TOOLKIT

Search Console MCP

Google Search Console, Bing Webmaster Tools, GA4 and AdSense behind one MCP server: 21 tools, of which 16 read and 5 change your property. Set up with one npx command and an OAuth window.

by Saurabh Sharma saurabhsharma2u/search-console-mcpMIT licence289 starscommit ec9cf15

The reading side is the reason to install it: multi-engine analytics queries, period-over-period and drop-attribution comparisons, anomaly detection, URL inspection, PageSpeed, seven SEO audit types (quick wins, striking distance, cannibalisation, lost queries, brand versus non-brand), and a heuristic that flags conversational queries as likely AI-fan-out traffic, which the README is careful to call custom logic with no official API behind it.

The writing side is what the README does not say: `sites_manage` and `accounts_manage` add or delete a property, `sitemaps_submit` and `sitemaps_delete` change sitemaps, and `indexing_submit` submits or removes URLs through IndexNow or the Google and Bing APIs. None of these has an approval step in the server. A careless prompt can delete a sitemap.

Tokens go to the OS keychain first, with an AES-256-GCM file fallback keyed to the machine; only the refresh token and its expiry are persisted.

Connects to: Google Search Console, Bing Webmaster Tools, GA4, Google AdSense
Access: 16 read tools; 5 write tools (add or delete a site, submit or delete a sitemap, submit or remove URLs) with no approval gate
Tools: 21, 5 of them write

Connect

npx search-console-mcp setup
# then in your MCP client config: { "command": "npx", "args": ["search-console-mcp"] }

Run this in a terminal inside your project folder. Claude Code, Cursor and Codex then read the skill from where it lands.

Requires

Node (npx)
a Google account with access to the properties; a separate OAuth scope for AdSense
Bing Webmaster API key for the Bing side

Safety review of the skill text and its scripts
Network	yes	Google, Bing and AdSense APIs with your tokens; PageSpeed Insights for the audit tool.
Shell	no	Runs under npx; exposes no shell.
Secrets	yes	OAuth refresh tokens in the OS keychain or an encrypted file at mode 600.
Deletes	yes	sites_manage delete, sitemaps_delete and indexing_submit remove exist and are not gated. Read the tool name back before you confirm a prompt that touches them.

What it exposes

21 tools, and which ones change things

All tools: sites_list sites_manage accounts_manage sitemaps_list sitemaps_submit sitemaps_delete analytics_query analytics_compare analytics_anomalies inspection_inspect pagespeed_analyze indexing_submit indexing_status seo_audit seo_keywords_research site_health_check compare_engines genai_query_insights adsense_accounts adsense_report adsense_payments_alerts

Writes

sites_manage (add, delete)
sitemaps_submit
sitemaps_delete
indexing_submit (standard, index_now, remove)
accounts_manage (add_site, remove)

Pairs with

Skills that work on what it reads

How to install these skills: three routes into Claude Code, and one line to check they loaded.

Method behind it

Our guide to measuring AI visibility explains why Search Console cannot show AI citations and what it can show (impressions on conversational queries). The server’s genai_query_insights tool is that same heuristic, and its README says so.

How to measure AI visibility: manual method and pitfalls

Questions

Questions people ask before installing

Is it read-only?

No. Sixteen of its twenty-one tools read; five write, including delete operations on sites and sitemaps and URL removal requests, without a confirmation step in the server. Use a Google account whose Search Console role is restricted if you want it to be read-only.

Does it show AI Overview or ChatGPT citations?

No, and it does not claim to. genai_query_insights flags query phrasing that looks conversational; it is a heuristic over ordinary Search Console rows, labelled as such in the README.

Where do my tokens live?

macOS Keychain, Windows Credential Manager or Linux Secret Service; failing those, an AES-256-GCM file keyed to your hardware ID. Only the refresh token and expiry are stored.