google-analytics-gtm-mcp

One Model Context Protocol (MCP) server for Google Analytics 4 and Google Tag Manager, with both read and write access. Connect it to Claude (or any MCP client) and, in natural language, pull GA4 reports, manage measurement configuration, build remarketing audiences, and edit and publish GTM tags, triggers, and variables — all with your own Google credentials. No third-party service, no subscription.

A single Google Cloud service account powers both surfaces: grant it access in Google Analytics and in Tag Manager, point one environment variable at its key, and you get 40 tools across the two products from one server entry.

Features

Google Analytics 4 — read

• List accounts and properties, property details, and data streams

• Run GA4 reports (run_report) and realtime reports (run_realtime_report)

• List custom dimensions, custom metrics, key events (conversions), and audiences

Google Analytics 4 — write

• Create and archive custom dimensions; create custom metrics

• Create key events (conversions)

• Create and archive audiences (remarketing lists you can share to Google Ads)

• Create / list / delete Measurement Protocol API secrets

• Send events via the Measurement Protocol (with a validate=True mode that checks a payload without ingesting it)

Google Tag Manager — read

• List accounts, containers, workspaces, tags, triggers, and variables

• Get a single tag; list container versions; get the live (published) version

Google Tag Manager — write

• Create, update, and delete tags, triggers, and variables

• Create a container version from a workspace

• Publish a version to live (guarded by confirm=true)

Related MCP server: gsc-mcp

Requirements

• Python 3.10+ (the MCP SDK requires it)

• A Google Cloud project and a service account with a JSON key

• The service account granted access on your GA4 account/property and your GTM account/container

Google setup (one time)

1. In the Google Cloud Console, create (or pick) a project.

2. Enable three APIs for that project: Google Analytics Data API, Google Analytics Admin API, and Tag Manager API.

3. Create a service account and download a JSON key for it. Note its email (...@your-project.iam.gserviceaccount.com).

4. In Google Analytics → Admin → Account (or Property) access management, add that email as a user — Editor if you want write access, Viewer/Analyst for read-only.

5. In Tag Manager → Admin → User Management (at the account and/or container level), add the same email — grant Publish (container permission) if you want to create and publish versions, or Read for read-only.

That's it — no OAuth consent screen, no token refresh. The service account authenticates directly.

Install

Using uv (recommended — it manages an isolated Python for you):

git clone https://github.com/burhan29ee/google-analytics-gtm-mcp.git
cd google-analytics-gtm-mcp
uv venv --python 3.12 .venv
uv pip install --python .venv/bin/python -e .

Or with pip:

python3 -m venv .venv && source .venv/bin/activate
pip install -e .

Configure your MCP client

Point the server at your service-account key with the GOOGLE_APPLICATION_CREDENTIALS environment variable, then add it to your client. For Claude Desktop, edit claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json; Windows: %APPDATA%\Claude\claude_desktop_config.json):

{
  "mcpServers": {
    "google-analytics-gtm": {
      "command": "/absolute/path/to/google-analytics-gtm-mcp/.venv/bin/python",
      "args": ["-m", "google_analytics_gtm_mcp.server"],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/path/to/service-account-key.json"
      }
    }
  }
}

Restart the client. You should be able to ask things like "list my GA4 properties," "pull last 28 days of users and conversions by channel," "create a remarketing audience of everyone who fired generate_lead in the last 60 days," or "list the tags in my GTM container and show me the live version."

Tool reference

Google Analytics 4

Google Tag Manager

Development

pip install -e ".[dev]"
ruff check .
pytest -q

See CONTRIBUTING.md for the full workflow.

Security

The service-account key is a credential — treat it like a password. Never commit it (the .gitignore blocks key files), grant the service account the least access it needs in each product, and rotate the key if it's ever exposed. GTM write tools that affect a live container (gtm_delete_*, gtm_publish_version) require confirm=true. See SECURITY.md for details and how to report a vulnerability.

Notes

• The mcp dependency is pinned to >=1.2,<2. The 2.0 SDK reorganized its API and removed mcp.server.fastmcp, which this server uses.

• GA4 audiences use the GA4 Admin v1alpha API; the rest of GA4 uses the stable v1beta and Data APIs. GTM uses the Tag Manager v2 API.

• This is an independent open-source project and is not affiliated with or endorsed by Google.

License

MIT