Insights MCP

Insights MCP is the internal application MoonFactory X uses to read reporting data from a client’s own Google accounts and assemble it into the reports published on this host.

It is not a consumer product and there is nothing here to sign up for. It runs on MoonFactory X machines, is operated by MoonFactory X staff, and connects only to accounts a client has explicitly granted it.

01What it does

Once a client grants access, Insights MCP reads that client’s traffic, search, and listing data and turns it into a written report. A person at MoonFactory X requests a report for a named client and a named month; the application makes the API calls, and the figures it returns are placed into the report alongside the source and date range that produced them.

Every number in a finished report is traceable to a specific call against a specific property over a stated range. Nothing is modelled, estimated, or carried over from a previous month.

02What it reads

• Google Analytics — analytics.readonly. Property configuration, and traffic and engagement data for the range printed on the report.
• Google Search Console — webmasters.readonly. Search performance, sitemap status, and index coverage for the client’s verified properties.
• Google Business Profile — business.manage, requested only where a client asks for local reporting. Location details, performance metrics, and reviews.

The application holds these permissions and no others. Where a client has not asked for local reporting, the Business Profile permission is never requested and never consented to.

It also reads four sources that require no access to a client’s Google account at all, and hold none of their data:

• PageSpeed Insights and the Chrome UX Report — page speed and real-user experience for a public address. Search Console publishes no interface for these.
• The Knowledge Graph — what Google publicly holds about a business as an entity: its name, its description, and the address it lists as official.
• The client’s own website — fetched as any visitor would fetch it, to check what is actually published: whether the analytics tag is on the page, what the sitemap contains, where the redirects lead, what robots.txt permits.

That last one matters more than it sounds. A property reporting no visitors and a site with no tag on it look identical in Analytics. Reading the page is how we tell them apart, and it is read exactly as the public reads it.

These four use a public interface key rather than a client’s permission, and reach only addresses that are already public.

03Why the Business Profile permission looks broader than it is

Google publishes no read-only permission for Business Profile. The only permission available also allows editing a listing, publishing posts, and replying to or deleting reviews. We state that plainly rather than let the consent screen imply otherwise.

We use it to read. Three things constrain it:

• The application contains no function that writes. There is no code path that can publish, edit, reply, or delete.
• Its network layer permits read requests and refuses everything else, to every Business Profile endpoint, before a request leaves the machine.
• The permission is off unless a client asks for local reporting, and is not requested at all otherwise.

A client can withdraw it at any time from their Google account permissions page, or by removing our account from the listing. Access ends immediately.

04What it cannot do

Across every connected account, the application cannot publish or edit content, change a setting, alter a listing, reply to or delete a review, submit a sitemap, request indexing, annotate Analytics, or create, modify, or delete anything at all. It reads, and the reading is the whole function.

It writes in three places, and none of them is Google.

The first is a record of figures. When a month closes, that month’s figures are recorded to a file on the MoonFactory X machine, so a later report compares against what was actually read rather than asking Google the same question again and receiving a different answer. Analytics thresholds and Search Console’s sixteen-month window can both change what a past range returns, and a comparison that shifts underneath a finished report is worse than no comparison at all.

The second is a record of what was published and sent, described in section 07.

The third is a message posted to the client’s own channel in our Slack workspace when a report is delivered, described in section 06. That is the only thing the application writes that leaves our machines, and it can do nothing else in Slack — it cannot edit a message, delete one, remove anyone, or touch a file. Those abilities are not merely unused; they are absent from the list of operations the application is permitted to perform.

Nothing in any of the three can reach a Google account.

05How one client’s data is kept from another’s

MoonFactory X reports for several clients. Each client’s access is held separately — their own consent, their own stored permission, and a written declaration of exactly which Analytics property, which Search Console property, and which website address belong to them.

A request made for one client is checked against that declaration before it leaves the machine. A request naming any other client’s property is refused outright: not filtered out of the result afterwards, but refused before it is sent. The check sits in the single place every request passes through, so no part of the application can go around it.

Every request the application makes is recorded to a log on the same machine — the time, the client it was made for, the report it was made for, and the interface it was sent to. That is the record of whose data was read, and when. It holds no permission, no key, and no personal data.

The declaration also names the one Slack channel that belongs to each client. A report asked for in a channel is answered for the client that channel belongs to, and that client then governs every request the report makes — so a channel recorded against the wrong client cannot put one client’s figures in front of another. The same check does both jobs.

06Where a report is delivered

A finished report is published to a private address on this host and announced in the client’s own channel in the MoonFactory X Slack workspace. The announcement carries the headline figures and the address; the report itself stays on this host behind its own credentials.

This means a summary of information derived from a client’s Google data passes through Slack, which processes it on our behalf as the messaging service we use to reach the client. It goes to that client’s channel and to no other. It is not sold, not used for advertising, and not shared with anyone outside the client and MoonFactory X staff. A client who would rather receive reports without Slack can say so and we will deliver by another route.

The application also reads the client’s channel before writing a report, so that a question asked there is answered in the report rather than missed. It reads the channels it has been added to and nothing else, and it cannot read a private conversation it is not part of.

Reports arrive on a schedule rather than on request. A client can also ask for the current one at any time with a command in their own channel; the reply carries the same address and no figure the report does not already show.

07Which version you are reading

A report can be corrected after it has been sent. When that happens the address does not change, so without a marker there would be no way to tell a corrected report from the one first delivered — and no way for us to prove which is which either.

Every publication is recorded: the client, the period, the exact content, where it went and when. A report reissued after it has already been read carries the amendment date and a version number on its face, and a statement above the first plate of what changed. If a figure you were shown has moved, that notice tells you so before you find it yourself.

08How a report is opened

A report is not protected by a password we hand out. Access is checked at the network edge, before a request reaches this host at all, against the email address of the person asking. Each client has their own rule, written against their own email domain.

That means access belongs to a person rather than to a shared secret. Someone who leaves is removed without disturbing anyone else, nothing has to be re-issued to everybody when one person changes, and there is a record of who opened what and when. A password in an email could do none of those things.

If you are asked to sign in and were not expecting it, do not — write to rev@moonfactory.dev and tell us what you saw.

09What we watch between reports

A monthly report describes a month that has already happened. Most of what goes wrong on a website is worth knowing about the same week, not four weeks later, so the application checks every client it is tracking once a day.

It checks that the measurement tag is still on the site, that traffic and search have not fallen sharply against the week before, that robots.txt has not started refusing crawlers, that submitted sitemaps are still being read, and that the property is still configured to count what matters. It also looks for searches where the site already ranks just below the point where people click.

Every check has a number behind it, and anything that does not cross that number is not reported at all. What is found goes to MoonFactory X, not to the client’s channel — it is our work list, and it is how something is usually fixed before it appears in a report as a decline.

10Google user data — limited use

11Who uses it

MoonFactory X staff, on behalf of MoonFactory X clients. There is no public sign-up, no shared instance, and no third-party access. If you have arrived here from a Google consent screen and were not expecting it, do not grant access — write to rev@moonfactory.dev and tell us what you saw.

12What it produces

• TRANSIT — the monthly performance report. Traffic, search, the pages that worked, index health, and the work being done about it.
• OCCULTATION — the incident record, issued when something goes wrong.

Both are published to private addresses on this host and delivered to the client directly. There is no index, nothing is linked from anywhere, and no address can be reached without signing in.

13Contact

MoonFactory X — rev@moonfactory.dev. Questions about access, scopes, or what is held are answered by the same address.