# Google Analytics MCP for Coolify

This package places a secure FastMCP HTTP/OAuth gateway in front of Google's
official experimental `analytics-mcp` package. It is intended to be deployed as
a **separate Coolify application** and does not modify an existing Google Ads
MCP deployment.

## What it provides

- Streamable HTTP MCP endpoint at `/mcp`
- Google OAuth protection for the remote MCP endpoint
- Encrypted persistent storage for MCP OAuth registrations and tokens
- Google Analytics Admin API and Data API tools from the official
  `analytics-mcp` package
- Support for either authorized-user ADC JSON or a service-account JSON key

## Required Coolify configuration

Create a persistent storage mount at `/data` and expose port `8080`.

Set these environment variables in the new Analytics application:

| Variable | Purpose |
| --- | --- |
| `GOOGLE_PROJECT_ID` | Existing Google Cloud project ID |
| `GOOGLE_ANALYTICS_MCP_BASE_URL` | Final HTTPS origin, without `/mcp` |
| `GOOGLE_ANALYTICS_MCP_OAUTH_CLIENT_ID` | Google OAuth web client ID |
| `GOOGLE_ANALYTICS_MCP_OAUTH_CLIENT_SECRET` | Google OAuth web client secret |
| `GOOGLE_ANALYTICS_MCP_JWT_SIGNING_KEY` | Long random secret used to sign MCP tokens |
| `GOOGLE_ANALYTICS_MCP_STORAGE_ENCRYPTION_KEY` | Fernet key used to encrypt stored OAuth data |
| `GOOGLE_ANALYTICS_CREDENTIALS_JSON` | Analytics-authorized ADC JSON, entered as one secret value |

`PORT` is optional and defaults to `8080`.

## Google Cloud configuration

Enable both APIs in the same Google Cloud project:

- Google Analytics Admin API
- Google Analytics Data API

The OAuth client must be a **Web application**. Add this authorized redirect
URI after the final domain is assigned:

```text
https://YOUR-ANALYTICS-MCP-DOMAIN/auth/callback
```

The MCP URL added to ChatGPT is:

```text
https://YOUR-ANALYTICS-MCP-DOMAIN/mcp
```

## Important credential separation

Do not alter the existing Ads application or replace its credentials. The
`GOOGLE_ANALYTICS_CREDENTIALS_JSON` value belongs only to this separate
Analytics application and must include the
`https://www.googleapis.com/auth/analytics.readonly` scope.

When the Google OAuth consent screen is in Testing, Google may expire
authorized-user refresh tokens after seven days. That is a Google OAuth
testing limitation, not a Coolify failure.

## Versions

- `analytics-mcp==0.7.0`
- `fastmcp==3.4.7`
- Python 3.11

The version pins make deployments repeatable. Review upstream releases before
updating them.