fix(mcp): make Search Console site_url optional so tenant auto-resolve works (H1) - #447
Merged
Conversation
…e works (H1) Every Search Console tool declared `site_url` in its inputSchema `required`, so `server.handle_call_tool` rejected an omitted `site_url` at `_validate_tool_input` before the handler ran — making `_resolve_site_url`'s single-property auto-resolution (for a tenant-scoped multi-account client) unreachable. This was review finding H1, which slipped through un-applied in #441. Drop `site_url` from `required` on all Search Console tools (it stays an optional property). Enforcement is unchanged: `_resolve_site_url` still `_require`s it in standalone use and binds it to the active client's allow-listed property under a multi-account backend (single → auto-resolve, multiple/out-of-scope/unconfigured → refuse, fail-closed). Verified end-to-end via `server.handle_call_tool` that no cross-tenant path opens. Adds a schema-path regression test (the existing tenant-scope tests call handlers directly, bypassing the schema that was the actual bug), updates the `test_required_fields` expectations, and syncs the docs/mcp-server.md required columns. Claude-Session: https://claude.ai/code/session_01X3WKmku93ucAR8DsatzLpG
Merged
hyoshi
added a commit
that referenced
this pull request
Jul 18, 2026
Bump 0.10.28 -> 0.10.29 (pyproject, __init__, plugin.json, gemini-extension.json, 51 SKILL.md frontmatters) and cut the CHANGELOG for the Search Console site_url schema fix (#447/H1) and the full documentation refresh (#446) merged since 0.10.28. Claude-Session: https://claude.ai/code/session_01X3WKmku93ucAR8DsatzLpG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes review finding H1, which slipped through un-applied in #441 (a dispatch miss — I reported it fixed when it wasn't; the docs audit surfaced it).
The bug
Every Search Console tool declared
site_urlin its inputSchemarequired, soserver.handle_call_toolrejected an omittedsite_urlat_validate_tool_inputbefore the handler ran — making_resolve_site_url's single-property auto-resolution (for a tenant-scoped multi-account client) unreachable. Fail-safe (rejects), so no security impact — but the documented feature was dead. The existing tenant-scope tests call handlers directly, bypassing the schema, so they never caught it.The fix
Drop
site_urlfromrequiredon all Search Console tools; it stays an optional property. Enforcement is unchanged and lives in_resolve_site_url:_requiressite_url— omitting it errors from the handler.Verification
server.handle_call_toolthat no cross-tenant path opens (sibling property refused, single auto-resolves to the tenant's own property only, empty allow-list fail-closed, whitespace/non-string handled). 越境不可を確認.test_search_console_site_url_optional.py) — fails before the fix, passes after. Updatedtest_required_fieldsexpectations. Synceddocs/mcp-server.mdrequired columns.pytest -k search_console→ 83 passed;ruff check mureo//black --check mureo//mypyclean.https://claude.ai/code/session_01X3WKmku93ucAR8DsatzLpG