registry / search-console-mcp-server / 0.1.0
search-console-mcp-server@0.1.0
Talk to your Google Search Console from Claude, Cursor, or any MCP client — one sign-in, no Google Cloud project required.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/index.jsView file
8import { join } from "path";
L9: import { spawn } from "child_process";
L10: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
High
3// src/auth.ts
L4: import { createServer } from "http";
L5: import { createHash, randomBytes } from "crypto";
...
L8: import { join } from "path";
L9: import { spawn } from "child_process";
L10: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
L11: var CLIENT_SECRET = process.env.SEARCH_CONSOLE_MCP_CLIENT_SECRET ?? "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";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L33// src/auth.ts
L4: import { createServer } from "http";
L5: import { createHash, randomBytes } from "crypto";
...
L8: import { join } from "path";
L9: import { spawn } from "child_process";
L10: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
L11: var CLIENT_SECRET = process.env.SEARCH_CONSOLE_MCP_CLIENT_SECRET ?? "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";
...
L13: var SUCCESS_URL = "https://www.getpercy.io/search-console-mcp/connected";
L14: var CRED_DIR = join(homedir(), ".search-console-mcp");
L15: var CRED_FILE = join(CRED_DIR, "credentials.json");
L16: function b64url(buf) {
L17: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
Findings
4 High3 Medium5 Low
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to search-console-mcp-server@0.1.0.
See all versions of search-console-mcp-server for other recorded verdicts.
- Review the evidence and your use of search-console-mcp-server@0.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.