Question 1

Do I need a Google Cloud project to use GSC PAP?

Accepted Answer

No. The whole reason GSC PAP exists is to remove the Google Cloud setup step. When you sign in with Google through gscpap.com, you grant permission to our OAuth client (which we registered with Google one time). We then call the Search Console API on your behalf using your refresh token. You never touch the Google Cloud Console.

If you were running an MCP server yourself, you would need to create a GCP project, enable the Search Console API, create OAuth 2.0 credentials, download a JSON file, distribute it across machines, manage refresh token rotation, and re-authenticate every time the token expires. That setup typically takes 30-45 minutes the first time and breaks in confusing ways when something rotates.

GSC PAP handles all of that for you. You sign in with Google, copy a single bearer token, paste it into Claude Desktop, Cursor, or Claude Code, and start asking questions. Total time from first visit to first query is around 60 seconds.

Question 2

Which AI clients support GSC PAP?

Accepted Answer

GSC PAP is exposed as an MCP (Model Context Protocol) server. Any AI client that speaks MCP can connect. As of April 2026, the actively supported clients are Claude Desktop, Cursor, and Claude Code (the Anthropic CLI). All three implement the MCP HTTP transport that we use, so no extra adapter is required.

The Model Context Protocol is an open standard published by Anthropic in late 2024. It lets AI assistants call external tools through a uniform JSON-RPC interface, with the server advertising what tools it has and the client invoking them as the conversation needs them. Any new AI client that adds MCP support will work with us automatically - no changes on our side.

If your client only supports stdio-mode MCP (an older transport), you can wrap our HTTP endpoint with a small bridge such as mcp-proxy. We also track emerging MCP clients (OpenAI's experimental support, JetBrains AI Assistant, etc.) and will document new integrations as they reach a usable state.

Question 3

How do I add GSC PAP to Claude Desktop, Cursor, or Claude Code?

Accepted Answer

The flow is the same for all three clients: sign in with Google at gscpap.com, copy the bearer token shown on the connect screen, then paste a JSON config or run a single CLI command in your AI client. Total time about 60 seconds, all from the same web page.

For Claude Desktop, paste the provided JSON into ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows, then restart the app. For Cursor, paste the same shape into ~/.cursor/mcp.json and reload Cursor's MCP server list. For Claude Code, run a single claude mcp add command - we generate the exact command for you on the connect screen with your token already inlined.

If you ever lose the token, you can mint a new one anytime from /account/tokens. Existing tokens stay valid (multi-bearer model), so you can rotate without breaking other clients. To revoke a specific token without affecting others, click revoke next to it in the same page - the rest keep working.

Question 4

What Search Console data can GSC PAP access?

Accepted Answer

GSC PAP requests the webmasters.readonly OAuth scope - the same read-only level you would grant to any third-party Search Console viewer. Specifically we can read your verified site list, search analytics (clicks, impressions, CTR, position by query, page, country, device, date), sitemap submission status, and URL inspection results. This is exactly the data you see in your own Search Console UI.

We cannot write, modify, or delete anything in your Search Console: not sites, not sitemaps, not indexing requests, not anything. The OAuth scope we request technically excludes write operations, so even if our service were compromised, an attacker could not change your Search Console state. The worst case is read-only data exposure - which is why we encrypt every refresh token at rest with AES-256-GCM.

Beyond what Google provides natively, GSC PAP keeps a Personal Archive of your data so you can query beyond Google's 16-month native window. Your archive is private to your account; no other GSC PAP user can see it. See our Privacy Policy for the full storage and retention details.

Question 5

Can other users see my data?

Accepted Answer

No. Your Search Console data, OAuth tokens, MCP sessions, archive, and tool call history are all isolated to your user account in our database. Every query passes through bearer-token authentication that resolves to a specific user, and every database query scopes results by user_id. There is no UI, API endpoint, or feature that exposes one user's data to another user.

This isolation is enforced at multiple layers: row-level filtering in every Postgres query, application-layer middleware that fails closed if user_id is missing from a request, and rate limits scoped per-user so one user's traffic cannot affect another's quota. The Personal Archive uses partitioned tables but the partition key is date, not user - rows from all users coexist physically but are filtered logically by user_id on every read.

The one exception is the operator (us). We may access your data for support, debugging, abuse investigation, or aggregate analysis - and every operator access is written to an audit log. This is documented transparently in our Privacy Policy. We never share, sell, or use your data for AI training. If you delete your account, your data is hard-deleted within 30 days of the request.

Question 6

How do I revoke access?

Accepted Answer

You have three independent ways to revoke. First, revoke a single MCP token from /account/tokens - this kills only that bearer, leaving other tokens (e.g. on different machines) working. Useful if you suspect one token has been exposed but want to keep using GSC PAP elsewhere.

Second, revoke the entire Google OAuth grant from your Google Account at myaccount.google.com/permissions - this severs our ability to call the Search Console API at all, even with a valid bearer. Useful if you want to cut us off completely without deleting your account.

Third, delete your account from /account/profile (Danger zone). This is the nuclear option: every MCP token is revoked, the Google OAuth grant is revoked at Google's side, your encrypted refresh token is marked revoked in our database, and a 30-day soft-delete grace period begins. After 30 days everything is hard-deleted including your Personal Archive. The grace period exists so you can recover an accidentally deleted account by signing in again before the timer expires.

Question 7

Is GSC PAP free? What are the limits?

Accepted Answer

Yes, GSC PAP is completely free during the public preview (v0.x). There is no credit card required, no trial expiration, and no premium feature gate. The only limits are technical ones to protect the service: 60 MCP tool calls per minute and 1,000 per hour per user. These limits are generous - typical AI assistant usage is 5-20 calls per question, so you can ask hundreds of questions per hour without hitting them.

Once we reach v1.0 and the service is stable, we will move to a paid model. Pricing is not finalized but the principles are: pay-as-you-go, transparent per-tool-call cost, and a free tier that covers light personal use. We will give all preview users at least 60 days notice and free-tier credits before any pricing change takes effect.

For the underlying Google Search Console API, Google enforces its own quota of 200 queries per minute per user and 1,200 per minute per project. We aggressively cache and deduplicate calls so you stay under these limits even with multiple AI clients connected to the same account. If you do hit a Google quota error, we surface it transparently in the tool response so your AI can back off gracefully.

Question 8

How far back does my data go?

Accepted Answer

Google Search Console itself only retains the most recent 16 months of data. Anything older drops off Google's side and cannot be recovered, even with API access - this is a hard limit Google enforces on every Search Console user, including direct users of the official Google Search Console UI.

GSC PAP solves this with the Personal Archive feature. After you sign in, you can trigger a one-time backfill from /account/archive that pulls your entire 16-month native window into our database. From then on, our daily cron job fetches yesterday's data automatically (4 days behind today, because Google's analytics data takes 3-4 days to stabilize). Your archive grows day by day forever, with no cap on age.

When your AI assistant queries via the search_analytics_query MCP tool, we automatically serve from the archive when the query covers stable past data (older than 3 days) and from the live Google API for recent or unstable data. This means zero quota cost for historical queries, and you can ask questions like "show me query trends over the last 24 months" - far beyond what Google's UI allows.

Frequently asked questions

Setup