
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
mcp-google-search-console
Advanced tools
MCP server for the Google Search Console API — search analytics, sitemaps, URL inspection and site management. For Claude, Cursor, Codex and other AI clients.
English | Русский
A1 Google Search Console MCP connects an AI app to Google Search Console. Investigate search performance, check whether a URL is indexed, inspect sitemaps and deliberately submit or remove a sitemap when needed.
It works with the properties your Google account can access. The important detail is that it uses the exact Search Console property value — a domain property and a URL-prefix property are different objects.
https://example.com/, https://www.example.com/ and sc-domain:example.com are distinct. list_sites shows the value to use.Start with a read-only question:
Show the top 20 search queries for my property over the last 28 days, with clicks and CTR.
Connect the server · Explore use cases · Open technical documentation
You: Is
https://example.com/pricingindexed? If not, why?Assistant: Inspects the URL and shows the index verdict, coverage, crawl information and canonical URLs. Nothing changes.
You: Check my submitted sitemaps and prepare a resubmission for the one with errors.
Assistant: Shows the sitemap, its warnings and errors, then asks for confirmation before submitting it again.
You: Confirm.
Assistant: Resubmits the selected sitemap. It does not change page content or guarantee indexing.
You need Node.js 20+, a Google account with access to a Search Console property and OAuth credentials from Google Cloud.
In the app: open Settings → Plugins → MCP servers, choose Add server, then add npx -y mcp-google-search-console@latest with GOOGLE_SEARCH_CONSOLE_CLIENT_ID, GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET and GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN.
codex mcp add google-search-console \
--env GOOGLE_SEARCH_CONSOLE_CLIENT_ID=your_client_id \
--env GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET=your_client_secret \
--env GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN=your_refresh_token \
-- npx -y mcp-google-search-console@latest
codex mcp list
claude mcp add \
--env GOOGLE_SEARCH_CONSOLE_CLIENT_ID=your_client_id \
--env GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET=your_client_secret \
--env GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN=your_refresh_token \
--transport stdio --scope user google-search-console \
-- npx -y mcp-google-search-console@latest
claude mcp list
Open Settings → Developer → Edit Config and add:
{"mcpServers":{"google-search-console":{"command":"npx","args":["-y","mcp-google-search-console@latest"],"env":{"GOOGLE_SEARCH_CONSOLE_CLIENT_ID":"your_client_id","GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET":"your_client_secret","GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN":"your_refresh_token"}}}}
If Edit Config is unavailable, edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows.
Add to ~/.cursor/mcp.json on macOS/Linux or %USERPROFILE%\.cursor\mcp.json on Windows:
{"mcpServers":{"google-search-console":{"type":"stdio","command":"npx","args":["-y","mcp-google-search-console@latest"],"env":{"GOOGLE_SEARCH_CONSOLE_CLIENT_ID":"your_client_id","GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET":"your_client_secret","GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN":"your_refresh_token"}}}}
Run MCP: Open User Configuration and add:
{"servers":{"google-search-console":{"type":"stdio","command":"npx","args":["-y","mcp-google-search-console@latest"],"env":{"GOOGLE_SEARCH_CONSOLE_CLIENT_ID":"${input:gsc_client_id}","GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET":"${input:gsc_client_secret}","GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN":"${input:gsc_refresh_token}"}}},"inputs":[{"type":"promptString","id":"gsc_client_id","description":"Google OAuth client ID"},{"type":"promptString","id":"gsc_client_secret","description":"Google OAuth client secret","password":true},{"type":"promptString","id":"gsc_refresh_token","description":"Google OAuth refresh token","password":true}]}
Check it with MCP: List Servers. VS Code MCP documentation
mcp where average position is below 10.A URL-prefix property must include its protocol and trailing slash, for example https://example.com/. A domain property is written as sc-domain:example.com. A near-match causes 403 or 404, so use the exact value returned by list_sites.
add_site only registers a property. Verification remains in the Search Console UI or Site Verification API. Search data uses Pacific Time; end_date is inclusive and final analytics data typically lags by two to three days. data_state: "all" can include fresher, still-changing rows.
| Operation | What happens | Confirmation boundary |
|---|---|---|
| List properties, analytics, sitemaps and URL status | Reads Search Console data | No change |
| Add a property | Adds a property entry; does not verify it | Changes account access |
| Submit or resubmit a sitemap | Requests processing of a sitemap | Changes Search Console state |
| Delete a property | Unlinks the property from the account; Google data is not deleted | Destructive |
| Delete a sitemap | Removes a submitted sitemap | Destructive |
| Raw API request | May call a write or delete endpoint | Potentially destructive |
The AI client controls confirmation prompts. The server marks reads, writes and destructive calls so the client can distinguish an inspection from a real change.
Search Console data requires Google OAuth 2.0; an API key is not enough.
https://www.googleapis.com/auth/webmasters to include sitemaps and property changes. Use https://www.googleapis.com/auth/webmasters.readonly only if you intentionally need read-only access.Testing-mode refresh tokens can expire after seven days. Publish the OAuth app, or use an Internal Workspace app, for long-lived access. Treat the client secret and refresh token as passwords.
| Variable | Required | Description |
|---|---|---|
GOOGLE_SEARCH_CONSOLE_CLIENT_ID | Yes* | OAuth client ID. |
GOOGLE_SEARCH_CONSOLE_CLIENT_SECRET | Yes* | OAuth client secret. |
GOOGLE_SEARCH_CONSOLE_REFRESH_TOKEN | Yes* | OAuth refresh token. |
GOOGLE_SEARCH_CONSOLE_ACCESS_TOKEN | Yes* | Short-lived alternative to the OAuth trio. |
GOOGLE_SEARCH_CONSOLE_API_BASE | No | API base URL override. |
GOOGLE_SEARCH_CONSOLE_TIMEOUT_MS | No | Per-request timeout; default 60000 ms. |
GOOGLE_SEARCH_CONSOLE_MAX_RETRIES | No | Temporary-error retries; default 3. |
* Provide either the OAuth trio or an access token.
ASKADS_TELEMETRY=0 to opt out.Found a bug or need a scenario? Create an issue or write in Telegram.
You made it to the end!
FAQs
MCP server for the Google Search Console API — search analytics, sitemaps, URL inspection and site management. For Claude, Cursor, Codex and other AI clients.
We found that mcp-google-search-console demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.