Google Seo Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 15

  prepare

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  deploy/deploy-vps.sh, line 8

  p -d --build --remove-orphans; sleep 3; curl -fsS http://127.0.0.1:8787/healthz && ec

  deploy/vps-self-update.sh, line 12

  if curl -fsS http://127.0.0.1:8787/healthz >/dev/null 2>&1; then

  src/digest.ts, line 104

  fetch(p.current, "page"), fetch(p.previous, "page"), fetch(p.current, "query"), fetch(p.previous, "query"),

  Show more

  src/hosted/githubApp.ts, line 34

  const res = await fetch(`${API}${path}`, { ...init, headers: { A

  src/hosted/githubApp.ts, line 55

  const res = await fetch("https://github.com/login/oauth/access_t

  src/tools/analysis.ts, line 535

  offset: z.number().int().min(0).max(9).default(0).describe("Result page to fetch (0 = first 'count' results, 1 = next, up to 9): how to reach beyond the first 20 mentions."),

  src/tools/github.ts, line 36

  const res = await fetch(`${API}${path}`, { ...init, headers: { A

  src/tools/github.ts, line 108

  const res = await fetch(`${API}/repos/${repo}/actions/jobs/${job

  src/tools/web.ts, line 23

  return await fetch(url, { ...init, signal: ctrl.signal, headers: { "User-Agent": UA, Accept: "*/*", ...(init.headers ?? {}) } });

  src/tools/wp.ts, line 1004

  yoastSitemap: z.boolean().default(false).describe("Also clear Yoast's cached XML sitemaps, so the next fetch (or gsc_submit_sitemap) sees current data."),

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  CLAUDE.md, line 19

  npm run auth -- --client-secret ./client_secret.json # 一次性 OAuth 授权，写入 ~/.config/google-seo-mcp/credentials.json

  src/auth.ts, line 10

  * ~/.config/google-seo-mcp/credentials.json (Google APIs) or ~/.config/google-seo-mcp/gmail.json (--gmail),

  src/env.ts, line 27

  const file = fileURLToPath(new URL("../.env", import.meta.url));

  Show more

  src/google.ts, line 19

  "credentials.json",

  src/google.ts, line 26

  * 3. ~/.config/google-seo-mcp/credentials.json - written by `npm run auth`

  .env.example, line 3

  # Copy to .env (gitignored). The server loads it at startup; existing

  .env.example, line 64

  WP_SITES=[{"name":"mysite","host":"1.2.3.4","port":22,"user":"ssh_user","path":"domains/example.com/public_html","identityFile":"~/.ssh/id_ed25519"}]

  .github/workflows/deploy.yml, line 39

  if git diff --name-only "$base" HEAD | grep -vqE '(\.md$|^docs/|^\.env\.example$|^LICENSE$)'; then echo "code=true" >> "$GITHUB_OUTPUT"; else echo "code=false" >> "$GITHUB_OUTPUT";

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 04c659934c4c. runs a script at install time. accepts a host from input, with no fixed list in this file. reads a credential or environment file.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen