brodesigns/gsc-readonly-mcp

Read-only MCP server for the Google Search
Console API. Search analytics, sitemap status, URL inspection, property
listing, nothing else.
Design choice: no write scope, not even gated. No submitsitemap, no
deletesitemap, no way to change anything in Search Console. If you need
those, look elsewhere; this project stays deliberately small so it is easy to
audit in one sitting.
## Tools
| Tool | Does |
| listsites | Lists every property the service account can access |
| listsitemaps | Sitemap status for a property (errors, warnings, indexed count) |
| searchanalyticsquery | Clicks, impressions, CTR, position, grouped by query/page/date/etc. |
| inspecturl | Index status, canonical URL, mobile usability for one URL |
## Setup
### 1. Create a service account and download its JSON key
1. Google Cloud Console → create or
select a project.
2. APIs & Services → Library → enable Search Console API.
3. APIs & Services → Credentials → Create Credentials → Service Account.
4. Open the new service account → Keys → Add Key → Create new key → JSON.
The file downloads automatically.
5. Open the file, note the clientemail field
(...@...iam.gserviceaccount.com).
### 2. Grant that service account access in Search Console
1. Search Console → open the
property.
2. Settings → Users and permissions → Add user.
3. Paste the clientemail from step 1. Use Full if you need
searchanalyticsquery (Restricted users hit a permission error on that
endpoint), Restricted is enough for listsites/listsitemaps.
### 3. Store the key file somewhere outside any git repo
bash
mkdir -p ~/.config/gsc
mv ~/Downloads/your-key-.json ~/.config/gsc/service-account.json
chmod 600 ~/.config/gsc/service-account.json
### 4. Configure your MCP client
Claude Code:
bash
claude mcp add gsc-readonly \
-e GSCSERVICEACCOUNTKEYFILE=~/.config/gsc/service-account.json \
-e GSCSITEURL="https://example.de/" \
-- npx -y @brodesigns/gsc-readonly-mcp
Or in .mcp.json:
json
"mcpServers": {
"gsc-readonly": {
"command": "npx",
"args": ["-y", "@brodesigns/gsc-readonly-mcp"],
"env": {
"GSCSERVICEACCOUNTKEYFILE": "/absolute/path/to/service-account.json",
"GSCSITEURL": "https://example.de/"
GSCSITEURL is optional; every tool also accepts a siteurl argument that
overrides it, useful if the same MCP server should cover several properties.
Important: use the property URL exactly as Search Console shows it.
Domain properties look like sc-domain:example.de, URL-prefix properties
look like https://example.de/. Passing the wrong form fails silently or
with a permission error even though the account has access.
## Why this exists