Google Search Console — Remote MCP Connector

A production-ready remote MCP server that gives Claude full access to your Google Search Console data. Deployed as a serverless AWS Lambda container, managed entirely with Terraform.

Architecture

Edit the diagram: open images/architecture.drawio in draw.io.

Claude.ai ──HTTPS/MCP──▶ Lambda Function URL
                              │
                    Lambda Web Adapter (TCP :8080)
                              │
                    FastMCP Server (streamable-http)
                    ├── PropertyService
                    ├── AnalyticsService
                    ├── InspectionService
                    ├── IndexingService
                    └── SitemapService
                              │
                    CredentialProvider ──▶ AWS Secrets Manager
                    GoogleServiceFactory ──▶ Google APIs

Tools exposed to Claude

Category	Tool	Description
Properties	list_properties	List all GSC properties
	get_property	Details for a specific property
	add_property	Add a new property
	delete_property	Remove a property
Analytics	get_search_performance	Full analytics query (any dimension/filter)
	get_top_queries	Top queries by clicks
	get_top_pages	Top pages by clicks
	get_performance_by_country	Country breakdown
	get_performance_by_device	Device breakdown
	get_daily_trend	Daily click/impression trend
	get_page_queries	All queries driving traffic to a page
	get_search_appearance_breakdown	Rich results, AMP, Discover breakdown
	compare_periods	Compare two date ranges
Inspection	inspect_url	Full URL inspection (indexing, mobile, rich results)
	batch_inspect_urls	Inspect up to 10 URLs at once
Indexing	request_indexing	Submit a URL for indexing
	batch_request_indexing	Submit multiple URLs for indexing
	notify_url_deleted	Notify Google a URL was deleted
	get_indexing_status	Check indexing notification status
Sitemaps	list_sitemaps	List all submitted sitemaps
	get_sitemap	Detailed sitemap info including errors
	submit_sitemap	Submit a sitemap
	delete_sitemap	Remove a sitemap
	refresh_sitemap	Force re-submission (delete + resubmit)

Prerequisites

• AWS CLI configured (aws sts get-caller-identity should succeed)
• Terraform ≥ 1.6
• Docker with buildx support
• Python 3.12+ (local dev/tests only)

Local development

cd google-search-console

# 1. Copy and fill in credentials
cp .env.example .env
# Edit .env with your GOOGLE_CLIENT_SECRET and GOOGLE_REFRESH_TOKEN

# 2. Install dependencies
pip install -r app/requirements.txt

# 3. Run the server locally
cd app
source ../.env
python main.py
# Server starts at http://localhost:8080/mcp

Run tests

# From project root
pip install pytest
pytest tests/ -v

Deploy to AWS

# From project root
./deploy.sh

The script will:

1. Load credentials from .env
2. terraform init + plan + apply
3. Build the Docker image and push to ECR
4. Create the Lambda function with a public Function URL
5. Print the MCP endpoint URL

Add to Claude

After deploy, copy the printed URL (e.g. https://xxx.lambda-url.eu-central-1.on.aws/mcp) and add it as a custom connector:

1. Go to Claude → Customize → Connectors
2. Click + → Add custom connector
3. Paste the URL
4. Click Add

Project structure

google-search-console/
├── app/
│   ├── main.py          # Entry point
│   ├── server.py        # Composition root
│   ├── auth/
│   │   └── credentials.py   # CredentialProvider (Strategy pattern)
│   ├── gsc/
│   │   ├── factory.py   # GoogleServiceFactory
│   │   ├── properties.py
│   │   ├── analytics.py
│   │   ├── inspection.py
│   │   ├── indexing.py
│   │   └── sitemaps.py
│   ├── tools/           # MCP tool registrations
│   ├── requirements.txt
│   └── Dockerfile
├── terraform/
│   ├── main.tf          # Provider + backend
│   ├── ecr.tf           # ECR + Docker build
│   ├── lambda.tf        # Lambda + Function URL
│   ├── iam.tf           # IAM roles (least privilege)
│   ├── secrets.tf       # Secrets Manager
│   ├── variables.tf
│   └── outputs.tf
├── tests/
├── images/
│   └── architecture.drawio
├── deploy.sh
├── .env.example
└── .gitignore

Security notes

• Google credentials are stored in AWS Secrets Manager, never in environment variables in production
• Lambda IAM role has least-privilege access (reads only its specific secret)
• Credentials are auto-refreshed and cached (thread-safe)
• Error messages never expose credential values
• .gitignore prevents committing .env, token.json, or client_secrets.json
• ECR has image scanning enabled on push
• CloudWatch logs retained for 14 days