search-console-mcp 1.9.3 → 1.10.1

package/README.md

@@ -1,3 +1,4 @@
+
 # Google Search Console MCP Server
 
 A Model Context Protocol (MCP) server that transforms how you interact with Google Search Console. Stop exporting CSVs and start asking questions.
@@ -6,10 +7,6 @@ A Model Context Protocol (MCP) server that transforms how you interact with Goog
 
 ---
 
-### [🏠 Overview](#) | [🎯 Prompts](#-magic-prompts) | [🚀 Quick Start](#-quick-start) | [🛠️ Tools](#-tools-reference)
-
----
-
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Tests](https://github.com/saurabhsharma2u/search-console-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/saurabhsharma2u/search-console-mcp/actions/workflows/ci.yml)
 
@@ -28,7 +25,6 @@ A Model Context Protocol (MCP) server that transforms how you interact with Goog
 > "Find low-hanging fruit keywords (positions 11-20) with high impressions that I should optimize."
 
 ---
-
 ## 🎯 Magic Prompts
 
 Copy and paste these into your MCP client (Claude Desktop, etc.) to see the intelligence engine in action:
@@ -53,69 +49,62 @@ Copy and paste these into your MCP client (Claude Desktop, etc.) to see the inte
 
 ---
 
-## 🔒 Security & Privacy
+## 🔐 Authentication (Desktop Flow)
+
+Search Console MCP uses a **Secure Desktop Flow**. This provides high-security, professional grade authentication for your Google account:
+- **Multi-Account Support**: Automatically detects and stores separate tokens for different Google accounts based on your email.
+- **System Keychain Primary**: Tokens are stored in your OS's native credential manager (macOS Keychain, Windows Credential Manager, or Linux Secret Service).
+- **AES-256-GCM Hardware-Bound Encryption**: Fallback storage is encrypted with AES-256-GCM using a key derived from your unique hardware machine ID. Tokens stolen from your machine cannot be decrypted on another computer.
+- **Silent Background Refresh**: Tokens auto-refresh silently when they expire.
+
+### 🚀 Step 1 — Initiate Login
+Run the following command to start the authorization process:
+```bash
+npx search-console-mcp setup
+```
+
+The CLI will:
+1. Briefly start a secure local server to handle the redirect.
+2. Open your default web browser to the Google Authorization page.
+3. Automatically fetch your email after authorization to label your credentials securely.
 
-We take your data security seriously. This tool is designed to be **local-first** and **secure by default**.
+### 🔑 Step 2 — Logout & Management
+To wipe your credentials from both the keychain and the disk:
+```bash
+# Logout of the default account
+npx search-console-mcp logout
 
-*   **Credentials Never Logged**: Your Google Service Account keys are used *only* in memory to authenticate with Google APIs. They are never written to disk, logs, or sent to any third-party server.
-*   **Local Execution**: The code runs entirely on your local machine (or wherever you host your MCP server).
-*   **Path Traversal Protection**: The setup wizard implements strict validation for file paths, including null-byte removal, extension enforcement (.json), and size limits (1MB) to prevent unauthorized file access.
-*   **Direct Communication**: All API calls go directly from your machine to Google's servers (`googleapis.com`). There is no middleman or proxy server.
-*   **Open Source**: The code is fully open source. You can audit exactly how your credentials are used in `src/google-client.ts`.
+# Logout of a specific account
+npx search-console-mcp logout user@gmail.com
+```
 
 ---
 
-## Features
+## 🔑 Alternative: Service Account (Advanced)
 
-- **Advanced Analytics**: Query performance data with powerful filters (Regex supported).
-    - *New*: Support for 'News', 'Discover', 'Image' search types.
-    - *New*: 'Fresh' data support for real-time monitoring.
-    - *New*: **Drop Attribution** to identify device-level traffic losses.
-    - *New*: **Time Series Insights** with rolling averages and trend forecasting.
-- **Trend Detection**: Automatically identify rising or falling trends in your traffic.
-- **Anomaly Detection**: Spot unusual spikes or drops that need attention.
-- **Sitemaps Management**: List, submit, and validte sitemaps.
-- **URL Inspection**: Check real-time indexing status and mobile usability.
-- **PageSpeed Insights**: Integrated performance and Core Web Vitals analysis.
-- **Schema Validation**: Validate JSON-LD structured data.
+For server-side environments or automated tasks where interactive login isn't possible, you can use a Google Cloud Service Account.
+
+### Setup:
+1.  **Create Service Account**: Go to the [Google Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts) and create a service account.
+2.  **Generate Key**: Click "Keys" > "Add Key" > "Create new key" (JSON). Download this file.
+3.  **Share Access**: In Google Search Console, add the service account's email address (e.g., `account@project.iam.gserviceaccount.com`) as a user with at least "Full" or "Restricted" permissions.
+4.  **Configure**: Point the server to your key file:
+    ```bash
+    export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/key.json"
+    ```
 
 ---
 
-## Quick Start
 
-### 1. Run the Setup Wizard
-First, use the interactive wizard to validate your credentials and get your configuration:
+## 🛡️ Fort Knox Security
 
-```bash
-npx -y search-console-mcp setup
-```
+This MCP server implements a multi-layered security architecture:
 
-The wizard will guide you through:
-- Creating a Google Service Account.
-- Adding the account to Search Console.
-- Validating your JSON key file.
-- Generating the configuration for your MCP client.
-
-### 2. Connect to an MCP Client
-
-**Note:** The server uses `stdio` to communicate. Do not run `npx search-console-mcp` directly in your terminal; it is meant to be run by an MCP client like Claude Desktop or Cursor.
-
-#### Claude Desktop Configuration
-Add this to your `claude_desktop_config.json`:
-
-```json
-{
-  "mcpServers": {
-    "google-search-console": {
-      "command": "npx",
-      "args": ["-y", "search-console-mcp"],
-      "env": {
-        "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/path/to/your/service-account-key.json"
-      }
-    }
-  }
-}
-```
+*   **Keychain Integration**: Primarily uses the **macOS Keychain**, **Windows Credential Manager**, or **libsecret (Linux)** to store tokens.
+*   **Hardware-Bound Vault**: Fallback tokens are stored in `~/.search-console-mcp-tokens.enc` and encrypted with **AES-256-GCM**.
+*   **Machine Fingerprinting**: The encryption key is derived from your unique hardware UUID and OS user. The encrypted file is useless if moved to another machine.
+*   **Minimalist Storage**: Only the `refresh_token` and `expiry_date` are stored.
+*   **Strict Unix Permissions**: The fallback file is created with `mode 600` (read/write only by your user).
 
 ---
 
@@ -165,12 +154,9 @@ These are low-level tools designed to be used by other AI agents to build comple
 | `pagespeed_analyze` | Lighthouse scores & Core Web Vitals. |
 | `schema_validate` | Validate Structured Data (JSON-LD). |
 
----
-
-## Contributing
 
-We love contributions! Please see [CONTRIBUTING.md](./CONTRIBUTING.md) for details.
 
 ## License
 
-MIT
+[MIT](LICENSE.md)
+[Contributing](CONTRIBUTING.md)

package/dist/google-client.js

@@ -1,16 +1,76 @@
 import { google } from 'googleapis';
-const SCOPES = ['https://www.googleapis.com/auth/webmasters'];
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { createCipheriv, createDecipheriv, scryptSync, randomBytes } from 'crypto';
+import nodeMachineId from 'node-machine-id';
+const { machineIdSync } = nodeMachineId;
+const SCOPES = [
+    'https://www.googleapis.com/auth/webmasters.readonly',
+    'https://www.googleapis.com/auth/userinfo.email'
+];
+const TOKEN_PATH = join(homedir(), '.search-console-mcp-tokens.enc');
+const SERVICE_NAME = 'io.github.saurabhsharma2u.search-console-mcp';
+const DEFAULT_ACCOUNT = 'default';
+// Default Client ID for Desktop Flow
+export const DEFAULT_CLIENT_ID = process.env.GOOGLE_CLIENT_ID || '347626597503-dr6t24m0i3g1nl1suam86rs650t3fhau.apps.googleusercontent.com';
+export const DEFAULT_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET || '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';
+const ENCRYPTION_ALGORITHM = 'aes-256-gcm';
+function getEncryptionKey() {
+    const mId = machineIdSync();
+    const salt = process.env.USER || 'sc-mcp-salt';
+    return scryptSync(mId, salt, 32);
+}
+function encrypt(text) {
+    const iv = randomBytes(12);
+    const key = getEncryptionKey();
+    const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `${iv.toString('hex')}:${authTag}:${encrypted}`;
+}
+function decrypt(data) {
+    const [ivHex, authTagHex, encryptedHex] = data.split(':');
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+    const key = getEncryptionKey();
+    const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encryptedHex, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
 let cachedClient = null;
-/**
- * Get an authenticated Google Search Console API client.
- * Supports both file-based credentials (GOOGLE_APPLICATION_CREDENTIALS)
- * and environment variable credentials (GOOGLE_CLIENT_EMAIL + GOOGLE_PRIVATE_KEY).
- */
-export async function getSearchConsoleClient() {
-    if (cachedClient) {
+export async function getSearchConsoleClient(targetEmail) {
+    if (cachedClient && !targetEmail) {
         return cachedClient;
     }
-    // Option 1: Environment variables (for serverless/Cloudflare)
+    // 1. Load Tokens (Keychain first, then File)
+    const tokens = await loadTokens(targetEmail);
+    if (tokens) {
+        try {
+            const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID || DEFAULT_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET || DEFAULT_CLIENT_SECRET);
+            oauth2Client.setCredentials(tokens);
+            // Check for expiry (refresh if needed)
+            if (tokens.expiry_date && tokens.expiry_date <= Date.now()) {
+                const { credentials } = await oauth2Client.refreshAccessToken();
+                // Since we refresh, we need the email to save back. 
+                // If we don't have targetEmail, we try to fetch it from the new credentials or previous data
+                const email = targetEmail || await getUserEmail(credentials);
+                await saveTokens(credentials, email);
+                oauth2Client.setCredentials(credentials);
+            }
+            const client = google.searchconsole({ version: 'v1', auth: oauth2Client });
+            if (!targetEmail)
+                cachedClient = client;
+            return client;
+        }
+        catch (error) {
+            console.error('Failed to use stored OAuth2 tokens:', error.message);
+        }
+    }
+    // 2. Fallback to Service Account (Environment Variables)
     if (!process.env.GOOGLE_APPLICATION_CREDENTIALS && process.env.GOOGLE_CLIENT_EMAIL && process.env.GOOGLE_PRIVATE_KEY) {
         const jwtClient = new google.auth.JWT({
             email: process.env.GOOGLE_CLIENT_EMAIL,
@@ -21,11 +81,169 @@ export async function getSearchConsoleClient() {
         cachedClient = google.searchconsole({ version: 'v1', auth: jwtClient });
         return cachedClient;
     }
-    // Option 2: File-based credentials (default)
+    // 3. Fallback to File-based credentials
     const auth = new google.auth.GoogleAuth({
         scopes: SCOPES,
     });
-    const client = await auth.getClient();
-    cachedClient = google.searchconsole({ version: 'v1', auth: client });
-    return cachedClient;
+    try {
+        const client = await auth.getClient();
+        cachedClient = google.searchconsole({ version: 'v1', auth: client });
+        return cachedClient;
+    }
+    catch (error) {
+        throw new Error('No valid authentication found. Please run "search-console-mcp login" to authorize.');
+    }
+}
+export async function getUserEmail(tokens) {
+    const oauth2Client = new google.auth.OAuth2(process.env.GOOGLE_CLIENT_ID || DEFAULT_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET || DEFAULT_CLIENT_SECRET);
+    oauth2Client.setCredentials(tokens);
+    const oauth2 = google.oauth2({ version: 'v2', auth: oauth2Client });
+    const userInfo = await oauth2.userinfo.get();
+    return userInfo.data.email || DEFAULT_ACCOUNT;
+}
+export async function logout(email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // 1. Try Keychain
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        await entry.deletePassword();
+    }
+    catch (e) { }
+    // 2. Clear from file
+    if (existsSync(TOKEN_PATH)) {
+        try {
+            const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+            const decrypted = decrypt(encryptedData);
+            const allTokens = JSON.parse(decrypted);
+            delete allTokens[target];
+            if (Object.keys(allTokens).length === 0) {
+                // Just delete the file if no accounts left
+                import('fs').then(fs => fs.unlinkSync(TOKEN_PATH)).catch(() => { });
+            }
+            else {
+                const updatedEncrypted = encrypt(JSON.stringify(allTokens));
+                writeFileSync(TOKEN_PATH, updatedEncrypted, { mode: 0o600 });
+            }
+        }
+        catch (e) { }
+    }
+}
+export async function loadTokens(email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // 1. Try Keychain
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        const secret = await entry.getPassword();
+        if (secret) {
+            return JSON.parse(secret);
+        }
+    }
+    catch (e) { }
+    // 2. Try Encrypted File
+    if (existsSync(TOKEN_PATH)) {
+        try {
+            const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+            const decrypted = decrypt(encryptedData);
+            const allTokens = JSON.parse(decrypted);
+            return allTokens[target] || (email ? null : Object.values(allTokens)[0]);
+        }
+        catch (e) { }
+    }
+    return null;
+}
+export async function saveTokens(tokens, email) {
+    const target = email || DEFAULT_ACCOUNT;
+    // Only store what we need
+    const minimalTokens = {
+        refresh_token: tokens.refresh_token,
+        expiry_date: tokens.expiry_date,
+        access_token: tokens.access_token // Needed for immediate use, but refresh_token is the key
+    };
+    const tokenStr = JSON.stringify(minimalTokens);
+    // 1. Try Keychain
+    let keychainSuccess = false;
+    try {
+        const { Entry } = await import('@napi-rs/keyring');
+        const entry = new Entry(SERVICE_NAME, target);
+        await entry.setPassword(tokenStr);
+        keychainSuccess = true;
+    }
+    catch (e) { }
+    // 2. Always write to encrypted file as a fallback
+    try {
+        let allTokens = {};
+        if (existsSync(TOKEN_PATH)) {
+            try {
+                const encryptedData = readFileSync(TOKEN_PATH, 'utf-8');
+                const decrypted = decrypt(encryptedData);
+                allTokens = JSON.parse(decrypted);
+            }
+            catch (e) { }
+        }
+        allTokens[target] = minimalTokens;
+        const encrypted = encrypt(JSON.stringify(allTokens));
+        writeFileSync(TOKEN_PATH, encrypted, { mode: 0o600 });
+    }
+    catch (e) {
+        if (!keychainSuccess)
+            throw e;
+    }
+}
+export async function initiateDeviceFlow(clientId) {
+    const response = await fetch('https://oauth2.googleapis.com/device/code', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            scope: SCOPES.join(' ')
+        })
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Failed to initiate device flow: ${error}`);
+    }
+    return await response.json();
+}
+export async function pollForTokens(clientId, clientSecret, deviceCode, interval) {
+    // This is now deprecated as Device Flow doesn't support Search Console scopes
+    throw new Error("Device Flow is not supported for Search Console API.");
+}
+export async function startLocalFlow(clientId, clientSecret) {
+    const { createServer } = await import('http');
+    const { google } = await import('googleapis');
+    const open = (await import('open')).default;
+    const REDIRECT_URI = 'http://localhost:3000/oauth2callback';
+    const oauth2Client = new google.auth.OAuth2(clientId, clientSecret, REDIRECT_URI);
+    const authUrl = oauth2Client.generateAuthUrl({
+        access_type: 'offline',
+        scope: SCOPES,
+        prompt: 'consent'
+    });
+    return new Promise((resolve, reject) => {
+        const server = createServer(async (req, res) => {
+            try {
+                if (req.url?.startsWith('/oauth2callback')) {
+                    const url = new URL(req.url, `http://${req.headers.host}`);
+                    const code = url.searchParams.get('code');
+                    if (code) {
+                        const { tokens } = await oauth2Client.getToken(code);
+                        res.writeHead(200, { 'Content-Type': 'text/html' });
+                        res.end('<h1>Authentication Successful!</h1><p>You can close this tab now and return to your terminal.</p>');
+                        server.close();
+                        resolve(tokens);
+                    }
+                }
+            }
+            catch (e) {
+                res.writeHead(500);
+                res.end('<h1>Authentication Failed</h1>');
+                server.close();
+                reject(e);
+            }
+        }).listen(3000);
+        console.log('\nOpening your browser to authorize Search Console access...');
+        open(authUrl);
+    });
 }

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import 'dotenv/config';
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
@@ -13,6 +14,9 @@ import * as schemaValidator from "./tools/schema-validator.js";
 import * as advancedAnalytics from "./tools/advanced-analytics.js";
 import * as sitesHealth from "./tools/sites-health.js";
 import { formatError } from "./errors.js";
+import { existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
 const server = new McpServer({
     name: "search-console-mcp",
     version: "1.0.0",
@@ -783,22 +787,38 @@ End with an overall portfolio summary and the single most important action to ta
         }]
 }));
 async function main() {
-    // Allow `npx search-console-mcp setup` to launch the setup wizard
-    if (process.argv[2] === 'setup') {
+    const command = process.argv[2];
+    // Handle standalone commands
+    if (command === 'setup') {
         const { main: setupMain } = await import('./setup.js');
         await setupMain();
         return;
     }
-    if (!process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+    if (command === 'logout') {
+        const { runLogout } = await import('./setup.js');
+        await runLogout();
+        return;
+    }
+    if (command === 'login') {
+        const { login } = await import('./setup.js');
+        await login();
+        return;
+    }
+    // Check for credentials
+    const hasServiceAccount = !!process.env.GOOGLE_APPLICATION_CREDENTIALS || (!!process.env.GOOGLE_CLIENT_EMAIL && !!process.env.GOOGLE_PRIVATE_KEY);
+    const tokenPath = join(homedir(), '.search-console-mcp-tokens.enc');
+    const hasOAuthTokens = existsSync(tokenPath);
+    if (!hasServiceAccount && !hasOAuthTokens) {
         console.error('\n╔══════════════════════════════════════════════════════════════╗');
         console.error('║          🚀 Google Search Console MCP Server                 ║');
         console.error('╚══════════════════════════════════════════════════════════════╝\n');
-        console.error('❌ GOOGLE_APPLICATION_CREDENTIALS environment variable is not set.\n');
-        console.error('💡 To set up the server, run the setup wizard:');
+        console.error('❌ No authentication found.\n');
+        console.error('💡 Please authorize with your Google Account:');
+        console.error('   npx -y search-console-mcp login\n');
+        console.error('Alternatively, run the setup wizard for other options:');
         console.error('   npx -y search-console-mcp setup\n');
-        console.error('Alternatively, set the variable manually:');
-        console.error('   export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/key.json\n');
         console.error('─'.repeat(64) + '\n');
+        // We don't exit here because the transport might still be needed or the user might be piping output
     }
     const transport = new StdioServerTransport();
     await server.connect(transport);

package/dist/setup.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
+import 'dotenv/config';
 import { readFileSync, existsSync, statSync } from 'fs';
 import { resolve, dirname, extname } from 'path';
 import { createInterface } from 'readline';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
 import { execSync } from 'child_process';
+import { startLocalFlow, saveTokens, getUserEmail, logout, DEFAULT_CLIENT_ID, DEFAULT_CLIENT_SECRET } from './google-client.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const rl = createInterface({
@@ -35,7 +37,7 @@ function printError(text) {
 function printInfo(text) {
     console.log(`ℹ️  ${text}`);
 }
-function validateKeyFile(path) {
+export function validateKeyFile(path) {
     try {
         const sanitizedPath = path.trim().replace(/\0/g, '');
         const expandedPath = sanitizedPath.startsWith('~')
@@ -55,10 +57,6 @@ function validateKeyFile(path) {
             printError(`Invalid file type. Please provide a .json file.`);
             return null;
         }
-        if (stats.size > 1024 * 1024) {
-            printError(`File too large. Service account keys are typically small JSON files.`);
-            return null;
-        }
         const content = readFileSync(fullPath, 'utf-8');
         const key = JSON.parse(content);
         const required = ['type', 'project_id', 'client_email', 'private_key'];
@@ -78,7 +76,7 @@ function validateKeyFile(path) {
         return null;
     }
 }
-async function testConnection(keyPath) {
+export async function testConnection(keyPath) {
     try {
         process.env.GOOGLE_APPLICATION_CREDENTIALS = resolve(keyPath.replace('~', homedir()));
         const { google } = await import('googleapis');
@@ -93,36 +91,19 @@ async function testConnection(keyPath) {
         return false;
     }
 }
-function showConfigSnippets(credentialsPath) {
+export function showConfigSnippets(credentialsPath) {
     console.log('\nAdd this to your MCP client configuration:\n');
-    console.log('For Claude Desktop (~/.config/claude/claude_desktop_config.json):');
-    console.log('─'.repeat(60));
     console.log(JSON.stringify({
         mcpServers: {
             "search-console": {
                 command: "npx",
-                args: ["search-console-mcp"],
+                args: ["-y", "search-console-mcp"],
                 env: {
                     GOOGLE_APPLICATION_CREDENTIALS: credentialsPath
                 }
             }
         }
     }, null, 2));
-    console.log('─'.repeat(60));
-    console.log('\nFor VS Code Copilot (.vscode/mcp.json):');
-    console.log('─'.repeat(60));
-    console.log(JSON.stringify({
-        servers: {
-            "search-console": {
-                command: "npx",
-                args: ["search-console-mcp"],
-                env: {
-                    GOOGLE_APPLICATION_CREDENTIALS: credentialsPath
-                }
-            }
-        }
-    }, null, 2));
-    console.log('─'.repeat(60));
 }
 export function resolveRepo(dirname) {
     let repo = '';
@@ -141,107 +122,151 @@ export function resolveRepo(dirname) {
                 repo = pkg.repository.url.replace(/.*github\.com\//, '').replace(/\.git$/, '');
             }
             else if (pkg.mcpName && pkg.mcpName.includes('/')) {
-                // Handle io.github.owner/repo or owner/repo
                 repo = pkg.mcpName.replace(/^io\.github\./, '').split('/').slice(-2).join('/');
             }
         }
     }
     return repo;
 }
-export async function main() {
+export async function login() {
     printHeader();
-    console.log('This wizard will help you set up Search Console MCP.');
-    console.log('You will need a Google Cloud service account with Search Console access.\n');
-    // Step 1: Check for existing credentials
+    printStep(1, 'Browser Authorization');
+    console.log('Using Secure Desktop Flow.');
+    console.log('Note: We will automatically fetch your email to support multiple accounts.');
+    // Use centralized defaults
+    const clientId = DEFAULT_CLIENT_ID;
+    const clientSecret = DEFAULT_CLIENT_SECRET;
+    try {
+        const tokens = await startLocalFlow(clientId, clientSecret);
+        printInfo('Fetching account information...');
+        const email = await getUserEmail(tokens);
+        await saveTokens(tokens, email);
+        printSuccess(`Successfully authenticated as ${email}!`);
+        printInfo('Tokens are stored securely in your system keychain.');
+        printStep(2, 'Configure your MCP client');
+        showOAuth2ConfigSnippets(clientId, clientSecret);
+        await supportProject();
+        rl.close();
+    }
+    catch (error) {
+        printError(`Authentication failed: ${error.message}`);
+        console.log('\nTip: Ensure you are using a "Desktop Application" Client ID type in the Cloud Console.');
+        process.exit(1);
+    }
+}
+export async function runLogout() {
+    printHeader();
+    printInfo('Logging out and clearing secure credentials...');
+    // Get email from CLI args if provided: search-console-mcp logout user@gmail.com
+    const email = process.argv[3];
+    try {
+        await logout(email);
+        if (email) {
+            printSuccess(`Successfully logged out and removed credentials for ${email}.`);
+        }
+        else {
+            printSuccess('Successfully logged out from default account.');
+        }
+    }
+    catch (error) {
+        printError(`Logout failed: ${error.message}`);
+    }
+    rl.close();
+}
+function showOAuth2ConfigSnippets(clientId, clientSecret) {
+    console.log('\nAdd this to your MCP client configuration:\n');
+    console.log(JSON.stringify({
+        mcpServers: {
+            "search-console": {
+                command: "npx",
+                args: ["-y", "search-console-mcp"],
+                env: {
+                    GOOGLE_CLIENT_ID: clientId,
+                    GOOGLE_CLIENT_SECRET: clientSecret
+                }
+            }
+        }
+    }, null, 2));
+}
+async function setupServiceAccount() {
     printStep(1, 'Locate your service account JSON key file');
     console.log('If you don\'t have one yet, follow these steps:');
     console.log('  1. Go to https://console.cloud.google.com/iam-admin/serviceaccounts');
     console.log('  2. Create a new service account (or select existing)');
     console.log('  3. Click "Keys" > "Add Key" > "Create new key" > "JSON"');
     console.log('  4. Save the downloaded JSON file\n');
-    const keyPath = await ask('Enter the path to your JSON key file (or press Enter to see config examples): ');
-    // Default values for when no path provided
-    let serviceAccountEmail = '<your-service-account>@<project>.iam.gserviceaccount.com';
-    let credentialsPath = '/path/to/your/service-account-key.json';
-    if (keyPath) {
-        // Validate the key file
-        const key = validateKeyFile(keyPath);
-        if (!key) {
-            rl.close();
-            process.exit(1);
-        }
-        printSuccess('JSON key file is valid!');
-        printInfo(`Project: ${key.project_id}`);
-        printInfo(`Service Account: ${key.client_email}`);
-        serviceAccountEmail = key.client_email;
-        credentialsPath = resolve(keyPath.replace('~', homedir()));
-        // Step 2: Show service account email
-        printStep(2, 'Add service account to Google Search Console');
-        console.log('You need to add this email as a user in Google Search Console:\n');
-        console.log(`  📧 ${serviceAccountEmail}\n`);
-        console.log('Steps:');
-        console.log('  1. Go to https://search.google.com/search-console');
-        console.log('  2. Select your property (or add one if needed)');
-        console.log('  3. Click "Settings" (gear icon) in the sidebar');
-        console.log('  4. Click "Users and permissions"');
-        console.log('  5. Click "Add user"');
-        console.log(`  6. Enter: ${serviceAccountEmail}`);
-        console.log('  7. Set permission to "Full" (or "Restricted" for read-only)');
-        console.log('  8. Click "Add"\n');
-        await ask('Press Enter when you\'ve added the service account to Search Console...');
-        // Step 3: Test connection
-        printStep(3, 'Test connection');
-        console.log('Testing authentication with Google APIs...');
-        const connected = await testConnection(keyPath);
-        if (connected) {
-            printSuccess('Authentication successful!');
-        }
-        else {
-            printError('Authentication failed. Please check your credentials and try again.');
-            rl.close();
-            process.exit(1);
-        }
-        // Step 4: Show configuration
-        printStep(4, 'Configure your MCP client');
-        showConfigSnippets(credentialsPath);
-        console.log('\n🎉 Setup complete! You can now use Search Console MCP.\n');
+    const keyPath = await ask('Enter the path to your JSON key file: ');
+    if (!keyPath) {
+        printError('No credentials file provided.');
+        process.exit(1);
+    }
+    const key = validateKeyFile(keyPath);
+    if (!key) {
+        process.exit(1);
+    }
+    printSuccess('JSON key file is valid!');
+    const serviceAccountEmail = key.client_email;
+    const credentialsPath = resolve(keyPath.replace('~', homedir()));
+    printStep(2, 'Add service account to Google Search Console');
+    console.log('You need to add this email as a user in Google Search Console:\n');
+    console.log(`  📧 ${serviceAccountEmail}\n`);
+    console.log('Steps:');
+    console.log('  1. Go to https://search.google.com/search-console');
+    console.log('  2. Select your property');
+    console.log('  3. Click "Settings" > "Users and permissions" > "Add user"');
+    console.log(`  4. Enter: ${serviceAccountEmail}`);
+    console.log('  5. Set permission to "Full" or "Restricted" and click "Add"\n');
+    await ask('Press Enter when you\'ve added the service account to Search Console...');
+    printStep(3, 'Test connection');
+    console.log('Testing authentication with Google APIs...');
+    const connected = await testConnection(credentialsPath);
+    if (connected) {
+        printSuccess('Authentication successful!');
     }
     else {
-        // No path provided - just show config examples
-        printInfo('No credentials file provided. Showing example configuration...\n');
-        printStep(2, 'Add service account to Google Search Console');
-        console.log('After creating your service account, add this email to Search Console:');
-        console.log(`  📧 ${serviceAccountEmail}\n`);
-        printStep(3, 'Configure your MCP client');
-        showConfigSnippets(credentialsPath);
-        console.log('\n💡 Run this wizard again with your JSON file path for validation.\n');
-    }
-    // Step 5: Support the project
-    printStep(5, 'Support this project');
-    const answer = await ask('Would you like to star the repo on GitHub? (Y/n): ');
+        process.exit(1);
+    }
+    printStep(4, 'Configure your MCP client');
+    showConfigSnippets(credentialsPath);
+    console.log('\n🎉 Setup complete! You can now use Search Console MCP.\n');
+    await supportProject();
+    rl.close();
+}
+async function supportProject() {
+    const answer = await ask('\nWould you like to star the repo on GitHub? (Y/n): ');
     if (answer === '' || answer.toLowerCase().startsWith('y')) {
         try {
             const repo = resolveRepo(__dirname);
-            // Harden against command injection: ensure repo is in 'owner/repo' format
             if (repo && /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(repo)) {
                 execSync(`gh api -X PUT /user/starred/${repo}`, { stdio: 'ignore' });
                 printSuccess('Thanks for your support! ⭐');
             }
             else {
-                throw new Error('Invalid repository format');
+                console.log('🔗 https://github.com/saurabhsharma2u/search-console-mcp');
             }
         }
         catch (error) {
-            console.log('\nCould not star automatically. Please star us manually if you like:');
             console.log('🔗 https://github.com/saurabhsharma2u/search-console-mcp');
         }
     }
+}
+export async function main() {
+    printHeader();
+    console.log('Choose your authentication method:');
+    console.log('\n1. OAuth 2.0 Desktop Flow (Recommended)');
+    console.log('   - Pros: Automatic authorization, uses your direct Google Account.');
+    console.log('   - Requirement: Opens a browser window and starts a brief local server.');
+    console.log('\n2. Service Account (Advanced)');
+    console.log('   - Pros: Fixed credentials, ideal for server environments and automated tasks.');
+    console.log('   - Cons: Requires creating a Google Cloud Project and manual Search Console sharing.');
+    const choice = await ask('\nEnter your choice (1 or 2, default is 1): ');
+    if (choice === '2') {
+        await setupServiceAccount();
+    }
     else {
-        console.log('No problem! Enjoy using Search Console MCP.');
+        await login();
     }
-    rl.close();
 }
-// Run if called directly
 const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
 if (isMain) {
     main().catch((error) => {

package/dist/tools/analytics.js

@@ -1,4 +1,25 @@
 import { getSearchConsoleClient } from '../google-client.js';
+const CACHE_TTL_MS = 60 * 1000; // 60 seconds
+const MAX_CACHE_SIZE = 100;
+const analyticsCache = new Map();
+export function clearAnalyticsCache() {
+    analyticsCache.clear();
+}
+function generateCacheKey(options) {
+    const clone = { ...options };
+    // Dimensions order matters because it determines the order of keys in the response.
+    // We should NOT sort them.
+    /*
+    if (clone.dimensions) {
+      clone.dimensions = [...clone.dimensions].sort();
+    }
+    */
+    if (clone.filters) {
+        clone.filters = [...clone.filters].sort((a, b) => (a.dimension + a.operator + a.expression).localeCompare(b.dimension + b.operator + b.expression));
+    }
+    // Sort object keys
+    return JSON.stringify(clone, Object.keys(clone).sort());
+}
 /**
  * Executes a raw query against the Google Search Console Search Analytics API.
  * This is a low-level function used by many other tools in the project.
@@ -7,34 +28,67 @@ import { getSearchConsoleClient } from '../google-client.js';
  * @returns A promise resolving to an array of data rows from GSC.
  */
 export async function queryAnalytics(options) {
-    const client = await getSearchConsoleClient();
-    const requestBody = {
-        startDate: options.startDate,
-        endDate: options.endDate,
-        dimensions: options.dimensions || [],
-        type: options.type || 'web',
-        aggregationType: options.aggregationType || 'auto',
-        dataState: options.dataState || 'final',
-        rowLimit: Math.min(options.limit || 1000, 25000),
-    };
-    // Add pagination support
-    if (options.startRow !== undefined && options.startRow > 0) {
-        requestBody.startRow = options.startRow;
-    }
-    if (options.filters && options.filters.length > 0) {
-        requestBody.dimensionFilterGroups = [{
-                filters: options.filters.map(f => ({
-                    dimension: f.dimension,
-                    operator: f.operator,
-                    expression: f.expression
-                }))
-            }];
+    const cacheKey = generateCacheKey(options);
+    const now = Date.now();
+    const cached = analyticsCache.get(cacheKey);
+    if (cached) {
+        if ('then' in cached) {
+            return cached;
+        }
+        if (now - cached.timestamp < CACHE_TTL_MS) {
+            return cached.data;
+        }
+        analyticsCache.delete(cacheKey);
     }
-    const res = await client.searchanalytics.query({
-        siteUrl: options.siteUrl,
-        requestBody
-    });
-    return res.data.rows || [];
+    const fetchPromise = (async () => {
+        try {
+            const client = await getSearchConsoleClient();
+            const requestBody = {
+                startDate: options.startDate,
+                endDate: options.endDate,
+                dimensions: options.dimensions || [],
+                type: options.type || 'web',
+                aggregationType: options.aggregationType || 'auto',
+                dataState: options.dataState || 'final',
+                rowLimit: Math.min(options.limit || 1000, 25000),
+            };
+            // Add pagination support
+            if (options.startRow !== undefined && options.startRow > 0) {
+                requestBody.startRow = options.startRow;
+            }
+            if (options.filters && options.filters.length > 0) {
+                requestBody.dimensionFilterGroups = [{
+                        filters: options.filters.map(f => ({
+                            dimension: f.dimension,
+                            operator: f.operator,
+                            expression: f.expression
+                        }))
+                    }];
+            }
+            const res = await client.searchanalytics.query({
+                siteUrl: options.siteUrl,
+                requestBody
+            });
+            const rows = res.data.rows || [];
+            analyticsCache.set(cacheKey, {
+                data: rows,
+                timestamp: Date.now()
+            });
+            // Simple LRU-like eviction: remove oldest if over limit
+            if (analyticsCache.size > MAX_CACHE_SIZE) {
+                const firstKey = analyticsCache.keys().next().value;
+                if (firstKey)
+                    analyticsCache.delete(firstKey);
+            }
+            return rows;
+        }
+        catch (error) {
+            analyticsCache.delete(cacheKey);
+            throw error;
+        }
+    })();
+    analyticsCache.set(cacheKey, fetchPromise);
+    return fetchPromise;
 }
 /**
  * Get aggregate performance metrics for the last N days.

package/dist/tools/schema-validator.js

@@ -40,8 +40,8 @@ export async function validateSchema(input, type) {
         if (schemas.length === 0) {
             return { valid: false, errors: ["No structured data (JSON-LD) found"], schemas: [] };
         }
+        const validator = new Validator();
         const validationPromises = schemas.map(async (schema) => {
-            const validator = new Validator();
             try {
                 const result = await validator.validate(schema);
                 if (result && Array.isArray(result) && result.length > 0) {

package/dist/tools/seo-insights.js

@@ -66,12 +66,7 @@ export async function detectCannibalization(siteUrl, options = {}) {
         startDate: startDate.toISOString().split('T')[0],
         endDate: endDate.toISOString().split('T')[0],
         dimensions: ['query', 'page'],
-        limit: 10000,
-        filters: [{
-                dimension: 'position',
-                operator: 'smallerThan',
-                expression: '20' // Only care about cannibalization on first 2 pages
-            }]
+        limit: 10000
     });
     // Group by query
     const queryMap = new Map();
@@ -79,7 +74,7 @@ export async function detectCannibalization(siteUrl, options = {}) {
         const query = row.keys?.[0] ?? '';
         const page = row.keys?.[1] ?? '';
         const impressions = row.impressions ?? 0;
-        if (impressions < minImpressions)
+        if (impressions < minImpressions || (row.position ?? 100) > 20)
             continue;
         if (!queryMap.has(query)) {
             queryMap.set(query, []);

package/dist/tools/sites-health.js

@@ -128,8 +128,30 @@ export async function healthCheck(siteUrl) {
     if (allSites.length === 0) {
         return [];
     }
-    const reports = await Promise.all(allSites.map(site => checkSite(site.siteUrl)));
+    const reports = await limitConcurrency(allSites, 5, site => checkSite(site.siteUrl));
     // Sort: critical first, then warning, then healthy
     const order = { critical: 0, warning: 1, healthy: 2 };
     return reports.sort((a, b) => order[a.status] - order[b.status]);
 }
+/**
+ * Limit the number of concurrent executions of an async mapping function.
+ *
+ * @param items - The array of items to process.
+ * @param limit - The maximum number of concurrent executions.
+ * @param fn - The async function to execute for each item.
+ * @returns A promise that resolves to an array of results.
+ */
+async function limitConcurrency(items, limit, fn) {
+    const results = [];
+    const executing = new Set();
+    for (const item of items) {
+        const p = fn(item);
+        results.push(p);
+        const e = p.then(() => { executing.delete(e); }, () => { executing.delete(e); });
+        executing.add(e);
+        if (executing.size >= limit) {
+            await Promise.race(executing);
+        }
+    }
+    return Promise.all(results);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "search-console-mcp",
-  "version": "1.9.3",
+  "version": "1.10.1",
   "mcpName": "io.github.saurabhsharma2u/search-console-mcp",
   "description": "MCP server for Google Search Console API",
   "type": "module",
@@ -31,9 +31,12 @@
   "dependencies": {
     "@adobe/structured-data-validator": "^1.6.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "@napi-rs/keyring": "^1.2.0",
     "cheerio": "^1.2.0",
     "dotenv": "^17.2.3",
     "googleapis": "^171.0.0",
+    "node-machine-id": "^1.1.12",
+    "open": "^11.0.0",
     "re2": "^1.23.3",
     "zod": "^4.3.6"
   },
@@ -45,4 +48,4 @@
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   }
-}
+}