Search Console MCP on Cloudflare Workers

Read-only Google Search Console + Bing Webmaster Tools + PageSpeed Insights Remote MCP for Cloudflare Workers, designed for ChatGPT and other clients that support authenticated Streamable HTTP MCP.

This is a Workers-oriented adapter aligned with saurabhsharma2u/search-console-mcp. It does not run the upstream Node CLI inside Workers; local filesystem/keychain auth is replaced by Worker Secrets and WebCrypto-friendly REST calls.

Current v0.1 scope

The first milestone intentionally exposes only read operations:

• connection_status

• sites_list

• sitemaps_list

• analytics_query

• inspection_inspect

• bing_crawl_issues

• pagespeed_analyze

• compare_engines

No sitemap submission, URL submission, indexing submission, site deletion, or other external write action is exposed.

Related MCP server: Google Search Console MCP Server

Architecture

ChatGPT / MCP client
        │ HTTPS + OAuth (PKCE)
        ▼
Cloudflare Worker /mcp
   ├─ OAuth gate + SQLite Durable Object state
   ├─ Google Search Console REST
   │    └─ restricted service account / webmasters.readonly
   ├─ Bing Webmaster Tools REST
   │    └─ API key
   └─ PageSpeed Insights REST

External credentials are stored only as Cloudflare Worker Secrets. OAuth authorization codes and refresh tokens used by the MCP client are stored in a SQLite-backed Durable Object and consumed atomically.

Required secrets

npx wrangler secret put GOOGLE_SERVICE_ACCOUNT_JSON
npx wrangler secret put BING_API_KEY
npx wrangler secret put OAUTH_PASSWORD
npx wrangler secret put OAUTH_JWT_SECRET

Optional but recommended for stable PageSpeed quota:

npx wrangler secret put PAGESPEED_API_KEY

GOOGLE_SERVICE_ACCOUNT_JSON

Paste the entire downloaded service-account JSON file as the secret value. Do not commit it, upload it to issues, or split the private key into normal [vars].

The service account should be added to the target Search Console property with the minimum permissions needed. This Worker only requests:

https://www.googleapis.com/auth/webmasters.readonly

Local checks

npm install
npm run check
npm test
npm run build

npm run build is a Wrangler dry-run. It does not deploy.

Deploy

npx wrangler login
npm run deploy

Then configure the secrets above. The Remote MCP URL is:

https://<worker>.workers.dev/mcp

GET /health only reports configuration presence and process health. It never prints secret values and does not prove the external credentials are valid; verify with sites_list after deployment.

ChatGPT connection

Create a custom Remote MCP / Plugin connection using the Worker /mcp URL and OAuth. The Worker publishes OAuth discovery, dynamic client registration, PKCE S256, token refresh, and protected-resource metadata. The authorization page is protected by OAUTH_PASSWORD.

Start with:

Show connection_status, then list my verified sites from Google and Bing.

Only after both engines pass should cross-engine comparisons be trusted.

Security notes

• OAUTH_PASSWORD must be at least 16 characters.

• OAUTH_JWT_SECRET must be an independent random value of at least 32 characters.

• Keep CORS_ALLOWED_ORIGINS exact. Do not replace it with *.

• Google/Bing/API-returned text is untrusted data and is not treated as instructions.

• The Worker intentionally exposes no external write tools in v0.1.

• Cloudflare free-tier suitability depends on real request/CPU/storage usage and upstream API quotas; it is not an unlimited-use guarantee.

See NOTICE.md for upstream attribution.