search-console-mcp-server@0.2.1
Talk to your Google Search Console from Claude, Cursor, or any MCP client — one sign-in, no Google Cloud project required.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe post-login redirect deliberately reports the flow source and package version to the publisher’s site without a disclosed opt-out, so this is suspicious runtime telemetry. The inspected OAuth and Search Console requests send credentials and data to Google, and the redirect contains no Google token.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the `login` command and completes Google OAuth.
Impact
The publisher’s site receives the login-flow source and package version, along with ordinary browser request metadata; no Google token was observed in that redirect.
Mechanism
After storing tokens locally, the local callback redirects the browser to `www.getpercy.io` with `source=mcp-login` and the package version.
AI rationale
The post-login redirect deliberately reports the flow source and package version to the publisher’s site without a disclosed opt-out, so this is suspicious runtime telemetry. The inspected OAuth and Search Console requests send credentials and data to Google, and the redirect contains no Google token.
Evidence
dist/index.js~/.search-console-mcp/credentials.json
Network endpoints1
www.getpercy.io
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After Google sign-in, the browser is redirected to the publisher’s site with `source=mcp-login` and the package version in the URL.
- The CLI handles login only when invoked with the `login` command; successful authentication triggers the redirect.
- The package sends no Google credentials to Percy in the inspected flow; token exchange and Search Console API requests target Google.
Evidence against
- OAuth uses Google’s authorization and token endpoints, and requests Search Console data from Google.
- The package stores tokens locally in `~/.search-console-mcp/credentials.json`.
- The manifest’s `prepublishOnly` script builds the package; it is not an install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
9import { join } from "path";
L10: import { spawn } from "child_process";
L11: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
High
3// src/auth.ts
L4: import { createServer } from "http";
L5: import { createRequire } from "module";
...
L9: import { join } from "path";
L10: import { spawn } from "child_process";
L11: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
L12: var CLIENT_SECRET = process.env.SEARCH_CONSOLE_MCP_CLIENT_SECRET ?? "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";
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/index.jsView on unpkg · L33// src/auth.ts
L4: import { createServer } from "http";
L5: import { createRequire } from "module";
...
L9: import { join } from "path";
L10: import { spawn } from "child_process";
L11: var CLIENT_ID = process.env.SEARCH_CONSOLE_MCP_CLIENT_ID ?? "1032081156097-[redacted].apps.googleusercontent.com";
L12: var CLIENT_SECRET = process.env.SEARCH_CONSOLE_MCP_CLIENT_SECRET ?? "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";
L13: var SCOPE = "https://www.googleapis.com/auth/webmasters.readonly";
L14: var { version } = createRequire(import.meta.url)("../package.json");
L15: var SUCCESS_URL = new URL("https://www.getpercy.io/search-console-mcp/connected");
...
L18: var WORKSPACE_URL = "https://www.getpercy.io/sign-in?source=mcp&workflow=improve-page";
L19: var CRED_DIR = join(homedir(), ".search-console
Findings
3 High4 Medium5 Low
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to search-console-mcp-server@0.2.1.
See all versions of search-console-mcp-server for other recorded verdicts.
- Review the evidence and your use of search-console-mcp-server@0.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.