Google Tag Manager MCP

MCP connector dedicated to Tag Manager, built with the same criteria as "Gustavo google ads- mcp": each action explicitly asks for account / container / workspace (or version) — nothing implicit — and actions that affect production (pausing a tag, publishing a version) require confirm=true. This replaces the previous "open Chrome and read the screen" approach, which was the most fragile tab in the panel because it depended on the web interface instead of a typed API.

Cost: the Tag Manager API is free (no Google charges for normal use). It deploys as a second free Web Service on Render, just like "Gustavo google ads- mcp" — same plan, same cost (zero) as you already have today.

How credentials are organized (standardized pattern)

This server does NOT use a token.json file in production — it uses environment variables, like the rest of your connectors on Render:

• GOOGLE_ADS_CLIENT_ID / GOOGLE_ADS_CLIENT_SECRET — they are reused; they are the same OAuth client that "Gustavo google ads- mcp" already uses. There's no need to create a new client per tool.

• GTM_REFRESH_TOKEN — the only new value, specific to Tag Manager.

If you ever prefer a separate OAuth client just for Tag Manager, you can define GTM_CLIENT_ID / GTM_CLIENT_SECRET and they take priority over the Google Ads ones.

Related MCP server: Samarth GTM MCP Server

1. Upload the code to GitHub

1. Repo already created: github.com/gustavomkt/mcp-tagmanager (public).

2. Upload all the files in this folder except client_secret.json, token.json, and .flow_state.json (those are only for local testing; they should never be uploaded — the .gitignore already excludes them).

2. Deploy on Render

1. Render → New → Web Service → connect the mcp-tagmanager repo.

2. Runtime: Docker (it detects the Dockerfile automatically).

3. Plan: Free.

4. Environment Variables (add them yourself in the Render dashboard — they are credentials, so I'm not going to fill them in for you):

   • GOOGLE_ADS_CLIENT_ID = the same value you already have in the Google Ads service.

   • GOOGLE_ADS_CLIENT_SECRET = the same value you already have in the Google Ads service.

   • GTM_REFRESH_TOKEN = the refresh token we already generated for Tag Manager (I shared it with you separately in the chat).

5. Create Web Service. When the build finishes, copy the public URL (something like https://mcp-tagmanager.onrender.com).

3. Connect it in Claude

Add it as a new remote MCP connector, pointing to the Render URL from the previous step (with /mcp at the end, e.g. https://mcp-tagmanager.onrender.com/mcp — it's the standard streamable-http endpoint). Once connected, let me know and I'll update the Tag Manager tab in the control panel to use these real tools instead of the browser-based instructions.

Alternative: run it locally with a file (without Render)

If you ever want to run it on your laptop instead of Render:

pip install -r requirements.txt
python auth_setup.py   # una vez, abre tu navegador
python server.py       # sin PORT definido, corre por stdio

server.py first looks for GTM_REFRESH_TOKEN + client_id/secret in environment variables; if it doesn't find them, it falls back to token.json.

Available tools

Read (they don't change anything):

• list_accounts()

• list_containers(account_id)

• list_workspaces(account_id, container_id)

• list_tags(account_id, container_id, workspace_id)

• get_tag(account_id, container_id, workspace_id, tag_id)

• list_triggers(account_id, container_id, workspace_id)

• list_variables(account_id, container_id, workspace_id)

• audit_workspace(account_id, container_id, workspace_id) — tags without trigger, triggers without tag, possible duplicates, and whether Consent Mode is configured. It's the reliable version of what we used to ask Claude in Chrome to "read from the screen and guess".

• list_versions(account_id, container_id)

Write (they require confirm=true):

• pause_tag(...) / resume_tag(...) — pauses or resumes a tag in the workspace. It doesn't publish the container.

• create_version(...) — creates a version from the workspace. It doesn't publish.

• publish_version(account_id, container_id, version_id, confirm=true) — publishes a version (it goes to production). Use it also to roll back: pass it the version_id of an earlier version from list_versions.

Stability notes

• Every call to the Google API is wrapped in error handling that returns a clear message ({"ok": false, "error": "..."}) instead of dropping the MCP connection without explanation — that kind of silent failure was part of why the other connectors "went down" without warning.

• The token refreshes itself on every call using the refresh token; if it's ever revoked (password change, manual revocation at myaccount.google.com), the error will tell you explicitly and you only need to generate a new GTM_REFRESH_TOKEN.

• Being a free Render Web Service, it "sleeps" after a while without use and the first call after that takes ~50 seconds to respond — just like "Gustavo google ads- mcp" today. It's the most likely cause of connectors seeming to "go down": it's not an error, it's the cold start of the free plan. If you ever want to eliminate that delay, the only way is a paid plan on Render — your decision, not something I change without you asking me to.