search-console-mcp 1.9.2 → 1.10.0

package/README.md

@@ -1,3 +1,4 @@
+
 # Google Search Console MCP Server
 
 A Model Context Protocol (MCP) server that transforms how you interact with Google Search Console. Stop exporting CSVs and start asking questions.
@@ -6,10 +7,6 @@ A Model Context Protocol (MCP) server that transforms how you interact with Goog
 
 ---
 
-### [🏠 Overview](#) | [🎯 Prompts](#-magic-prompts) | [🚀 Quick Start](#-quick-start) | [🛠️ Tools](#-tools-reference)
-
----
-
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Tests](https://github.com/saurabhsharma2u/search-console-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/saurabhsharma2u/search-console-mcp/actions/workflows/ci.yml)
 
@@ -28,7 +25,6 @@ A Model Context Protocol (MCP) server that transforms how you interact with Goog
 > "Find low-hanging fruit keywords (positions 11-20) with high impressions that I should optimize."
 
 ---
-
 ## 🎯 Magic Prompts
 
 Copy and paste these into your MCP client (Claude Desktop, etc.) to see the intelligence engine in action:
@@ -53,69 +49,62 @@ Copy and paste these into your MCP client (Claude Desktop, etc.) to see the inte
 
 ---
 
-## 🔒 Security & Privacy
+## 🔐 Authentication (Desktop Flow)
+
+Search Console MCP uses a **Secure Desktop Flow**. This provides high-security, professional grade authentication for your Google account:
+- **Multi-Account Support**: Automatically detects and stores separate tokens for different Google accounts based on your email.
+- **System Keychain Primary**: Tokens are stored in your OS's native credential manager (macOS Keychain, Windows Credential Manager, or Linux Secret Service).
+- **AES-256-GCM Hardware-Bound Encryption**: Fallback storage is encrypted with AES-256-GCM using a key derived from your unique hardware machine ID. Tokens stolen from your machine cannot be decrypted on another computer.
+- **Silent Background Refresh**: Tokens auto-refresh silently when they expire.
+
+### 🚀 Step 1 — Initiate Login
+Run the following command to start the authorization process:
+```bash
+npx search-console-mcp setup
+```
+
+The CLI will:
+1. Briefly start a secure local server to handle the redirect.
+2. Open your default web browser to the Google Authorization page.
+3. Automatically fetch your email after authorization to label your credentials securely.
 
-We take your data security seriously. This tool is designed to be **local-first** and **secure by default**.
+### 🔑 Step 2 — Logout & Management
+To wipe your credentials from both the keychain and the disk:
+```bash
+# Logout of the default account
+npx search-console-mcp logout
 
-*   **Credentials Never Logged**: Your Google Service Account keys are used *only* in memory to authenticate with Google APIs. They are never written to disk, logs, or sent to any third-party server.
-*   **Local Execution**: The code runs entirely on your local machine (or wherever you host your MCP server).
-*   **Path Traversal Protection**: The setup wizard implements strict validation for file paths, including null-byte removal, extension enforcement (.json), and size limits (1MB) to prevent unauthorized file access.
-*   **Direct Communication**: All API calls go directly from your machine to Google's servers (`googleapis.com`). There is no middleman or proxy server.
-*   **Open Source**: The code is fully open source. You can audit exactly how your credentials are used in `src/google-client.ts`.
+# Logout of a specific account
+npx search-console-mcp logout user@gmail.com
+```
 
 ---
 
-## Features
+## 🔑 Alternative: Service Account (Advanced)
 
-- **Advanced Analytics**: Query performance data with powerful filters (Regex supported).
-    - *New*: Support for 'News', 'Discover', 'Image' search types.
-    - *New*: 'Fresh' data support for real-time monitoring.
-    - *New*: **Drop Attribution** to identify device-level traffic losses.
-    - *New*: **Time Series Insights** with rolling averages and trend forecasting.
-- **Trend Detection**: Automatically identify rising or falling trends in your traffic.
-- **Anomaly Detection**: Spot unusual spikes or drops that need attention.
-- **Sitemaps Management**: List, submit, and validte sitemaps.
-- **URL Inspection**: Check real-time indexing status and mobile usability.
-- **PageSpeed Insights**: Integrated performance and Core Web Vitals analysis.
-- **Schema Validation**: Validate JSON-LD structured data.
+For server-side environments or automated tasks where interactive login isn't possible, you can use a Google Cloud Service Account.
+
+### Setup:
+1.  **Create Service Account**: Go to the [Google Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts) and create a service account.
+2.  **Generate Key**: Click "Keys" > "Add Key" > "Create new key" (JSON). Download this file.
+3.  **Share Access**: In Google Search Console, add the service account's email address (e.g., `account@project.iam.gserviceaccount.com`) as a user with at least "Full" or "Restricted" permissions.
+4.  **Configure**: Point the server to your key file:
+    ```bash
+    export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/key.json"
+    ```
 
 ---
 
-## Quick Start
 
-### 1. Run the Setup Wizard
-First, use the interactive wizard to validate your credentials and get your configuration:
+## 🛡️ Fort Knox Security
 
-```bash
-npx search-console-mcp-setup
-```
+This MCP server implements a multi-layered security architecture:
 
-The wizard will guide you through:
-- Creating a Google Service Account.
-- Adding the account to Search Console.
-- Validating your JSON key file.
-- Generating the configuration for your MCP client.
-
-### 2. Connect to an MCP Client
-
-**Note:** The server uses `stdio` to communicate. Do not run `npx search-console-mcp` directly in your terminal; it is meant to be run by an MCP client like Claude Desktop or Cursor.
-
-#### Claude Desktop Configuration
-Add this to your `claude_desktop_config.json`:
-
-```json
-{
-  "mcpServers": {
-    "google-search-console": {
-      "command": "npx",
-      "args": ["-y", "search-console-mcp"],
-      "env": {
-        "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/path/to/your/service-account-key.json"
-      }
-    }
-  }
-}
-```
+*   **Keychain Integration**: Primarily uses the **macOS Keychain**, **Windows Credential Manager**, or **libsecret (Linux)** to store tokens.
+*   **Hardware-Bound Vault**: Fallback tokens are stored in `~/.search-console-mcp-tokens.enc` and encrypted with **AES-256-GCM**.
+*   **Machine Fingerprinting**: The encryption key is derived from your unique hardware UUID and OS user. The encrypted file is useless if moved to another machine.
+*   **Minimalist Storage**: Only the `refresh_token` and `expiry_date` are stored.
+*   **Strict Unix Permissions**: The fallback file is created with `mode 600` (read/write only by your user).
 
 ---
 
@@ -155,6 +144,7 @@ These are low-level tools designed to be used by other AI agents to build comple
 |------|-------------|
 | `sites_list` | List all verified sites. |
 | `sites_add` / `sites_delete` | Manage properties. |
+| `sites_health_check` | **[NEW]** Run a health check on one or all sites. Checks WoW performance, sitemaps, and anomalies. |
 | `sitemaps_list` / `sitemaps_submit` | Manage sitemaps. |
 
 ### Inspection & Validation
@@ -164,12 +154,9 @@ These are low-level tools designed to be used by other AI agents to build comple
 | `pagespeed_analyze` | Lighthouse scores & Core Web Vitals. |
 | `schema_validate` | Validate Structured Data (JSON-LD). |
 
----
-
-## Contributing
 
-We love contributions! Please see [CONTRIBUTING.md](./CONTRIBUTING.md) for details.
 
 ## License
 
-MIT
+[MIT](LICENSE.md)
+[Contributing](CONTRIBUTING.md)

package/dist/docs/algorithm-updates.js

@@ -1,18 +1,59 @@
 export const algorithmUpdatesDocs = `
 # Google Algorithm Updates Reference
 
-The \`analytics_drop_attribution\` tool correlates traffic drops with major known Google Algorithm Updates. The following updates are currently supported:
+The \`analytics_drop_attribution\` tool correlates traffic drops with major known Google Algorithm Updates. The following updates are currently tracked (source: [Search Engine Journal](https://www.searchenginejournal.com/google-algorithm-history/)):
+
+## 2026
+
+| Date | Update Name | Impact Area |
+|------|-------------|-------------|
+| 2026-02-05 | February 2026 Discover Core Update | Discover Feed |
+
+## 2025
+
+| Date | Update Name | Impact Area |
+|------|-------------|-------------|
+| 2025-12-11 | December 2025 Core Update | General Ranking |
+| 2025-08-26 | August 2025 Spam Update | Spam / Content Quality |
+| 2025-06-30 | June 2025 Core Update | General Ranking |
+| 2025-03-13 | March 2025 Core Update | General Ranking |
+
+## 2024
 
 | Date | Update Name | Impact Area |
 |------|-------------|-------------|
-| 2025-01-15 | January 2025 Core Update | General Ranking |
+| 2024-12-19 | December 2024 Spam Update | Spam / Content Quality |
+| 2024-12-12 | December 2024 Core Update | General Ranking |
 | 2024-11-11 | November 2024 Core Update | General Ranking |
-| 2024-08-15 | August 2024 Core Update | General Ranking |
+| 2024-08-15 | August 2024 Core Update | General Ranking / Quality |
 | 2024-06-20 | June 2024 Spam Update | Content Quality / Spam |
+| 2024-05-14 | AI Overviews Rollout | Search Features / SERP |
+| 2024-05-06 | Site Reputation Abuse (Manual Actions) | Parasite SEO / Spam |
 | 2024-03-05 | March 2024 Core Update | General Ranking / Quality |
+
+## 2023
+
+| Date | Update Name | Impact Area |
+|------|-------------|-------------|
+| 2023-11-08 | November 2023 Reviews Update | Review Content |
 | 2023-11-02 | November 2023 Core Update | General Ranking |
 | 2023-10-05 | October 2023 Core Update | General Ranking |
+| 2023-10-04 | October 2023 Spam Update | Spam / Multi-language |
 | 2023-09-14 | September 2023 Helpful Content Update | Quality / Value |
+| 2023-08-22 | August 2023 Core Update | General Ranking |
+| 2023-04-12 | April 2023 Reviews Update | Review Content |
+| 2023-03-15 | March 2023 Core Update | General Ranking |
+| 2023-02-21 | February 2023 Product Reviews Update | Product Reviews |
+
+## 2022
+
+| Date | Update Name | Impact Area |
+|------|-------------|-------------|
+| 2022-12-14 | December 2022 Link Spam Update | Link Spam / SpamBrain |
+| 2022-12-05 | December 2022 Helpful Content Update | Quality / Value |
+| 2022-10-19 | October 2022 Spam Update | Spam |
+| 2022-09-20 | September 2022 Product Review Update | Product Reviews |
+| 2022-09-12 | September 2022 Core Update | General Ranking |
 
 ## How Attribution Works
 When a traffic drop is detected, the system checks if it occurred within **+/- 2 days** of any of these dates. If it matches, the update is flagged as a potential primary cause of the drop.

package/dist/google-client.js

@@ -1,16 +1,76 @@
 import { google } from 'googleapis';
-const SCOPES = ['https://www.googleapis.com/auth/webmasters'];
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { createCipheriv, createDecipheriv, scryptSync, randomBytes } from 'crypto';
+import nodeMachineId from 'node-machine-id';
+const { machineIdSync } = nodeMachineId;
+const SCOPES = [
+    'https://www.googleapis.com/auth/webmasters.readonly',
+    'https://www.googleapis.com/auth/userinfo.email'
+];
+const TOKEN_PATH = join(homedir(), '.search-console-mcp-tokens.enc');
+const SERVICE_NAME = 'io.github.saurabhsharma2u.search-console-mcp';
+const DEFAULT_ACCOUNT = 'default';
+// Default Client ID for Desktop Flow
+export const DEFAULT_CLIENT_ID = process.env.GOOGLE_CLIENT_ID || '347626597503-dr6t24m0i3g1nl1suam86rs650t3fhau.apps.googleusercontent.com';
+export const DEFAULT_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET || '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';
+const ENCRYPTION_ALGORITHM = 'aes-256-gcm';
+function getEncryptionKey() {
+    const mId = machineIdSync();
+    const salt = process.env.USER || 'sc-mcp-salt';
+    return scryptSync(mId, salt, 32);
+}
+function encrypt(text) {
+    const iv = randomBytes(12);
+    const key = getEncryptionKey();
+    const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${iv.toString('hex')}:${authTag}:${encrypted}`;
+}
+function decrypt(data) {
+    const [ivHex, authTagHex, encryptedHex] = data.split(':');
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+    const key = getEncryptionKey();
+    const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encryptedHex, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
 let cachedClient = null;
-/**
- * Get an authenticated Google Search Console API client.
- * Supports both file-based credentials (GOOGLE_APPLICATION_CREDENTIALS)
- * and environment variable credentials (GOOGLE_CLIENT_EMAIL + GOOGLE_PRIVATE_KEY).
- */
-export async function getSearchConsoleClient() {
-    if (cachedClient) {
+export async function getSearchConsoleClient(targetEmail) {
+    if (cachedClient && !targetEmail) {
         return cachedClient;
     }
-    // Option 1: Environment variables (for serverless/Cloudflare)
+    // 1. Load Tokens (Keychain first, then File)
+    const tokens = await loadTokens(targetEmail);
+    if (tokens) {
+        try {
+            const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID || DEFAULT_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET || DEFAULT_CLIENT_SECRET);
+            oauth2Client.setCredentials(tokens);
+            // Check for expiry (refresh if needed)
+            if (tokens.expiry_date && tokens.expiry_date <= Date.now()) {
+                const { credentials } = await oauth2Client.refreshAccessToken();
+                // Since we refresh, we need the email to save back. 
+                // If we don't have targetEmail, we try to fetch it from the new credentials or previous data
+                const email = targetEmail || await getUserEmail(credentials);
+                await saveTokens(credentials, email);
+                oauth2Client.setCredentials(credentials);
+            }
+            const client = google.searchconsole({ version: 'v1', auth: oauth2Client });
+            if (!targetEmail)
+                cachedClient = client;
+            return client;
+        }
+        catch (error) {
+            console.error('Failed to use stored OAuth2 tokens:', error.message);
+        }
+    }
+    // 2. Fallback to Service Account (Environment Variables)
     if (!process.env.GOOGLE_APPLICATION_CREDENTIALS && process.env.GOOGLE_CLIENT_EMAIL && process.env.GOOGLE_PRIVATE_KEY) {
         const jwtClient = new google.auth.JWT({
             email: process.env.GOOGLE_CLIENT_EMAIL,
@@ -21,11 +81,169 @@ export async function getSearchConsoleClient() {
         cachedClient = google.searchconsole({ version: 'v1', auth: jwtClient });
         return cachedClient;
     }
-    // Option 2: File-based credentials (default)
+    // 3. Fallback to File-based credentials
     const auth = new google.auth.GoogleAuth({
         scopes: SCOPES,
     });
-    const client = await auth.getClient();
-    cachedClient = google.searchconsole({ version: 'v1', auth: client });
-    return cachedClient;
+    try {
+        const client = await auth.getClient();
+        cachedClient = google.searchconsole({ version: 'v1', auth: client });
+        return cachedClient;
+    }
+    catch (error) {
+        throw new Error('No valid authentication found. Please run "search-console-mcp login" to authorize.');
+    }
+}
+export async function getUserEmail(tokens) {
+    const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID || DEFAULT_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET || DEFAULT_CLIENT_SECRET);
+    oauth2Client.setCredentials(tokens);
+    const oauth2 = google.oauth2({ version: 'v2', auth: oauth2Client });
+    const userInfo = await oauth2.userinfo.get();
+    return userInfo.data.email || DEFAULT_ACCOUNT;
+}
+export async function logout(email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // 1. Try Keychain
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        await entry.deletePassword();
+    }
+    catch (e) { }
+    // 2. Clear from file
+    if (existsSync(TOKEN_PATH)) {
+        try {
+            const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+            const decrypted = decrypt(encryptedData);
+            const allTokens = JSON.parse(decrypted);
+            delete allTokens[target];
+            if (Object.keys(allTokens).length === 0) {
+                // Just delete the file if no accounts left
+                import('fs').then(fs => fs.unlinkSync(TOKEN_PATH)).catch(() => { });
+            }
+            else {
+                const updatedEncrypted = encrypt(JSON.stringify(allTokens));
+                writeFileSync(TOKEN_PATH, updatedEncrypted, { mode: 0o600 });
+            }
+        }
+        catch (e) { }
+    }
+}
+export async function loadTokens(email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // 1. Try Keychain
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        const secret = await entry.getPassword();
+        if (secret) {
+            return JSON.parse(secret);
+        }
+    }
+    catch (e) { }
+    // 2. Try Encrypted File
+    if (existsSync(TOKEN_PATH)) {
+        try {
+            const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+            const decrypted = decrypt(encryptedData);
+            const allTokens = JSON.parse(decrypted);
+            return allTokens[target] || (email ? null : Object.values(allTokens)[0]);
+        }
+        catch (e) { }
+    }
+    return null;
+}
+export async function saveTokens(tokens, email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // Only store what we need
+    const minimalTokens = {
+        refresh_token: tokens.refresh_token,
+        expiry_date: tokens.expiry_date,
+        access_token: tokens.access_token // Needed for immediate use, but refresh_token is the key
+    };
+    const tokenStr = JSON.stringify(minimalTokens);
+    // 1. Try Keychain
+    let keychainSuccess = false;
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        await entry.setPassword(tokenStr);
+        keychainSuccess = true;
+    }
+    catch (e) { }
+    // 2. Always write to encrypted file as a fallback
+    try {
+        let allTokens = {};
+        if (existsSync(TOKEN_PATH)) {
+            try {
+                const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+                const decrypted = decrypt(encryptedData);
+                allTokens = JSON.parse(decrypted);
+            }
+            catch (e) { }
+        }
+        allTokens[target] = minimalTokens;
+        const encrypted = encrypt(JSON.stringify(allTokens));
+        writeFileSync(TOKEN_PATH, encrypted, { mode: 0o600 });
+    }
+    catch (e) {
+        if (!keychainSuccess)
+            throw e;
+    }
+}
+export async function initiateDeviceFlow(clientId) {
+    const response = await fetch('https://oauth2.googleapis.com/device/code', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            scope: SCOPES.join(' ')
+        })
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Failed to initiate device flow: ${error}`);
+    }
+    return await response.json();
+}
+export async function pollForTokens(clientId, clientSecret, deviceCode, interval) {
+    // This is now deprecated as Device Flow doesn't support Search Console scopes
+    throw new Error("Device Flow is not supported for Search Console API.");
+}
+export async function startLocalFlow(clientId, clientSecret) {
+    const { createServer } = await import('http');
+    const { google } = await import('googleapis');
+    const open = (await import('open')).default;
+    const REDIRECT_URI = 'http://localhost:3000/oauth2callback';
+    const oauth2Client = new google.auth.OAuth2(clientId, clientSecret, REDIRECT_URI);
+    const authUrl = oauth2Client.generateAuthUrl({
+        access_type: 'offline',
+        scope: SCOPES,
+        prompt: 'consent'
+    });
+    return new Promise((resolve, reject) => {
+        const server = createServer(async (req, res) => {
+            try {
+                if (req.url?.startsWith('/oauth2callback')) {
+                    const url = new URL(req.url, `http://${req.headers.host}`);
+                    const code = url.searchParams.get('code');
+                    if (code) {
+                        const { tokens } = await oauth2Client.getToken(code);
+                        res.writeHead(200, { 'Content-Type': 'text/html' });
+                        res.end('<h1>Authentication Successful!</h1><p>You can close this tab now and return to your terminal.</p>');
+                        server.close();
+                        resolve(tokens);
+                    }
+                }
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end('<h1>Authentication Failed</h1>');
+                server.close();
+                reject(e);
+            }
+        }).listen(3000);
+        console.log('\nOpening your browser to authorize Search Console access...');
+        open(authUrl);
+    });
 }

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import 'dotenv/config';
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
@@ -11,7 +12,11 @@ import * as seoInsights from "./tools/seo-insights.js";
 import * as seoPrimitives from "./tools/seo-primitives.js";
 import * as schemaValidator from "./tools/schema-validator.js";
 import * as advancedAnalytics from "./tools/advanced-analytics.js";
+import * as sitesHealth from "./tools/sites-health.js";
 import { formatError } from "./errors.js";
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
 const server = new McpServer({
     name: "search-console-mcp",
     version: "1.0.0",
@@ -61,6 +66,19 @@ server.tool("sites_get", "Get information about a specific site", { siteUrl: z.s
         return formatError(error);
     }
 });
+server.tool("sites_health_check", "Run a health check on one or all verified sites. Checks week-over-week performance, sitemap status, and traffic anomalies. Returns a structured report with an overall status (healthy/warning/critical) per site.", {
+    siteUrl: z.string().optional().describe("Optional. The URL of a specific site to check. If omitted, checks all verified sites.")
+}, async ({ siteUrl }) => {
+    try {
+        const result = await sitesHealth.healthCheck(siteUrl);
+        return {
+            content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+        };
+    }
+    catch (error) {
+        return formatError(error);
+    }
+});
 // Sitemaps Tools
 server.tool("sitemaps_list", "List sitemaps for a site", { siteUrl: z.string().describe("The URL of the site") }, async ({ siteUrl }) => {
     try {
@@ -740,17 +758,67 @@ Provide a summary with actionable recommendations.`
             }
         }]
 }));
+server.prompt("site-health-check", {
+    siteUrl: z.string().optional().describe("Optional. The URL of a specific site to check. If omitted, checks all verified sites.")
+}, ({ siteUrl }) => ({
+    messages: [{
+            role: "user",
+            content: {
+                type: "text",
+                text: `Run a comprehensive health check${siteUrl ? ` for ${siteUrl}` : ' across all my verified sites'}.
+
+Use the 'sites_health_check' tool${siteUrl ? ` with siteUrl '${siteUrl}'` : ' without a siteUrl to check all sites'}.
+
+Then for each site in the results:
+
+1. **Summarize the status** (healthy / warning / critical) with a clear visual indicator.
+2. **Performance:** Report the week-over-week changes in clicks, impressions, CTR, and position.
+3. **Sitemaps:** Note any missing sitemaps, errors, or warnings.
+4. **Anomalies:** Highlight any traffic anomaly drops detected.
+
+If any site has a 'critical' or 'warning' status:
+- List the specific issues found.
+- For critical traffic drops, use 'analytics_drop_attribution' to check if a Google algorithm update is the likely cause.
+- For sitemap errors, use 'sitemaps_list' to get detailed error information.
+- Provide 3 prioritized action items for each affected site.
+
+End with an overall portfolio summary and the single most important action to take right now.`
+            }
+        }]
+}));
 async function main() {
-    if (!process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+    const command = process.argv[2];
+    // Handle standalone commands
+    if (command === 'setup') {
+        const { main: setupMain } = await import('./setup.js');
+        await setupMain();
+        return;
+    }
+    if (command === 'logout') {
+        const { runLogout } = await import('./setup.js');
+        await runLogout();
+        return;
+    }
+    if (command === 'login') {
+        const { login } = await import('./setup.js');
+        await login();
+        return;
+    }
+    // Check for credentials
+    const hasServiceAccount = !!process.env.GOOGLE_APPLICATION_CREDENTIALS || (!!process.env.GOOGLE_CLIENT_EMAIL && !!process.env.GOOGLE_PRIVATE_KEY);
+    const tokenPath = join(homedir(), '.search-console-mcp-tokens.enc');
+    const hasOAuthTokens = existsSync(tokenPath);
+    if (!hasServiceAccount && !hasOAuthTokens) {
         console.error('\n╔══════════════════════════════════════════════════════════════╗');
         console.error('║          🚀 Google Search Console MCP Server                 ║');
         console.error('╚══════════════════════════════════════════════════════════════╝\n');
-        console.error('❌ GOOGLE_APPLICATION_CREDENTIALS environment variable is not set.\n');
-        console.error('💡 To set up the server, run the setup wizard:');
-        console.error('   npx search-console-mcp-setup\n');
-        console.error('Alternatively, set the variable manually:');
-        console.error('   export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/key.json\n');
+        console.error('❌ No authentication found.\n');
+        console.error('💡 Please authorize with your Google Account:');
+        console.error('   npx -y search-console-mcp login\n');
+        console.error('Alternatively, run the setup wizard for other options:');
+        console.error('   npx -y search-console-mcp setup\n');
         console.error('─'.repeat(64) + '\n');
+        // We don't exit here because the transport might still be needed or the user might be piping output
     }
     const transport = new StdioServerTransport();
     await server.connect(transport);