
   url: string,
@@ -1193,7 +1326,8 @@ export async function checkIndexingEligibility(
 
   const types = new Set<string>();
   let hasVideoBroadcast = false;
-  const scriptPattern = /<script[^>]+type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi;
+  const scriptPattern =
+    /<script\b[^>]*\btype\s*=\s*(?:"application\/ld\+json"|'application\/ld\+json'|application\/ld\+json)[^>]*>([\s\S]*?)<\/script>/gi;
   let match: RegExpExecArray | null;
   while ((match = scriptPattern.exec(html)) !== null) {
     try {
@@ -1205,7 +1339,11 @@ export async function checkIndexingEligibility(
     }
   }
 
-  if (types.has('JobPosting') || hasVideoBroadcast) {
+  if (
+    types.has('JobPosting') ||
+    hasVideoBroadcast ||
+    hasEligibleHtmlStructuredData(html)
+  ) {
     return { eligible: true };
   }
 

package/src/index.ts

@@ -56,6 +56,11 @@ import {
 import { CONTENT_DECAY_COMPARE_DAYS_SCHEMA } from './content-decay-schema';
 import { resolveIndexedPagesDateRange } from './indexed-pages-range';
 import { createQuickWinsInputSchema } from './quick-wins-schema';
+import { SITEMAP_URL_SCHEMA } from './sitemap-url-schema';
+import {
+  SEARCH_CONSOLE_PROPERTY_DESCRIPTION,
+  SEARCH_CONSOLE_PROPERTY_SCHEMA,
+} from './search-console-property-schema';
 import { WRITE_TOOL_ANNOTATIONS } from './write-tool-annotations';
 import {
   getToolCatalogForAccessMode,
@@ -65,6 +70,7 @@ import {
 import {
   assertIndexingRequestUrl,
   assertIndexingUrlAuthorized,
+  assertUrlWithinSearchConsoleProperty,
 } from './indexing-property-authorization';
 import {
   DEFAULT_ANALYSIS_RESULT_LIMIT,
@@ -104,9 +110,6 @@ const READ_ONLY_ANNOTATIONS = {
   openWorldHint: true,
 } as const;
 
-const SITE_URL_DESCRIPTION =
-  "The Search Console property identifier, exactly as returned by sites.list. Two formats exist: domain properties use 'sc-domain:example.com'; URL-prefix properties use the full URL including protocol and trailing slash, e.g. 'https://www.example.com/'. Passing the wrong format returns a permission error even when the user owns the site — call sites.list first if unsure.";
-
 const METRIC_OUTPUT_SCHEMA = {
   clicks: z.number(),
   impressions: z.number(),
@@ -586,7 +589,7 @@ const TOOL_CATALOG = [
   {
     name: 'indexing.request',
     description:
-      'Request Google to index or update a URL using the Google Indexing API.',
+      'Request an eligible JobPosting or livestream URL update through Google\'s restricted Indexing API; this is not a general webpage submission tool.',
   },
   {
     name: 'indexing.list_pages',
@@ -720,7 +723,7 @@ class GscMcpRuntime {
         description:
           "Retrieve one exact Google Search Console property and the connected account's permission level for it. Use this when the user has already named a property and you need to confirm that exact property or its access level without listing every property first.",
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: SITE_DETAIL_OUTPUT_SCHEMA,
         annotations: READ_ONLY_ANNOTATIONS,
@@ -739,7 +742,7 @@ class GscMcpRuntime {
         title: 'Inspect URL index status',
         description: `Inspect the version of a single URL currently known in Google's index. Returns Google's index-status analysis, last crawl, page-fetch/indexing state, canonicals, and rich-results/AMP analysis where available. This API does not test the live URL or prove current live-page indexability, and its mobile-usability result is deprecated. Use this when the user asks 'is X indexed?' or wants Google's indexed-state evidence for one page. For a bounded group of 2-10 URLs, prefer urls.inspect_many; Google still processes one URL Inspection request per URL and applies the same quota semantics.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           inspection_url: z
             .string()
             .describe(
@@ -757,6 +760,11 @@ class GscMcpRuntime {
       },
       async ({ site_url, inspection_url, language_code }) => {
         const googleId = this.requireGoogleId();
+        assertUrlWithinSearchConsoleProperty(
+          inspection_url,
+          site_url,
+          'inspection_url',
+        );
         const rateLimitError = await this.rateLimitError(googleId, 'urls.inspect');
         if (rateLimitError) return rateLimitError;
         const accessToken = await this.getAccessToken(googleId);
@@ -779,7 +787,7 @@ class GscMcpRuntime {
         title: 'Inspect multiple URLs',
         description: `Inspect the versions of up to 10 URLs currently known in Google's index from one Search Console property. This API does not run live URL tests. Google still processes one URL Inspection request per URL, so every requested URL consumes one quota unit and one unit of this server's shared URL-inspection safety budget. Requests are sent sequentially to avoid unnecessary bursts. Use this for a small group of important or debugging-target URLs; do not use it to crawl an entire site.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           inspection_urls: z
             .array(z.string().url())
             .min(1)
@@ -799,6 +807,13 @@ class GscMcpRuntime {
       },
       async ({ site_url, inspection_urls, language_code }) => {
         const googleId = this.requireGoogleId();
+        for (const inspectionUrl of inspection_urls) {
+          assertUrlWithinSearchConsoleProperty(
+            inspectionUrl,
+            site_url,
+            'inspection_url',
+          );
+        }
         const rateLimitError = await this.rateLimitError(
           googleId,
           'urls.inspect_many',
@@ -842,10 +857,8 @@ class GscMcpRuntime {
         description:
           'List sitemaps submitted for a Search Console property. Optionally filter to entries included by one sitemap index. Returns sitemap URLs, last submitted/downloaded dates, submitted URL counts, warning and error counts, and sitemap status. Google\'s deprecated sitemap indexed count is intentionally omitted. Use this when the user asks about sitemap health, submission status, wants to audit which sitemaps are working, or needs the child sitemaps belonging to a specific sitemap index.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          sitemap_index: z
-            .string()
-            .url()
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          sitemap_index: SITEMAP_URL_SCHEMA
             .optional()
             .describe(
               'Optional sitemap index URL. When supplied, Google returns sitemap entries included in that index.',
@@ -928,7 +941,7 @@ class GscMcpRuntime {
           '  non-preliminary data.',
         ].join('\n'),
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe(
             'End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day data lag: the most recent complete date is usually 3 days ago.',
@@ -1086,7 +1099,7 @@ class GscMcpRuntime {
         title: 'Find queries for a page',
         description: 'For one exact page URL, return the Search Console queries that produced impressions for it over a date range. This wraps an exact page dimension filter so agents do not need to construct analytics.query filter groups manually. Exact page matching is case-sensitive in Search Console. Use row_limit and start_row to page through bounded results; Search Console can still omit anonymized queries. Google Discover is intentionally unavailable because Discover does not expose query data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           page_url: z.string().url().describe('Exact fully-qualified page URL to filter on, e.g. https://example.com/guides/seo/. Search Console exact page filters are case-sensitive.'),
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
@@ -1164,7 +1177,7 @@ class GscMcpRuntime {
         title: 'Find pages for a query',
         description: 'For one exact search query, return the site pages that received impressions for it over a date range. This wraps an exact query dimension filter so agents do not need to construct analytics.query filter groups manually. Exact query matching is case-sensitive in Search Console. Use row_limit and start_row to page through bounded results and verify which URL Google is surfacing before diagnosing cannibalization or content targeting. Google Discover is intentionally unavailable because Discover does not expose query data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           query: z.string().min(1).describe('Exact Search Console query text to filter on. Exact query filters are case-sensitive.'),
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
@@ -1243,7 +1256,7 @@ class GscMcpRuntime {
         title: 'Add Search Console property',
         description: 'Add a new website property to your Google Search Console account. Note: Domain properties require sc-domain prefix (e.g., sc-domain:example.com), URL-prefix properties require full URL (e.g., https://example.com/).',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sites.add'],
@@ -1265,7 +1278,7 @@ class GscMcpRuntime {
         title: 'Delete Search Console property',
         description: 'Remove an existing website property from your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sites.delete'],
@@ -1287,8 +1300,8 @@ class GscMcpRuntime {
         title: 'Submit sitemap',
         description: 'Submit a new sitemap to your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file to submit, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file to submit, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sitemaps.submit'],
@@ -1310,8 +1323,8 @@ class GscMcpRuntime {
         title: 'Delete sitemap',
         description: 'Remove/delete a submitted sitemap from your Google Search Console account.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file to delete, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file to delete, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: MESSAGE_OUTPUT_SCHEMA,
         annotations: WRITE_TOOL_ANNOTATIONS['sitemaps.delete'],
@@ -1334,8 +1347,8 @@ class GscMcpRuntime {
         title: 'Get sitemap details',
         description: 'Get status and details of a single sitemap submitted to Google Search Console.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
-          feedpath: z.string().describe('The full URL of the sitemap file, e.g. https://example.com/sitemap.xml'),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
+          feedpath: SITEMAP_URL_SCHEMA.describe('The full HTTP/HTTPS URL of the sitemap file, e.g. https://example.com/sitemap.xml'),
         },
         outputSchema: { sitemap: SITEMAP_OUTPUT_SCHEMA },
         annotations: READ_ONLY_ANNOTATIONS,
@@ -1353,7 +1366,7 @@ class GscMcpRuntime {
       {
         title: 'Identify SEO Quick Wins',
         description: 'Find observed query/page Search Analytics rows with at least the requested impressions whose average position falls in a configurable opportunity range (8-20 by default). Average position is an aggregate Search Console metric, not a literal current rank; CTR is returned for context and is not an eligibility filter. Results are ordered deterministically by impressions, then bounded with limit/start_row and explicit result_page metadata. Source pagination separately flags the local 100,000-row safety ceiling.',
-        inputSchema: createQuickWinsInputSchema(SITE_URL_DESCRIPTION),
+        inputSchema: createQuickWinsInputSchema(),
         outputSchema: z.object(QUICK_WIN_OUTPUT_SCHEMA),
         annotations: READ_ONLY_ANNOTATIONS,
       },
@@ -1387,7 +1400,7 @@ class GscMcpRuntime {
         title: 'Detect Keyword Cannibalization',
         description: 'Analyze query/page Search Analytics to find queries split across multiple pages. Candidates are ranked deterministically by the observed query/page impression sum, each candidate bounds its page list, and limit/start_row plus result_page provide safe pagination. total_clicks, total_impressions, and impression_share are calculated from observed query/page rows and are not true query-level property aggregates; multiple pages can make that row sum exceed the query-level Search Console total. Multiple ranking URLs can also reflect legitimate locale or intent differences, so treat candidates as evidence to investigate rather than proof of harmful cannibalization.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
           min_impressions: CANNIBALIZATION_MIN_IMPRESSIONS_SCHEMA,
@@ -1445,7 +1458,7 @@ class GscMcpRuntime {
         title: 'Detect Content Decay',
         description: 'Assess page-level click declines across two contiguous periods without treating every small click change as content decay. Each result is classified as likely_decay, weak_insufficient_evidence, or improving_visibility_with_click_volatility using deterministic click-volume, impression, and average-position signals. This is a heuristic assessment, not statistical proof. Results are bounded with limit/start_row; source pagination is reported separately.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           compare_days: CONTENT_DECAY_COMPARE_DAYS_SCHEMA,
           limit: ANALYSIS_RESULT_LIMIT_SCHEMA,
           start_row: RESULT_START_ROW_SCHEMA,
@@ -1519,7 +1532,7 @@ class GscMcpRuntime {
         title: 'Request Indexing',
         description: "Requests indexing through Google's Indexing API for a URL within an owner-level Search Console property accessible to the connected Google account. Google currently restricts this API to pages containing JobPosting structured data or livestream pages containing BroadcastEvent inside VideoObject. It is not available for general webpage submission.",
         inputSchema: {
-          site_url: z.string().describe(`${SITE_URL_DESCRIPTION} The connected Google account must be an owner of this property.`),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA.describe(`${SEARCH_CONSOLE_PROPERTY_DESCRIPTION} The connected Google account must be an owner of this property.`),
           url: z.string().superRefine((value, ctx) => {
             try {
               assertIndexingRequestUrl(value);
@@ -1557,7 +1570,7 @@ class GscMcpRuntime {
         title: 'List Search-Visible Pages',
         description: `${SEARCH_VISIBLE_PAGES_DESCRIPTION} When one date boundary is omitted, the server derives the other to target an inclusive 30-day range; generated end dates are capped at the latest complete date. Responses are bounded and pageable with row_limit/start_row.`,
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date: SEARCH_CONSOLE_DATE_SCHEMA.optional().describe('Start date (inclusive) in YYYY-MM-DD format. If end_date is omitted, the generated end date is 29 days later, capped at the latest complete date.'),
           end_date: SEARCH_CONSOLE_DATE_SCHEMA.optional().describe('End date (inclusive) in YYYY-MM-DD format. If start_date is omitted, the generated start date is 29 days earlier. Defaults to 3 days ago. Note the 2-3 day data lag.'),
           row_limit: z.number().int().min(1).max(25000).default(1000).describe(`Maximum pages requested for this logical response (1-25000). Output is safely bounded; continue with result_page.next_start_row while result_page.has_more is true.`),
@@ -1617,7 +1630,7 @@ class GscMcpRuntime {
         title: 'Compare Performance Between Periods',
         description: 'Compare Search Console performance metrics (clicks, impressions, CTR, average position) between two distinct date ranges (Period A vs Period B) for a selected dimension (query, page, country, device). Apply the same search type and optional dimension filters to both periods. Results are ranked by largest absolute click change, then impression change, and safely paged with limit/start_row. Percentage change is null when the baseline is zero and the comparison value differs. Discover is intentionally unavailable because this comparison contract includes average position, which the Discover report does not support.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           start_date_a: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date of Period A (recent, YYYY-MM-DD)'),
           end_date_a: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date of Period A (recent, YYYY-MM-DD)'),
           start_date_b: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date of Period B (previous, YYYY-MM-DD)'),
@@ -1723,7 +1736,7 @@ class GscMcpRuntime {
         description:
           'Generate a plain-language weekly SEO report for one Google Search Console property. Returns a markdown digest covering the 7 days ending on end_date, with week-over-week comparison, top pages, queries gaining or losing traction, and one specific action item. Defaults end_date to 3 days ago so the report uses the latest usually-complete Search Console data; pass end_date explicitly to include fresher preliminary data.',
         inputSchema: {
-          site_url: z.string().describe(SITE_URL_DESCRIPTION),
+          site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
           end_date: SEARCH_CONSOLE_DATE_SCHEMA
             .optional()
             .describe('End date (inclusive) in YYYY-MM-DD format. Defaults to 3 days ago, which is usually the latest complete Search Console date. Pass a more recent date explicitly to include preliminary data.'),

package/src/indexing-property-authorization.ts

@@ -76,6 +76,32 @@ function isWithinDomainProperty(target: URL, domain: string): boolean {
   return target.hostname === domain || target.hostname.endsWith(`.${domain}`);
 }
 
+/**
+ * Confirms that a fully-qualified HTTP(S) URL belongs to the supplied Search
+ * Console property. This is shared by URL Inspection and Indexing API guards
+ * so both paths use identical URL-prefix and Domain-property semantics.
+ */
+export function assertUrlWithinSearchConsoleProperty(
+  url: string,
+  siteUrl: string,
+  fieldName = 'url',
+): void {
+  const target = parseHttpUrl(url, fieldName);
+  const normalizedSiteUrl = normalizeSiteUrl(siteUrl);
+
+  if (normalizedSiteUrl.startsWith(DOMAIN_PROPERTY_PREFIX)) {
+    if (isWithinDomainProperty(target, parseDomainProperty(normalizedSiteUrl))) {
+      return;
+    }
+  } else if (isWithinUrlPrefix(target, new URL(normalizedSiteUrl))) {
+    return;
+  }
+
+  throw new Error(
+    `${fieldName} must belong to the site_url Search Console property.`,
+  );
+}
+
 /**
  * Confirms that an Indexing API URL is contained by an owner-level Search
  * Console property available to the authenticated account. URL parsing avoids
@@ -86,7 +112,6 @@ export function assertIndexingUrlAuthorized(
   siteUrl: string,
   sites: SearchConsoleSite[],
 ): void {
-  const target = parseHttpUrl(url, 'url');
   const normalizedSiteUrl = normalizeSiteUrl(siteUrl);
   const authorizedSite = sites.find((site) => {
     if (site.permissionLevel !== SITE_OWNER_PERMISSION) return false;
@@ -103,15 +128,7 @@ export function assertIndexingUrlAuthorized(
     );
   }
 
-  if (normalizedSiteUrl.startsWith(DOMAIN_PROPERTY_PREFIX)) {
-    if (isWithinDomainProperty(target, parseDomainProperty(normalizedSiteUrl))) {
-      return;
-    }
-  } else if (isWithinUrlPrefix(target, new URL(normalizedSiteUrl))) {
-    return;
-  }
-
-  throw new Error('url must belong to the authorized site_url Search Console property.');
+  assertUrlWithinSearchConsoleProperty(url, normalizedSiteUrl);
 }
 
 export function assertIndexingRequestUrl(url: string): void {

package/src/quick-wins-schema.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { SEARCH_CONSOLE_DATE_SCHEMA } from './date-validation';
+import { SEARCH_CONSOLE_PROPERTY_SCHEMA } from './search-console-property-schema';
 import {
   DEFAULT_ANALYSIS_RESULT_LIMIT,
   MAX_ANALYSIS_RESULT_LIMIT,
@@ -16,10 +17,10 @@ const QUICK_WINS_THRESHOLDS_SHAPE = {
   max_position: z.number().positive().default(20).describe('Maximum Search Console average position for the opportunity range (inclusive). This is an aggregate metric, not a literal current rank. Must be greater than 0. Default is 20.'),
 };
 
-export function createQuickWinsInputSchema(siteUrlDescription: string) {
+export function createQuickWinsInputSchema() {
   return z
     .object({
-      site_url: z.string().describe(siteUrlDescription),
+      site_url: SEARCH_CONSOLE_PROPERTY_SCHEMA,
       start_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('Start date (inclusive) in YYYY-MM-DD format.'),
       end_date: SEARCH_CONSOLE_DATE_SCHEMA.describe('End date (inclusive) in YYYY-MM-DD format. Note the 2-3 day GSC data lag.'),
       ...QUICK_WINS_THRESHOLDS_SHAPE,

package/src/search-console-property-schema.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+
+export const SEARCH_CONSOLE_PROPERTY_DESCRIPTION =
+  "The Search Console property identifier, exactly as returned by sites.list. Domain properties use 'sc-domain:example.com'; URL-prefix properties use an HTTP or HTTPS URL, typically including the trailing slash, e.g. 'https://www.example.com/'. Passing the wrong property form can return a permission error even when the user owns the site - call sites.list first if unsure.";
+
+function isDomainPropertyIdentifier(value: string): boolean {
+  if (!value.startsWith('sc-domain:')) return false;
+  const domain = value.slice('sc-domain:'.length);
+  return (
+    domain.length > 0 &&
+    !/\s/.test(domain) &&
+    !domain.includes('/') &&
+    !domain.includes('?') &&
+    !domain.includes('#') &&
+    !domain.includes('@') &&
+    !domain.includes(':')
+  );
+}
+
+function isUrlPrefixPropertyIdentifier(value: string): boolean {
+  if (value !== value.trim() || /\s/.test(value)) return false;
+  try {
+    const parsed = new URL(value);
+    return (
+      (parsed.protocol === 'http:' || parsed.protocol === 'https:') &&
+      parsed.hostname.length > 0 &&
+      parsed.username === '' &&
+      parsed.password === ''
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function isSearchConsolePropertyIdentifier(value: string): boolean {
+  return isDomainPropertyIdentifier(value) || isUrlPrefixPropertyIdentifier(value);
+}
+
+export const SEARCH_CONSOLE_PROPERTY_SCHEMA = z
+  .string()
+  .refine(isSearchConsolePropertyIdentifier, {
+    message:
+      "Expected a Search Console property identifier such as 'sc-domain:example.com' or an HTTP/HTTPS URL-prefix property such as 'https://www.example.com/'.",
+  })
+  .describe(SEARCH_CONSOLE_PROPERTY_DESCRIPTION);

package/src/sitemap-url-schema.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+
+export const SITEMAP_URL_SCHEMA = z
+  .string()
+  .url()
+  .refine((value) => {
+    try {
+      const protocol = new URL(value).protocol;
+      return protocol === 'http:' || protocol === 'https:';
+    } catch {
+      return false;
+    }
+  }, 'Sitemap URL must use http:// or https://.');