Shows whether this server is connected to Google: token presence and source (env variables or a stored in-chat login), expiry, the Google account email, granted vs missing OAuth scopes, where the credentials file lives and where the OAuth client comes from. Makes no network calls and never returns the token itself. Call it first when other tools report the server is not connected.

Step-by-step checklist for connecting this server to Google: creating a Google Cloud project and a Desktop-app OAuth client, publishing the consent screen (mandatory — Testing-mode refresh tokens die after 7 days), downloading the client JSON and handing its PATH to set_client. Works without any credentials; the checklist shortens to 'enable the API + log in' when an OAuth client is already configured (one client serves the whole mcp-google-* line). Never asks the user to paste secrets into the chat.

Saves the OAuth client credentials from the JSON file downloaded from Google Cloud Console ('Download JSON' on a Desktop-app client). Pass the file PATH — the secret must never be pasted into the chat. The client is stored once in the shared ~/.config/mcp-google-auth/client.json (owner-only) and reused by every mcp-google-* server; tokens stay per-server. After this, call start_login.

First step of connecting from the chat, without editing config files or restarting the client. Returns authorizeUrl — show it to the user as a clickable link and ask them to open it in the browser ON THIS MACHINE, pick the Google account and approve access. A one-shot listener on 127.0.0.1 catches Google's redirect; the code is exchanged locally and never passes through the chat. Does not open the browser itself. The attempt lives 10 minutes; when the browser shows the success page, call finish_login.

Second step: confirms the browser consent finished, saves the tokens to an owner-only file and verifies the login with a read-only identity call, returning the account email and the granted scopes. After success every tool works immediately — no client restart. If the user granted only part of the requested permissions, the login is still saved and missingScopes lists what will not work. Logging in under a different Google account replaces the previous login (its refresh token is revoked best-effort) and the response carries previousAccountEmail so the change never goes unnoticed.

Revokes the stored token at Google (oauth2.googleapis.com/revoke) and deletes the local credentials file. Tokens supplied via env variables are NOT touched — remove them from the MCP client config manually; envTokenStillSet in the response says whether any are still in effect.

Lists all Google Tag Manager accounts the authorized user can access. Returns { account: [{ accountId, name, path, fingerprint }], nextPageToken }. All ids are strings. This is the entry point: every other tool needs an accountId (or a path) from here.

Gets one Google Tag Manager account by id. Returns the Account resource: { accountId, name, path, fingerprint, shareData }.

Lists the containers of a GTM account. Returns { container: [{ containerId, name, publicId (e.g. GTM-XXXXXX), usageContext, path, fingerprint, tagManagerUrl }], nextPageToken }.

Gets one container by account id + container id. Returns the Container resource including publicId (the GTM-XXXXXX snippet id), usageContext and fingerprint.

Creates a new container in a GTM account. usage_context declares the platform, e.g. ["web"]; other values include androidSdk5, iosSdk5, server. Returns the created Container with its server-assigned containerId and publicId. Requires the tagmanager.edit.containers scope.

Lists the workspaces of a container. Returns { workspace: [{ workspaceId, name, description, path, fingerprint }], nextPageToken }. Workspaces are mandatory in GTM v2: every tag/trigger/variable operation needs a workspaceId, and a "Default Workspace" always exists — call this first.

Gets one workspace by account id + container id + workspace id. Returns the Workspace resource with its fingerprint.

Creates a new workspace in a container — an isolated draft where tags, triggers and variables are edited before being compiled into a version. Returns the created Workspace with its server-assigned workspaceId. Requires the tagmanager.edit.containers scope.

Lists the tags of a workspace. Returns { tag: [{ tagId, name, type (e.g. html, gaawe), parameter: [{ type, key, value, list, map }], firingTriggerId, blockingTriggerId, paused, path, fingerprint, tagManagerUrl }], nextPageToken }.

Lists the triggers of a workspace. Returns { trigger: [{ triggerId, name, type (e.g. pageview, click, customEvent), filter/customEventFilter (conditions of { type, parameter }), path, fingerprint }], nextPageToken }.

Lists the user-defined variables of a workspace (built-in variables live in manage_built_in_variables). Returns { variable: [{ variableId, name, type (e.g. v = data layer, jsm = custom JS, c = constant), parameter, path, fingerprint }], nextPageToken }.

Generic getter for any GTM resource by its API-relative path — tags, triggers, variables, versions, containers, workspaces. Prefer echoing the path field from a previous response over assembling the string yourself. Returns the full resource JSON including its current fingerprint (needed for update_entity).

Creates a tag, trigger or variable in a workspace. body is the resource JSON: minimally { name, type } plus type-specific parameter entries; tags also take firingTriggerId (array of trigger id strings). Example tag body: { "name": "GA4 event", "type": "gaawe", "parameter": [...], "firingTriggerId": ["12"] }. Returns the created resource with its server-assigned id and fingerprint. Requires the tagmanager.edit.containers scope.

Updates a tag, trigger or variable by its API path. PUT semantics: this is a FULL REPLACE, not a patch — fetch the current resource with get_resource, modify it, and send the whole object back. Pass the resource's last-seen fingerprint for optimistic-concurrency safety; a mismatch fails the request. Requires the tagmanager.edit.containers scope.

Deletes a tag, trigger or variable by its API path. The response is empty on success. Requires the tagmanager.edit.containers scope.

Manages a workspace's built-in variables (pageUrl, clickText, event, ...). These are toggles, not records: action "list" returns the currently enabled ones ({ builtInVariable: [...] }), "enable" and "disable" take types (BuiltInVariableType enum values) and switch them on/off. Enable/disable require the tagmanager.edit.containers scope.

Compiles a workspace into an immutable Container Version (the unit that gets published). SIDE EFFECT: the source workspace is DELETED and replaced by a fresh one — the response's newWorkspacePath points to the replacement; use it for any further edits, or old workspace paths will 404. Returns { containerVersion (with containerVersionId and full tag/trigger/variable snapshots), syncStatus, newWorkspacePath }. A compile failure comes back as compilerError=true with HTTP 200 and is reported as an error. Requires the tagmanager.edit.containerversions scope (edit.containers is NOT sufficient).

Container-version operations. action "publish" pushes a version live (replacing the currently published one; requires the tagmanager.publish scope; version_id required, fingerprint recommended). action "get" fetches one version by version_id. action "live" fetches the currently published version of the container (no version_id needed). Publish responses can carry compilerError=true with HTTP 200 — reported as an error. Returns the ContainerVersion (publish wraps it as { containerVersion, compilerError }).

Escape hatch to call any Google Tag Manager API v2 path directly, for endpoints without a dedicated tool (environments, folders, templates, zones, workspace :sync / :quick_preview, version_headers, ...). path is relative to /tagmanager/v2/, e.g. "accounts/1/containers/2/environments". query values may be arrays for repeated params. Requests go through the same OAuth, rate limiter and retries as every other tool.