@digestseo/mcp-gsc 0.4.5 → 0.4.6

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.6] - 2026-09-21
+
+### Fixed
+- Package metadata and install guidance now advertise the actual Node.js ranges accepted by bundled runtime dependencies (`^22.18.0 || >=24.11.0`) instead of claiming all Node.js 22+ releases are supported.
+- Indexing API eligibility preflight now recognizes static JSON-LD, Microdata, and RDFa type markup, including schema.org URL type spellings, instead of rejecting otherwise eligible static pages solely because they do not use the narrow JSON-LD form previously detected.
+- URL Inspection now rejects malformed/non-HTTP(S) URLs and URLs outside the supplied Search Console property locally before consuming the server's inspection safety budget or calling Google.
+
 ## [0.4.5] - 2026-09-21
 
 ### Fixed

package/README.md

@@ -89,7 +89,7 @@ Read-write mode requests the Google Search Console read-write and Indexing API s
 
 Large analytics responses are bounded at the MCP boundary instead of being generated and then discarded by clients with structured-content limits. List-style tools expose `start_row` / `next_start_row` where applicable; ranked analytical tools expose `limit`, `start_row`, and `result_page` metadata including `has_more`, `truncated`, and `byte_limit_reached`. Continue paging while `has_more` is true rather than assuming one response is complete.
 
-> **`indexing.request` eligibility.** Google's Indexing API is not a general-purpose page submission tool — as of this writing, Google's own documentation limits it to two content types: pages with `JobPosting` structured data, and livestream pages with `BroadcastEvent` structured data nested inside `VideoObject`. Before submitting, the server fetches the target URL and checks its JSON-LD for one of those two types; if neither is present (or the page can't be fetched), it returns an error explaining why the URL is ineligible instead of calling the Indexing API. A successful submission is only an acknowledgment that Google received the notification — it does not guarantee the URL will be indexed.
+> **`indexing.request` eligibility.** Google's Indexing API is not a general-purpose page submission tool — as of this writing, Google's own documentation limits it to two content types: pages with `JobPosting` structured data, and livestream pages with `BroadcastEvent` structured data nested inside `VideoObject`. Before submitting, the server fetches the target URL and checks static JSON-LD, Microdata, and RDFa markup for one of those two types; if neither is present (or the page can't be fetched), it returns an error explaining why the URL is ineligible instead of calling the Indexing API. Structured data injected only after client-side JavaScript runs cannot be confirmed by this bounded preflight and therefore fails closed. A successful submission is only an acknowledgment that Google received the notification — it does not guarantee the URL will be indexed.
 
 ## What you can ask
 

package/SETUP.md

@@ -10,7 +10,7 @@ By the end you'll have a Worker at `https://<your-worker>.workers.dev/mcp` that
 
 - A [Cloudflare account](https://dash.cloudflare.com/sign-up) (the free Workers plan is enough to start).
 - A [Google account](https://accounts.google.com/) with access to the Search Console properties you want to query.
-- Node.js 22+ and npm. The bundled Wrangler 4 runtime requires Node 22 or newer.
+- Node.js 22.18+ within the 22.x line, or Node.js 24.11+ with npm. The bundled runtime dependency graph includes Babel 8 packages with this stricter Node support range.
 - The Wrangler CLI — installed for you by `npm install`; invoke it with `npx wrangler …`.
 
 Clone and install:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digestseo/mcp-gsc",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "private": false,
   "main": "scripts/glama-start.mjs",
   "bin": {
@@ -87,6 +87,6 @@
     "vitest": "^4.1.11"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": "^22.18.0 || >=24.11.0"
   }
 }

package/src/google.ts

@@ -985,6 +985,15 @@ const INDEXING_SCOPE_MESSAGE =
   'and livestream pages (BroadcastEvent structured data inside VideoObject). ' +
   'It is not available for general webpage submission.';
 
+function normalizeSchemaType(value: string): string {
+  const trimmed = value.trim().replace(/[\/#]+$/, '');
+  const schemaUrl = trimmed.match(
+    /^https?:\/\/(?:www\.)?schema\.org\/([^/?#\s]+)$/i,
+  );
+  if (schemaUrl) return schemaUrl[1];
+  return trimmed;
+}
+
 function collectSchemaTypes(node: unknown, types: Set<string>): void {
   if (Array.isArray(node)) {
     for (const item of node) collectSchemaTypes(item, types);
@@ -993,9 +1002,11 @@ function collectSchemaTypes(node: unknown, types: Set<string>): void {
   if (!node || typeof node !== 'object') return;
   const obj = node as Record<string, unknown>;
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   for (const [key, value] of Object.entries(obj)) {
     if (key === '@type') continue;
@@ -1010,9 +1021,11 @@ function containsBroadcastEvent(node: unknown): boolean {
   const obj = node as Record<string, unknown>;
   const types = new Set<string>();
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   if (types.has('BroadcastEvent')) return true;
   return Object.values(obj).some(containsBroadcastEvent);
@@ -1025,14 +1038,134 @@ function hasEligibleVideoBroadcast(node: unknown): boolean {
   const obj = node as Record<string, unknown>;
   const types = new Set<string>();
   const type = obj['@type'];
-  if (typeof type === 'string') types.add(type);
+  if (typeof type === 'string') types.add(normalizeSchemaType(type));
   else if (Array.isArray(type)) {
-    for (const t of type) if (typeof t === 'string') types.add(t);
+    for (const t of type) {
+      if (typeof t === 'string') types.add(normalizeSchemaType(t));
+    }
   }
   if (types.has('VideoObject') && containsBroadcastEvent(obj)) return true;
   return Object.values(obj).some(hasEligibleVideoBroadcast);
 }
 
+const VOID_HTML_TAGS = new Set([
+  'area',
+  'base',
+  'br',
+  'col',
+  'embed',
+  'hr',
+  'img',
+  'input',
+  'link',
+  'meta',
+  'param',
+  'source',
+  'track',
+  'wbr',
+]);
+
+function htmlAttribute(attributes: string, name: string): string | undefined {
+  const pattern = new RegExp(
+    `\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'=<>]+))`,
+    'i',
+  );
+  const match = pattern.exec(attributes);
+  return match?.[1] ?? match?.[2] ?? match?.[3];
+}
+
+function isSchemaVocabulary(value: string | undefined): boolean {
+  return Boolean(value && /^https?:\/\/(?:www\.)?schema\.org\/?$/i.test(value.trim()));
+}
+
+function explicitSchemaType(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (/^https?:\/\/(?:www\.)?schema\.org\//i.test(trimmed)) {
+    return normalizeSchemaType(trimmed);
+  }
+  return undefined;
+}
+
+function htmlStructuredTypes(
+  attributes: string,
+  schemaVocabularyInScope: boolean,
+): Set<string> {
+  const types = new Set<string>();
+
+  const itemType = htmlAttribute(attributes, 'itemtype');
+  if (itemType) {
+    for (const token of itemType.split(/\s+/)) {
+      const normalized = explicitSchemaType(token);
+      if (normalized) types.add(normalized);
+    }
+  }
+
+  const rdfaType = htmlAttribute(attributes, 'typeof');
+  if (rdfaType) {
+    for (const token of rdfaType.split(/\s+/)) {
+      const explicit = explicitSchemaType(token);
+      if (explicit) types.add(explicit);
+      else if (schemaVocabularyInScope && token.trim()) {
+        types.add(normalizeSchemaType(token));
+      }
+    }
+  }
+
+  return types;
+}
+
+/**
+ * Recognize static Microdata/RDFa eligibility without turning this preflight
+ * into a general-purpose HTML validator. The stack is only used to enforce
+ * Google's VideoObject -> BroadcastEvent nesting requirement.
+ */
+function hasEligibleHtmlStructuredData(html: string): boolean {
+  const staticMarkup = html
+    .replace(/<!--(?:[\s\S]*?)-->/g, '')
+    .replace(/<(script|style|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, '');
+  const stack: Array<{
+    tag: string;
+    schemaVocabulary: boolean;
+    videoObjectInScope: boolean;
+  }> = [];
+  const tagPattern = /<\s*(\/?)\s*([a-zA-Z][\w:-]*)([^>]*)>/g;
+  let match: RegExpExecArray | null;
+
+  while ((match = tagPattern.exec(staticMarkup)) !== null) {
+    const closing = match[1] === '/';
+    const tag = match[2].toLowerCase();
+    const attributes = match[3];
+
+    if (closing) {
+      for (let index = stack.length - 1; index >= 0; index -= 1) {
+        if (stack[index].tag === tag) {
+          stack.length = index;
+          break;
+        }
+      }
+      continue;
+    }
+
+    const parent = stack.at(-1);
+    const schemaVocabulary =
+      isSchemaVocabulary(htmlAttribute(attributes, 'vocab')) ||
+      parent?.schemaVocabulary === true;
+    const types = htmlStructuredTypes(attributes, schemaVocabulary);
+    if (types.has('JobPosting')) return true;
+
+    const videoObjectInScope =
+      types.has('VideoObject') || parent?.videoObjectInScope === true;
+    if (types.has('BroadcastEvent') && videoObjectInScope) return true;
+
+    const selfClosing = /\/\s*$/.test(attributes);
+    if (!selfClosing && !VOID_HTML_TAGS.has(tag)) {
+      stack.push({ tag, schemaVocabulary, videoObjectInScope });
+    }
+  }
+
+  return false;
+}
+
 export interface IndexingEligibility {
   eligible: boolean;
   reason?: string;
@@ -1112,9 +1245,9 @@ async function readBoundedResponseText(response: Response): Promise<string> {
 /**
  * Checks whether `url` carries the structured data Google's Indexing API
  * currently supports (JobPosting, or BroadcastEvent nested in VideoObject),
- * by inspecting its JSON-LD. Best-effort: if the page can't be fetched or
- * parsed, eligibility can't be confirmed and the URL is treated as
- * ineligible rather than silently submitted.
+ * by inspecting static JSON-LD, Microdata, and RDFa markup. Best-effort: if
+ * the page can't be fetched or parsed, eligibility can't be confirmed and the
+ * URL is treated as ineligible rather than silently submitted.
  */
 export async function checkIndexingEligibility(
   url: string,
@@ -1193,7 +1326,8 @@ export async function checkIndexingEligibility(
 
   const types = new Set<string>();
   let hasVideoBroadcast = false;
-  const scriptPattern = /<script[^>]+type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi;
+  const scriptPattern =
+    /<script\b[^>]*\btype\s*=\s*(?:"application\/ld\+json"|'application\/ld\+json'|application\/ld\+json)[^>]*>([\s\S]*?)<\/script>/gi;
   let match: RegExpExecArray | null;
   while ((match = scriptPattern.exec(html)) !== null) {
     try {
@@ -1205,7 +1339,11 @@ export async function checkIndexingEligibility(
     }
   }
 
-  if (types.has('JobPosting') || hasVideoBroadcast) {
+  if (
+    types.has('JobPosting') ||
+    hasVideoBroadcast ||
+    hasEligibleHtmlStructuredData(html)
+  ) {
     return { eligible: true };
   }
 

package/src/index.ts

@@ -70,6 +70,7 @@ import {
 import {
   assertIndexingRequestUrl,
   assertIndexingUrlAuthorized,
+  assertUrlWithinSearchConsoleProperty,
 } from './indexing-property-authorization';
 import {
   DEFAULT_ANALYSIS_RESULT_LIMIT,
@@ -588,7 +589,7 @@ const TOOL_CATALOG = [
   {
     name: 'indexing.request',
     description:
-      'Request Google to index or update a URL using the Google Indexing API.',
+      'Request an eligible JobPosting or livestream URL update through Google\'s restricted Indexing API; this is not a general webpage submission tool.',
   },
   {
     name: 'indexing.list_pages',
@@ -759,6 +760,11 @@ class GscMcpRuntime {
       },
       async ({ site_url, inspection_url, language_code }) => {
         const googleId = this.requireGoogleId();
+        assertUrlWithinSearchConsoleProperty(
+          inspection_url,
+          site_url,
+          'inspection_url',
+        );
         const rateLimitError = await this.rateLimitError(googleId, 'urls.inspect');
         if (rateLimitError) return rateLimitError;
         const accessToken = await this.getAccessToken(googleId);
@@ -801,6 +807,13 @@ class GscMcpRuntime {
       },
       async ({ site_url, inspection_urls, language_code }) => {
         const googleId = this.requireGoogleId();
+        for (const inspectionUrl of inspection_urls) {
+          assertUrlWithinSearchConsoleProperty(
+            inspectionUrl,
+            site_url,
+            'inspection_url',
+          );
+        }
         const rateLimitError = await this.rateLimitError(
           googleId,
           'urls.inspect_many',

package/src/indexing-property-authorization.ts

@@ -76,6 +76,32 @@ function isWithinDomainProperty(target: URL, domain: string): boolean {
   return target.hostname === domain || target.hostname.endsWith(`.${domain}`);
 }
 
+/**
+ * Confirms that a fully-qualified HTTP(S) URL belongs to the supplied Search
+ * Console property. This is shared by URL Inspection and Indexing API guards
+ * so both paths use identical URL-prefix and Domain-property semantics.
+ */
+export function assertUrlWithinSearchConsoleProperty(
+  url: string,
+  siteUrl: string,
+  fieldName = 'url',
+): void {
+  const target = parseHttpUrl(url, fieldName);
+  const normalizedSiteUrl = normalizeSiteUrl(siteUrl);
+
+  if (normalizedSiteUrl.startsWith(DOMAIN_PROPERTY_PREFIX)) {
+    if (isWithinDomainProperty(target, parseDomainProperty(normalizedSiteUrl))) {
+      return;
+    }
+  } else if (isWithinUrlPrefix(target, new URL(normalizedSiteUrl))) {
+    return;
+  }
+
+  throw new Error(
+    `${fieldName} must belong to the site_url Search Console property.`,
+  );
+}
+
 /**
  * Confirms that an Indexing API URL is contained by an owner-level Search
  * Console property available to the authenticated account. URL parsing avoids
@@ -86,7 +112,6 @@ export function assertIndexingUrlAuthorized(
   siteUrl: string,
   sites: SearchConsoleSite[],
 ): void {
-  const target = parseHttpUrl(url, 'url');
   const normalizedSiteUrl = normalizeSiteUrl(siteUrl);
   const authorizedSite = sites.find((site) => {
     if (site.permissionLevel !== SITE_OWNER_PERMISSION) return false;
@@ -103,15 +128,7 @@ export function assertIndexingUrlAuthorized(
     );
   }
 
-  if (normalizedSiteUrl.startsWith(DOMAIN_PROPERTY_PREFIX)) {
-    if (isWithinDomainProperty(target, parseDomainProperty(normalizedSiteUrl))) {
-      return;
-    }
-  } else if (isWithinUrlPrefix(target, new URL(normalizedSiteUrl))) {
-    return;
-  }
-
-  throw new Error('url must belong to the authorized site_url Search Console property.');
+  assertUrlWithinSearchConsoleProperty(url, normalizedSiteUrl);
 }
 
 export function assertIndexingRequestUrl(url: string): void {