Privacy Policy for Suganthan's GSC MCP

Last updated: 3 August 2026

What this covers

This policy covers Suganthan's GSC MCP, the free and open source Google Search Console MCP server distributed as the suganthan-gsc-mcp package on npm and on GitHub. The website you are reading this on has its own separate privacy policy.

The short version

The software runs entirely on your own computer. We operate no servers for it, we receive no data from it, and we store nothing about you. Your Search Console data travels directly between your machine and Google.

What the software accesses

With your consent, granted through Google's sign in flow, the software reads Google Search Console data for properties your Google account can access: search queries, clicks, impressions, positions, page URLs, device and country breakdowns, sitemap status, and URL index status. It fetches this data on demand, only when you ask a question that needs it.

If you choose the optional full access mode during setup, the software can also submit sitemaps and notify Google about new or updated URLs on your sites. Both actions only ever run when you explicitly ask for them.

Where your data goes

Every request goes straight from your machine to Google's APIs, and every response comes straight back. There is no intermediary server, no proxy, and no copy sent to us or anyone else.

The answers you request are shown inside the AI assistant you connect the software to, such as Claude. What that assistant does with the conversation is governed by its own privacy policy, not this one. We are not in that path either.

What we store

Nothing. The software keeps your Google sign in token in a local file on your computer (~/.gsc-mcp/oauth-token.json) so you do not have to sign in every time. You can delete that file whenever you like. The software contains no analytics, no telemetry, and no crash reporting.

Google sign in and scopes

By default the software requests a single read only permission (webmasters.readonly). If you choose full access during setup, it additionally requests the Search Console management permission (webmasters) for sitemap submission and the indexing permission (indexing) for URL submission.

The sign in flow may use an OAuth client that ships inside the package. That client identifies the app to Google's consent screen and grants no access by itself; you always sign in with your own Google account, and your tokens stay on your machine.

Limited Use disclosure

Suganthan's GSC MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice the software goes further than that policy requires: Google user data is processed only on your own device, is never transmitted to the developer or any third party by the software, is never used for advertising, and is never stored beyond the local token file described above.

Revoking access

Two steps, either is sufficient: revoke the app's access at myaccount.google.com/permissions, and delete the local token file at ~/.gsc-mcp/oauth-token.json.

Verifying these claims

The software is open source under the Apache 2.0 licence. Every claim on this page can be checked against the code on GitHub.

Changes to this policy

If the software's behaviour ever changes in a way that affects this policy, the policy will be updated here and the change noted in the project changelog before the release ships.

Contact

For privacy questions or requests, contact:
Email: sugan@suganthan.com