# How to connect Google Search Console to Hermes Agent (no API keys)

> Connect Google Search Console to Hermes Agent with no Google Cloud project, no OAuth client, and no API keys. Hosted OAuth, 9 Search Console tools, and fixes for the GSC API errors agents actually hit.

Web version: https://claw-link.dev/hermes/google-search-console

Most guides for giving Hermes Agent Google Search Console access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Google Search Console setup: pair once in the browser and your always-on Hermes agent can act on Google Search Console for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself.

**Start here — paste this into Hermes to set up ClawLink:**

> Set up ClawLink for Hermes and tell me when it's ready.
> 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable`
> 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait.
> 3. I'll approve it in my browser, then reply "approved".
> 4. When I say approved, finish setup: `hermes clawlink finish`
> 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready.

## Setup

It takes three steps to connect Hermes to Google Search Console.

1. **Install ClawLink** — add the plugin to Hermes Agent once.
2. **Connect Google Search Console** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask Hermes Agent in plain English.

**Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect google-search-console  # connect Google Search Console (browser OAuth)
npx -y @useclawlink/cli actions google-search-console  # list available actions
npx -y @useclawlink/cli run google-search-console <action> --input '<json>'  # execute (add --confirm for writes)
```

### Install by command

The prompt above walks Hermes through this. By hand, it is four commands and a browser approval:

```bash
hermes plugins install ClawLink-HQ/hermes-plugin --enable
hermes clawlink begin    # prints an approval link — open it and approve
hermes clawlink finish   # after approving in the browser
hermes clawlink test
```

Then connect Google Search Console in the [ClawLink dashboard](https://claw-link.dev/dashboard) — a one-click OAuth approval, no API keys.

Verify the connection by asking Hermes:

> List my verified sites in Search Console, then run a search analytics query on my main property for the last 28 days grouped by query, and show the top 20 rows by clicks with impressions and average position.

### Using a different agent?

The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once Google Search Console is connected in the dashboard, that agent calls the same 9 Google Search Console tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## Google Search Console MCP for Hermes

Looking for a Google Search Console MCP server for Hermes Agent? ClawLink connects Google Search Console to Hermes Agent and exposes 9 Google Search Console tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Google Search Console integration](https://claw-link.dev/openclaw/google-search-console) runs on the same hosted Google provider and the same 9 tools; OpenClaw installs ClawLink through a ClawHub skill instead of the Hermes pairing commands.

The alternatives the answer engines teach for Hermes both put the setup burden on you: either a Google Cloud walkthrough ending with a client-secret JSON on the machine running Hermes, or a gateway route where you copy an MCP URL and API key into `~/.hermes/config.yaml` by hand and restart the agent. ClawLink needs neither a config file nor a key, because Google does not even issue API keys for Search Console data; access is OAuth or nothing. Pair Hermes once, click Connect, approve Google's consent screen, and the nine tools below read the properties your Google account already owns.

## What the Hermes Agent Google Search Console integration can do

9 Google Search Console tools are ready for Hermes Agent once the account is connected. The 8 below are the ones people reach for most; your agent can call all 9.

### 8 of 9 Google Search Console tools for Hermes

| Tool | What it does |
|---|---|
| **Add site** `google_search_console_add_site` | Add a site to Search Console |
| **Get site** `google_search_console_get_site` | Get details for a specific Search Console site |
| **Get sitemap** `google_search_console_get_sitemap` | Get sitemap metadata for a Search Console site |
| **Inspect URL** `google_search_console_inspect_url` | Inspect a URL for indexing status and issues |
| **List sitemaps** `google_search_console_list_sitemaps` | List sitemaps for a Search Console site |
| **List sites** `google_search_console_list_sites` | List verified Search Console sites |
| **Search analytics query** `google_search_console_search_analytics_query` | Query search analytics data (clicks, impressions, CTR, position) |
| **Submit sitemap** `google_search_console_submit_sitemap` | Submit a sitemap to Search Console |

## Example prompts

**Top queries**

> List my verified sites in Search Console, then run a search analytics query on my main property for the last 28 days grouped by query, and show the top 20 rows by clicks with impressions and average position.

**Compare two periods**

> Query search analytics for my site grouped by page for the last 28 days and for the 28 days before that, then list the pages whose clicks dropped the most between the two windows.

**Inspect a URL**

> Inspect my newest blog post's URL in Search Console and tell me whether it is indexed, and if it is not, what reason Google gives.

**Sitemaps**

> List the sitemaps submitted for my site. If the main one is missing or stale, submit it again using its full URL, and confirm what Google now reports for it.

## What the Search Console tools actually expect

The argument rules the Search Console API enforces, taken from the live schemas and our own failure logs rather than the docs alone.

- **`site_url` must match the property exactly, and it is the argument agents most often fail to pass at all.** URL-prefix properties are the full URL with protocol and trailing slash (`https://www.example.com/`); domain properties use `sc-domain:example.com`. `arguments.site_url is required` is the most common logged Search Console failure in ClawLink. The fix is always the same: `google_search_console_list_sites` first, then reuse a `siteUrl` verbatim.
- **`aggregation_type` takes `auto` or `byProperty`.** The screaming-case guess `BY_PROPERTY` draws a Google 400 (`'BY_PROPERTY' is not a valid aggregation type in the context of the request`), and `byProperty` is also invalid when grouping by `page`. Omit the argument unless you have a reason not to.
- **`searchAppearance` has to be queried alone.** Combining it with any other dimension returns `Cannot group by search appearance dimension together with another dimension.`
- **Search analytics wants explicit `start_date` and `end_date` in YYYY-MM-DD, caps at 5,000 rows per call, and omits anonymized queries** when grouping by query, so summed rows undercount the UI totals by design.
- **URL inspection requires the page to belong to the property you name**, or Google answers 403 `You do not own this site, or the inspected URL is not part of this property.` The API is capped at 2,000 inspections per property per day.
- **`feedpath` on the sitemap tools is the full sitemap URL** (`https://www.example.com/sitemap.xml`), not a relative path.
- **There are nine tools, and the one missing from the table above is `google_search_console_delete_site`.** It removes a property from the connected account without touching the site or its verification. If you never want it used, say so in your agent's instructions.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google Search Console working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Connection flow** | Register a Google Search Console app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect Google Search Console through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Google Search Console. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right Google Search Console actions to the runtime in a format your agent can reliably use. | 9 tools for Google Search Console are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes Google Search Console to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Google Search Console in the browser, and the 9 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### Hermes paired but still can't use Google Search Console
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

### Connection succeeds but no tools appear
Reconnect Google Search Console from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling Google Search Console tools
Google Search Console tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Google Search Console call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### Google Search Console returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### "User does not have sufficient permission for site" (403) from Google Search Console
Despite the wording, the usual cause is the property string, not the permission. A domain property queried as a URL, a missing trailing slash on a URL-prefix property, or an invented example value all fail exactly like this. Ask the agent to call `google_search_console_list_sites` and retry with a `siteUrl` copied verbatim. Only if the string checks out is it a real access problem, fixed in Search Console under Settings, then Users and permissions, by the account that owns the property. Reconnecting ClawLink fixes neither cause.

### "is not a verified Search Console site in this account" (404) from Google Search Console
The connection signed into a Google account that has no such property, most often because the site was verified under a different account than the one chosen on the consent screen. Run `google_search_console_list_sites` to see what the connection can reach. If the site is missing, reconnect with the owning account or add this account as a user on the property.

### "BY_PROPERTY is not a valid aggregation type in the context of the request" (400) when querying search analytics
An enum-shape guess. The API accepts `auto` or `byProperty` in camelCase, and `byProperty` is rejected outright when the query groups by `page`. Have the agent drop `aggregation_type` from the call; `auto` chooses correctly for whatever dimensions are present.

### "Connected account is in EXPIRED state" when Hermes calls Google Search Console
Google invalidated the refresh token behind the connection, through a password change, a revocation, or long inactivity. Nothing on the Hermes side fixes it: reconnect Google Search Console from the ClawLink dashboard, approve the consent screen again, and start a fresh chat so Hermes reloads its tool catalog.

### OAuth finished in the browser but the account is still missing
Try reconnecting Google Search Console and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

### Is there a Hermes Agent Google Search Console integration?
Yes. ClawLink is the fastest way to connect Hermes to Google Search Console: link your Google Search Console account once in the browser and Hermes Agent can call the Google Search Console API through 9 ready-made tools — no custom code or token handling.

### How do I connect Google Search Console to Hermes with ClawLink?
Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Google Search Console in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

### How long does it take to connect Google Search Console to Hermes Agent?
About two minutes. Sign in, click Connect next to Google Search Console in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

### Why use ClawLink instead of wiring Google Search Console up myself?
The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google Search Console working from chat.

### Can I connect Google Search Console to Hermes with an API key instead of OAuth?
No, because Google does not sell that door: API keys identify an application and only work for public data, while search analytics, sitemaps and indexing status are private account data. OAuth is the only access route Google offers. The practical difference between providers is who owns the OAuth app. With ClawLink it is us, so there is no Google Cloud project, no client-secret JSON, and no `~/.hermes/config.yaml` edit; you sign in on Google's consent screen and the token stays with ClawLink.

### Do I need my own Google Cloud project or OAuth app to give Hermes access to Search Console?
No. That requirement belongs to the self-hosted route, where you create the project, enable the Search Console API, and mint your own OAuth client before anything works. ClawLink's verified Google OAuth app replaces all of it. Pair Hermes, click Connect next to Google Search Console in the dashboard, approve, done.

### Which Google permissions does the Search Console connection request?
Two Search Console scopes, `https://www.googleapis.com/auth/webmasters` and `https://www.googleapis.com/auth/webmasters.readonly`, plus basic profile and email to label the connection. We read that scope string off a live connection, not the marketing page. The grant covers reading search analytics, managing properties and sitemaps; it cannot edit your site or its verification. You can revoke it at any moment under Third-party apps and services in your Google account, or delete the connection in the ClawLink dashboard.

### Can Hermes make Google reindex my pages?
No tool on this page forces reindexing, and that limit is Google's: the Indexing API accepts only JobPosting and BroadcastEvent pages, so a request-indexing call for ordinary pages does not exist in any MCP server or connector, whatever their catalogs imply. Hermes can inspect a URL to see how Google views it and submit a sitemap to nudge discovery, which is what Search Console itself offers.

### Hermes paired but still can't use Google Search Console
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

## Related

- [Google Classroom tools](https://claw-link.dev/hermes/google-classroom) — Manage classes, coursework, and students
- [Hermes Google Calendar integration](https://claw-link.dev/hermes/google-calendar) — Create and manage calendar events
- [Google Sheets tools](https://claw-link.dev/hermes/google-sheets) — Read and write spreadsheet data