v0.5.0

What's new

4 new tools, hostname/country filters on all GA4 tools, 222 tests (55 added). 36 tools total.

New tools

CrUX — real-user Core Web Vitals from the Chrome UX Report API (requires CRUX_API_KEY):

• crux_page_vitals — LCP, INP, CLS, FCP, TTFB with good/needs_improvement/poor ratings and p75
• crux_history — 25 weeks of weekly p75 series per metric, for tracking regressions

Sitemaps:

• sitemap_audit — fetches a sitemap (or sitemap index), parses URLs with defusedxml (prevents XXE/billion-laughs), and cross-references against 90 days of GSC data. Verdicts: empty, fetch_error, partial (>20% URLs not in GSC), healthy

Technical:

• schema_validate — fetches any public URL, extracts JSON-LD blocks, validates required fields per schema type (Article, LocalBusiness, FAQPage, Product, WebSite...), and suggests missing schemas from URL patterns. No auth required

GA4 filters

All 6 GA4 tools and the 2 cross tools now accept hostname and country parameters. Pass either or both to filter results to a specific subdomain or country without changing anything else.

Security / reliability fixes

• sitemap_audit: child sitemaps in a sitemap index are validated against the parent's origin (follow_redirects=False) to prevent SSRF via poisoned sitemap index files
• auth.py: token directory created with 0o700, token file chmod 0o600 after write
• retry.py: extends exponential backoff to GA4 gRPC errors (ServiceUnavailable, ResourceExhausted, InternalServerError, BadGateway, RetryError) in addition to the existing GSC HTTP errors

New dependencies

• httpx>=0.27.0 — used by crux_page_vitals, crux_history, sitemap_audit, schema_validate
• defusedxml>=0.7.1 — used by sitemap_audit for safe XML parsing

Breaking changes

None. All existing tools behave identically when the new parameters are omitted.