Google Analytics 4

Google Analytics 4 MCP server

Understand what happens after the click.

Explore traffic, conversions, funnels and property configuration through a read-only MCP server.

Watch the film · What's new · Install · Tool reference · Try hosted getmcpads

[Play the 45-second film](https://www.getmcpads.com/home/film/get-mcp-ads-brand-film-1080p.mp4)

The film shows hosted getmcpads with sample data. Its MCP Apps, from creative galleries and alerts to Google Sheets exports and bulk launches, belong to the hosted product. This repository provides the standalone native API tools.

27 read tools · Read-only by design.

Run locally with your own platform credentials and a client that supports stdio MCP, such as Claude Desktop, Claude Code or Cursor. Your requests go directly to the platform. For managed connections, including supported ChatGPT setups, use the hosted option.

What's new

[v2.1.1: Zod 4 security update](https://github.com/get-mcp-ads/google-analytics-mcp-server/releases/tag/v2.1.1) · October 26, 2026

• Update zod to 4.6.7. Every Zod release before 4.6.6 is covered by the high-severity advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory, and no Zod 3 release carries the fix. npm audit --omit=dev reports no vulnerability again.
• Keep the Zod 3 validation behaviour. A parameter default is still validated and completed before use, so an omitted object must still supply its required fields.
• Keep each parameter's own description when the parameter is optional or has a default. Zod 4 stores a description on the wrapped schema only, so the shared fallback description could otherwise replace it.
• Tool names, parameters and descriptions published over MCP are unchanged. server-card.json is regenerated with Zod 4's JSON Schema output, which spells some constraints differently.

Earlier releases

Full changelog · All releases

Source synchronization: SOURCE_SYNC.md.

Upgrade notes

Requires Node.js 22.23.4, 24.22.1 or 26.12.1, or a newer release of one of these lines. Older releases lack the October 2026 security fixes, and the server prints a warning on stderr when it starts on one. CI covers Node 22, 24 and 26.

This release makes no breaking change to the configuration. One change is announced for 3.0.0: GA4_PROPERTY_IDS is optional in 2.x and becomes required. When set, every tool is limited to the listed properties, and GA4_PROPERTY_ID must be one of them. When unset, the server starts as before and prints one line on stderr recommending it. The tools and their schemas are unchanged.

Install this release

This is a GitHub source release. npm and MCP Registry versions are published separately. The commands below select this exact version; unpinned npx examples later in this document select the version currently available on npm.

git clone --branch v2.1.1 --depth 1 https://github.com/get-mcp-ads/google-analytics-mcp-server.git

cd google-analytics-mcp-server npm ci npm run build

Configure your MCP client to run node with the absolute path to dist/cli.js and the platform credentials documented below.

Prefer a managed connection? Use Google Analytics 4 with hosted getmcpads. Connect your account, select the data your assistant may access and use the hosted MCP connection. See the site for current features and plans.

What you get

Compatibility, checked before the call

GA4 rejects many metric and dimension combinations, and its errors rarely explain which pair is at fault. This server carries the compatibility matrix, so ga4_check_compatibility and ga4_validate_query let the model verify a combination before spending a call and a quota token on it.

Quotas matter here more than on ad platforms: GA4 charges tokens per property per day, and a few careless exploratory queries can exhaust them. ga4_get_property_quotas_snapshot shows what is left.

Read-only, and why it stays that way

There are no write tools, and no environment variable that adds any. Every tool calls a read method of the Data API or the Admin API.

This is not caution for its own sake. A misread report is a wrong answer you can spot. A mistaken write to an analytics property, a deleted audience or an edited data stream, corrupts the record you use to judge everything else, and often silently. The other servers we publish do have write tools, guarded by a mandatory preview. This one has none.

Our ad platform servers with guarded writes: Meta Ads · Google Ads · TikTok Ads

Personal data

Analytics data is not anonymous by default. A GA4 property can carry a userId you set yourself, a device identifier, or a Google Signals pseudonymous ID. An MCP conversation sends whatever a tool returns to a model.

Identifiers are redacted by default wherever this server can return them, and showing them is an explicit opt-in, never the default.

Every one of these accepts includePersonalIdentifiers: true to return raw values, and defaults to false.

Audience export rows are positional, so the redaction reads the export's dimension metadata to find identifier columns. If that metadata is missing, every value in the row is redacted rather than guessing which column is safe. Failing closed is the point.

Report rows are not redacted. ga4_run_report and the other reporting tools return what you asked for. Altering the numbers a report returns would be worse than returning them.

So one decision stays yours: if your property carries a userId you consider personal, do not request it as a report dimension in a conversation whose transcript leaves your machine.

Getting credentials

Three values, obtained once.

1. OAuth client

In a Google Cloud project, enable the Google Analytics Data API and the Google Analytics Admin API, then create an OAuth client under APIs & Services → Credentials. Choose Desktop app for local use. Note the client ID and client secret.

2. Refresh token

Run the OAuth consent flow once, signed in as a Google account with access to your GA4 properties, and keep the refresh token. The analytics.readonly scope is enough, and it is the only one you should grant.

📖 Google OAuth for installed apps

The refresh token does not expire. It is the sensitive value: anyone holding it can mint access tokens indefinitely. Use an OAuth client dedicated to this server so you can revoke it on its own.

3. Property ID, optional

Set GA4_PROPERTY_ID to avoid passing it on every call. Find it in GA4 under Admin → Property Settings, or list them with ga4_list_properties.

Run `ga4_health_check` as your first call. It verifies the credentials and lists the properties you can actually reach, without printing any secret.

Setup

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{

"mcpServers": { "google-analytics": { "command": "npx", "args": ["-y", "@getmcpads/google-analytics-mcp-server"], "env": { "GA4_CLIENT_ID": "your-client-id", "GA4_CLIENT_SECRET": "your-client-secret", "GA4_REFRESH_TOKEN": "your-refresh-token", "GA4_PROPERTY_IDS": "123456789" } } } }

Restart Claude Desktop. Ask it: *"list my Google Analytics properties"*.

Claude Code

claude mcp add google-analytics --env GA4_CLIENT_ID=... --env GA4_CLIENT_SECRET=... --env GA4_REFRESH_TOKEN=... -- npx -y @getmcpads/google-analytics-mcp-server

Cursor

.cursor/mcp.json in your project, same shape as the Claude Desktop config above.

From source

git clone https://github.com/get-mcp-ads/google-analytics-mcp-server.git

cd google-analytics-mcp-server npm install && npm run build cp .env.example .env # then fill in your credentials npm start

Configuration

Check your setup at any time:

npm run doctor

`