Atlas / MCP servers / samarthanalytics-sj / samarth-gtm-mcp

samarth-gtm-mcpBLOCK

mcp/samarthanalytics-sj/samarth-analytics-mcp

MCP server for Samarth Analytics Google Tag Manager operations

Verdict
BLOCK
Grade
F
Trust score
27 /100
Exposed tools
200 126r · 104w · 21d
Transport
stdio · streamable-http
License
MIT
Stars
2
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/samarthanalytics-sj/samarth-analytics-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/samarth-gtm-mcp) [](./LICENSE)

An open-source Model Context Protocol (MCP) server that lets AI assistants such as Claude Desktop, Claude Code and Cursor work with Google Tag Manager and GA4. It covers the full GTM API v2 surface (100+ tools, including server-side containers), the GA4 Admin and Data APIs, a built-in implementation audit, and a second server that crawls a website to check its tags and Consent Mode v2 setup. Built by Samarth Analytics for our own client work and released under the MIT license for the analytics community.

Read-only by default. Creating, updating, publishing and deleting are each behind a separate environment flag, every write also requires confirm=true, and a dry-run mode simulates writes without touching the API. See Guardrails.

Use it at your own risk, and start on a dummy container. The server acts with your Google credentials, so every change it makes is yours. Try it first on a sandbox GTM container and a test GA4 property, keep the write flags off until you have watched how it behaves, and review the container's version history after any write session. We run it in production, but your setup is not ours.

Three ways to use it

Read from source at commit b1c705658c8cOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add samarth-gtm-mcp --env GOOGLE_OAUTH_CLIENT_SECRET=${GOOGLE_OAUTH_CLIENT_SECRET} -- npx -y [email protected]
03

Exposed tools (200)

126 read · 104 write · 21 destructive. Blast radius: 21 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
StagingreadQA env
accounts_getread
accounts_listread
add_ga4_event_parameterswriteAdd GA4 event parameters to an existing GA4 Event tag (type
add_ga4_event_parameters_to_all_tagswrited
add_ga4_server_parameterswriteAdd event parameters and/or user properties to a GA4 SERVER tag (type
add_google_ads_negative_keywordswriteAdd campaign-level NEGATIVE keywords to a LIVE campaign - the follow-through after
analytics_scorecardreadUnified analytics health SCORECARD: a 0-100 score and letter grade with a per-section breakdown and ranked top issues, combining the GTM container audit and, when ga4Property (
audit_containerread
audit_ga4_data_qualityreadAudit the actual GA4 reporting DATA over the last N days (default 28) and flag data-quality problems that silently corrupt analytics: a high share of
audit_google_ads_conversion_healthreadTHE conversion-health audit: runs every read in one pass (tagging/UTM plumbing, full conversion-action
audit_google_ads_ga4_linkreadAudit the Ads ↔ GA4 SEAM for one Ads account + one GA4 property: is the property linked to this account
audit_google_ads_utm_setupreadAudit the account\
audit_gtm_containerreadAudit a GTM workspace and return ACTIONABLE findings: counts, a severity summary, and findings carrying severity, category, the affected resource, a recommendation, and for auto-fixable issues a ready-to-run
audit_gtm_container_changesreadRe-audit the workspace AND report what CHANGED since its last audit: NEW issues (regressions), RESOLVED issues, plus the full current report. Records this run so the next call can diff against it. New findings carry the same ready-to-run fixes. Use when the user asks
audit_server_containerreadAudit a SERVER container workspace. Checks that a client claims incoming requests; that server tags carry their destination id, have a firing trigger and are not paused; and that a tagging server URL is set. Flags duplicate GA4 relays (double-counting), URL-encoded trigger filter values (e.g.
batch_delete_gtm_entitiesdestructiveDelete a SPECIFIC SET of tags, triggers AND variables in ONE approval, instead of one card per item.
bootstrap_server_side_taggingwriteSet up server-side tagging in one step: creates a SERVER container, then a GA4 client and GA4 server tag in its default workspace. Give the Measurement ID to relay either as
brand_new_thingreadx
built_in_variables_disabledestructive[DELETE] Disable one or more built-in variables in a GTM workspace.
built_in_variables_enablewrite[WRITE] Enable one or more built-in variables in a GTM workspace.
built_in_variables_listread
built_in_variables_revertread
check_ga4_compatibilityreadCheck which of the given GA4 dimensions/metrics can be combined in ONE report on this property (the Data API rejects incompatible pairs). Call this BEFORE run_ga4_report when combining unusual dimensions/metrics; drop or replace anything reported incompatible instead of retrying blind.
check_gtm_measurement_idsreadCross-check the GA4 measurement ids configured in this GTM container against the GA4 properties the signed-in user can access: flags ids matching NO accessible GA4 web stream (a typo, a wrong id, or a property on another login) and resolves matched ids to their property. Optional ga4Account (
consent_banner_detectread
consent_compliance_auditread
consent_scenario_captureread
containers_combineread
containers_createwrite
containers_getread
containers_listread
containers_lookupread
containers_move_tag_idwrite
containers_set_tagging_server_urlswrite
containers_snippetread
create_adroll_capi_server_tagwriteCreate an AdRoll SERVER tag from the Stape template (stape-io / adroll-tag), imported automatically. containerId must be the SERVER container. Needs the AdRoll
create_ga4_propertywrite[GA4] Create a new GA4 property under an account. Applies directly to GA4.
create_google_ads_conversion_actionwriteCreate a new WEBSITE conversion action in a Google Ads account and return its Conversion ID and Label.
create_google_ads_conversion_actions_for_tagswriteBATCH one-click: create ONE Google Ads conversion action per GTM tag in the selected Ads account, and (when you ALSO pass the GTM container ids + a trigger per entry) build each one\
create_google_ads_user_listwriteCreate a CRM-based Customer Match user list (CONTACT_INFO: emails/phones) - the missing target when
create_gtm_clientwriteCreate a CLIENT in a SERVER container workspace.
create_gtm_environmentwriteCreate a GTM ENVIRONMENT (e.g. a
create_gtm_folderwriteCreate a folder in a GTM workspace to organise tags/triggers/variables. Folders are PURELY organisational, they do not change what fires. File items into it with move_gtm_entities_to_folder using the returned folderId.
create_gtm_tagwriteCreate a tag in a GTM workspace (draft).
create_gtm_tag_with_triggerwriteOne-shot: create a tag that fires on a trigger in a single call. Enables needed built-in
create_gtm_tracking_tagwritePREFERRED way to create a tag that fires on an event: builds a CORRECT GTM resource from simple fields (no raw GTM JSON). One call enables needed built-in variables, reuses or creates the named trigger, and creates the tag linked to it, in the draft workspace.
create_gtm_transformationwriteCreate a TRANSFORMATION in a SERVER container workspace (reshape event data before tags run). EITHER pass name + allowParams (an
create_gtm_triggerwriteCreate a trigger in a GTM workspace.
create_gtm_variablewriteCreate a variable in a GTM workspace from a raw GTM Variable resource {name, type, ...}. Prefer create_gtm_variable_typed.
create_gtm_variable_typedwriteCreate a GTM variable with the correct structure (no raw JSON). Fields per kind: constant (value); data_layer (dataLayerName); javascript (a Custom JavaScript variable, e.g.
create_gtm_workspacewriteCreate a new draft workspace in a GTM container to make changes in.
create_hotjar_tagwriteCreate a Hotjar tracking tag (Custom HTML installing the hj() queue and loading static.hotjar.com).
create_line_yahoo_capi_server_tagwriteCreate a LINE Yahoo (Yahoo! JAPAN Ads) Conversion API SERVER tag from the Stape template (stape-io / line-yahoo-tag), imported automatically. containerId must be the SERVER container. Needs the Yahoo
create_meta_emq_variableswriteCreate the standard Meta CAPI
create_meta_pixel_tagwriteCreate a Meta (Facebook) Pixel WEB tag from the official community template (imported automatically) with the CORRECT event fields. Use this instead of hand-building a cvt_ template tag, which gets the event wrong.
create_nextdoor_capi_server_tagwriteCreate a Nextdoor Conversion API SERVER tag from the Stape template (stape-io / nextdoor-tag), imported automatically. containerId must be the SERVER container. Needs the Nextdoor
create_pinterest_capi_server_tagwriteCreate a Pinterest Conversions API SERVER tag from the official Pinterest server template (pinterest / ss-gtm-template), imported automatically: the server counterpart of create_pinterest_tag. containerId must be the SERVER container. advertiserId and apiAccessToken come from Pinterest Ads Manager,
create_pinterest_tagwriteCreate a Pinterest WEB tag from the Pinterest community template, imported automatically.
create_quora_capi_server_tagwriteCreate a Quora Conversion API SERVER tag from the Stape template (stape-io / quora-tag), imported automatically. containerId must be the SERVER container.
create_rtb_house_server_tagwriteCreate an RTB House SERVER tag from the Stape template (stape-io / rtb-house-tag), imported automatically. containerId must be the SERVER container. RTB House is a retargeting tag with NO token: it needs the
create_server_containerwriteCreate a SERVER container (server-side GTM, usageContext
create_server_tagwrite
create_server_triggerwriteCreate the firing trigger for a SERVER container: a Custom Event trigger, optionally SCOPED to a client via
create_snap_pixel_tagwriteCreate a Snap Pixel WEB tag from the Snapchat community template, imported automatically.
create_spotify_capi_server_tagwriteCreate a Spotify Ads Conversion API SERVER tag from the Stape template (stape-io / spotify-tag), imported automatically. containerId must be the SERVER container. Needs the Spotify Ads
create_tiktok_capi_server_tagwriteCreate a TikTok Events API SERVER tag from the Stape template (stape-io / tiktok-tag), imported automatically. containerId must be the SERVER container. DISTINCT from the TikTok WEB pixel and using DIFFERENT field keys (pixelId / accessToken / eventName, NOT the web pixel_code / event).
create_x_capi_server_tagwriteCreate an X (Twitter) Conversion API SERVER tag from the Stape template (stape-io / twitter-tag), imported automatically: the server counterpart of the X Pixel. containerId must be the SERVER container. The template has NO event-name field:
create_yelp_capi_server_tagwriteCreate a Yelp Conversion API SERVER tag from the Stape template (stape-io / yelp-tag), imported automatically. containerId must be the SERVER container. Yelp has no pixel id: only the
delete_ga4_accountdestructive[GA4] Soft-delete (trash) an entire GA4 account and all its properties. High blast radius. Destructive — two-step approval.
delete_ga4_propertydestructive[GA4] Soft-delete (trash) a GA4 property — recoverable for a limited time. Destructive — two-step approval.
delete_gtm_clientdestructiveDelete a CLIENT from a SERVER container workspace (draft, not published). The GTM API DOES support this (workspaces.clients.delete); do NOT tell the user clients can only be removed in the GTM UI. Destructive, requires two confirmations: check the client is not the only one claiming requests.
delete_gtm_folderdestructiveDelete a GTM folder (draft, not published). GTM does NOT delete its contents: the tags/triggers/variables become unfiled. Destructive, requires two confirmations.
delete_gtm_tagdestructiveDelete a tag from a GTM workspace (draft, not published). Destructive, requires two confirmations.
delete_gtm_triggerdestructiveDelete a trigger from a GTM workspace (draft, not published). Applies the audit fix for an unused trigger. Destructive, requires two confirmations.
delete_gtm_variabledestructiveDelete a variable from a GTM workspace (draft, not published). Destructive, requires two confirmations; verify it is not used by a published version first.
describe_template_fieldsreadRead the FIELDS a custom or Community Gallery template accepts, straight from the template\
destinations_getread
destinations_linkread
destinations_listread
detect_page_phone_numbersreadScan one or more live page URLs and return every UNIQUE phone number on them, merged across pages and normalized to E.164 where possible. Read-only.
diff_gtm_versionsreadDiff two PUBLISHED container versions: tags/triggers/variables added, removed or modified between version A (base) and version B. Answers
diff_gtm_workspace_vs_livereadShow CONFIG DRIFT between the draft workspace and the PUBLISHED (live) container version: which tags/triggers/variables the draft adds, removes or modifies, i.e. what publishing it would change.
discover_site_urlsreadList the pages of a website, from its sitemap.xml (found via robots.txt or the usual locations) and falling back to a link crawl when there is no sitemap. Read-only. Answers
enable_gtm_builtin_variableswriteEnable built-in variables in a GTM workspace.
environments_createwrite
environments_deletedestructive
environments_getread
environments_listread
environments_reauthorizeread
environments_updatewrite
export_containerread
folders_createwrite
folders_deletedestructive
folders_entitiesread
folders_getread
folders_listread
folders_move_entitieswrite
folders_updatewrite
forget_memorydestructiveRemove saved memories matching a description. Call this when the user says to forget or stop applying
forms_scanread
ga4_account_summaries_listread
ga4_acknowledge_user_data_collectionread
ga4_check_compatibilityread
ga4_create_propertywrite
ga4_custom_dimensions_listread
ga4_custom_metrics_listread
ga4_data_retention_getread
ga4_data_streams_listread
ga4_delete_accountdestructive
ga4_delete_propertydestructive
ga4_enhanced_measurement_getread
ga4_google_ads_links_listread
ga4_key_events_listread
ga4_properties_listread
ga4_property_getread
ga4_run_realtime_reportwrite
ga4_run_reportwrite
ga4_trash_thingdestructive[GA4 DELETE] Soft-delete (trash) a thing.
ga4_update_accountwrite
ga4_update_data_retentionwrite
ga4_update_propertywrite
get_form_tracking_recipewriteGet the complete, ready-to-create GTM recipe for an AJAX WordPress form plugin (Contact Form 7, Gravity Forms, Ninja Forms, WPForms, Elementor). These submit via AJAX, so GTM
get_ga4_attribution_settingsreadGet a GA4 property\
get_ga4_data_retentionreadGet a GA4 property\
get_ga4_enhanced_measurementreadGet the enhanced-measurement settings of ONE GA4 WEB data stream (page views, scrolls, outbound clicks, site search, video, file downloads, etc.). Requires dataStream — the full stream resource name like
get_ga4_google_signalsreadGet a GA4 property\
get_ga4_property_detailsreadGet a GA4 property\
get_google_ads_budget_pacingreadDaily budgets vs ACTUAL average daily spend per enabled campaign over a trailing window (default 14 days):
get_google_ads_change_historyreadWHO changed WHAT in the Google Ads account, newest first: timestamp, user email, the surface it came from
get_google_ads_conversion_volumereadConversions per conversion ACTION over a window (default last 30 days; or startDate/endDate YYYY-MM-DD), plus
get_google_ads_recommendationsreadGOOGLE\
get_google_ads_structurereadStructure reads for deeper audits, one view per call:
get_google_ads_tracking_setupreadThe account\
get_google_ads_upload_diagnosticswriteGoogle\
google_ads_campaign_performancereadPer-campaign performance: impressions, clicks, cost, conversions and conversion value. Read-only. Two ways to
gtm_tag_suggestionsread
gtm_type_referenceread
list_ga4_accountsreadList the Google Analytics 4 account summaries the signed-in user can access.
list_ga4_audiencesreadList the audiences (remarketing / segmentation) configured on a GA4 property — by display name, with description, membership window in days, whether ads personalization is enabled, and the number of filter clauses. Requires property like
list_ga4_bigquery_linksreadList a GA4 property\
list_ga4_custom_dimensionsreadList a GA4 property\
list_ga4_custom_metricsreadList a GA4 property\
list_ga4_data_streamsreadList the data streams of a GA4 property. Requires property like
list_ga4_firebase_linksreadList a GA4 property\
list_ga4_google_ads_linksreadList the Google Ads accounts linked to a GA4 property (customerId, ads-personalization flag). Requires property like
list_ga4_key_eventsreadList the key events (conversions) configured on a GA4 property — by event NAME, with counting method and whether it is a custom event. Requires property like
list_ga4_measurement_protocol_secretsreadList Measurement Protocol secrets on a GA4 property, grouped by data stream — by DISPLAY NAME only (the secret value is never returned). Use to see which server-side / MP integrations exist. Requires property like
list_ga4_propertiesreadList GA4 properties under an account. Requires account like
list_google_ads_accountsreadList the Google Ads accounts the signed-in user can reach, manager (MCC) accounts included. Returns each
list_google_ads_audiencesreadThe account\
list_google_ads_campaignsreadList a Google Ads account\
list_google_ads_conversion_actionsreadList a Google Ads account\
list_gtm_accountsreadList the Google Tag Manager accounts the signed-in user can access.
list_gtm_clientsreadList the CLIENTS in a SERVER container workspace, e.g. the GA4 client
list_gtm_containersreadList the GTM containers within a GTM account. Requires the numeric accountId.
list_gtm_environmentsreadList the container
list_gtm_foldersreadList the folders in a GTM workspace (name + folderId). The GTM API DOES expose this (folders.list): use it to find a folder id before move_gtm_entities_to_folder / rename_gtm_folder / delete_gtm_folder rather than asking the user.
list_gtm_tagsreadList the tags in a GTM workspace. Each tag returns tagId, name, type,
list_gtm_templatesreadList the CUSTOM (community-gallery) templates imported into a workspace with each one\
list_gtm_transformationsreadList the TRANSFORMATIONS in a SERVER container workspace; they enrich or redact event data before tags run.
list_gtm_triggersreadList the triggers in a GTM workspace. Each returns triggerId, name, type,
list_gtm_variablesreadList the user-defined variables in a GTM workspace (name + type). Use it to check whether a variable already exists before creating one.
list_gtm_versionsreadList the container\
list_gtm_workspacesreadList the workspaces in a GTM container.
list_unused_gtm_triggersreadList the UNUSED (orphaned) triggers in a GTM workspace: referenced by NO tag (firing or blocking) and not in a Trigger Group, so safe-to-delete clutter. Read-only; use it to show exactly what delete_unused_gtm_triggers would remove (triggerId, name, type).
lookup_corpus_patternsreadLook up how tags, triggers and variables were ACTUALLY built across the operator\
monitor_ga4_propertywriteRun a live HEALTH MONITOR on a GA4 property and return an alert list: is data still being received (realtime active users + last complete day), did a key event stop firing, a sudden traffic spike or drop, conversions not moving with traffic, attribution decay (
move_gtm_entities_to_folderwriteMove tags, triggers and/or variables into a GTM folder (organisational only, does NOT change firing). Pass at least one of tagIds / triggerIds / variableIds. To file all GA4 tags: list_gtm_tags, keep the gaawe/gaawc/googtag ids, create_gtm_folder, then call this with those tagIds.
plan_phone_conversion_trackingreadBuild the COMPLETE, reviewable implementation plan for tracking every phone number on a page as its own Google Ads conversion: one conversion action, one GTM tag and one trigger PER NUMBER. Read-only - it creates nothing.
plan_server_migration_from_webreadREAD-ONLY: given a WEB container, list every convertible tag and the plan to port it to a SERVER container - which server tool builds each, the destination ids read off the web tag (
profile_tag_typesreadGroup a workspace\
rank_ga4_campaignsreadRank a GA4 property
recall_memoriesreadSEARCH the saved memories for this Google account and read back what matches. A few of the most relevant
remember_memorywriteSave a durable NOTE to the assistant\
rename_gtm_folderwriteRename a GTM folder (organisational only).
run_ga4_realtime_reportwriteRun a GA4 REAL-TIME report (events in the last 30 minutes). dimensions/metrics are GA4 realtime API names (e.g. dimensions [
run_ga4_reportwriteRun a GA4 report. dimensions/metrics are GA4 API names (e.g. [
score_ga4_propertyreadProduce a GA4 property health SCORECARD: an overall 0–100 score + letter grade (A–F) and a severity-ranked top-issues list, from the GA4 property audit. The GA4-mode counterpart to analytics_scorecard. Requires property like
set_ga4_measurement_id_on_all_tagswriteSet/replace the Measurement ID on ALL GA4 tags in the workspace in ONE call (GA4 event tags plus the Google tag). The value may be a literal id (G-/AW-/GT-XXXX) or a GTM variable like {{GA4 Variable}}. PREFER this whenever the user says
set_google_ads_campaign_statuswritePause or re-enable a LIVE campaign. Pausing stops spend within minutes; the result returns the previous
set_gtm_containerwriteSwitch the ACTIVE GTM container within the current account, by containerId OR containerName (case-insensitive). Optionally set the workspace too; otherwise
set_gtm_tag_consentwriteSet a tag\
set_gtm_tag_pausedwritePause or unpause a tag in a GTM workspace, preserving its other settings. Applies the audit fix for a paused tag. paused=true pauses, false enables.
set_gtm_workspacewriteSwitch the ACTIVE GTM workspace (the one in the app bar, used by the audit and new operations) within the current account and container. Accepts workspaceId OR workspaceName (case-insensitive). Use when the user says
set_server_container_tagging_urlwriteSet the SERVER container\
set_web_server_container_urlwriteWire a WEB container to a server container by setting the web Google tag
setup_consent_mode_defaultswriteInstall the Consent Mode v2 DEFAULT-consent tag in a WEB container: a Custom HTML gtag(
setup_ecommerce_funnelwriteONE STEP: install the FULL GA4 ecommerce funnel in a WEB container. Per funnel event (default view_item, add_to_cart, view_cart, begin_checkout, add_shipping_info, add_payment_info, purchase) it creates a Custom Event trigger plus a GA4 event tag with
site_crawlread
site_pages_discoverread
treadtest tool
tags_add_ga4_event_parameterswrite
tags_createwrite
tags_deletedestructive[DELETE] Delete a GTM tag.
tags_getread
tags_listread
tags_type_profileread
tags_updatewrite
templates_describe_fieldsread
04

Trust audit

BLOCKgrade F · trust 27/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (7 observation(s))
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/scripts/auth-google.ts:44
exec(cmd, (err) => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
<tool:delete_gtm_client>:1
Delete a CLIENT from a SERVER container workspace (draft, not published). The GTM API DOES support this (workspaces.clients.delete); do NOT tell the user clients can only be removed in the GTM UI. Des
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
docs/AITAGMANAGER_MCP_INTEGRATION_FEASIBILITY.md:783
| Jailbreak attempts | System-prompt hardening; write actions gated by out-of-band human approval (UI card, not model text); guardrail flags server-side; refusal + logging of policy-probe patterns; no
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/desktop/src/main/google/workspace-dependencies.ts
workspace-dependencies.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/desktop/src/main/google/workspace-diff.ts
workspace-diff.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/desktop/src/shared/embeddings.ts
embeddings.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/desktop/src/shared/install-manifest.ts
install-manifest.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/desktop/src/shared/log-format.ts
log-format.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
apps/runtime-worker/server.mjs:198
console.log(`[runtime-worker] auth ${TOKEN ? "REQUIRED" : "DISABLED (set RUNTIME_WORKER_TOKEN)"}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/scripts/auth-google.ts:168
console.log(`Token file (output) : ${getTokenFilePath()}`);
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
apps/desktop/src/main/google/gtm-builders.ts:333
url: string; // pixel/beacon URL (protocol-relative //host/path or https, may contain {{variables}})
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/chat-orchestrator/.env.example:19
# MCP_URL=http://127.0.0.1:3001/mcp
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/chat-orchestrator/Dockerfile:74
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
apps/desktop/src/main/google/oauth-config.ts:52
const raw = readFileSync(configPath, 'utf8').replace(/^/, ''); // strip BOM
MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321
apps/desktop/src/shared/__tests__/chat-memory.test.ts:26
check('redact: Anthropic key', (() => { const r = redactSecrets('use sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345'); return r.redacted && !r.text.includes('sk-ant-'); })());
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
apps/portal/shared/__tests__/storage.node.test.ts:210
loadDbConfig({ DATABASE_URL: "postgres://user:pw@host/db" }),
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
apps/desktop/src/shared/__tests__/devlog.test.ts:33
const out = redact({ llm: { provider: 'anthropic', apiKey: 'sk-ant-REALSECRET123' }, developerToken: 'DEVTOKENXYZ', ok: true }) as Record<string, any>;
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
apps/portal/shared/__tests__/audit-snapshot.node.test.ts:293
const SECRET = "test-session-secret-0123456789abcdef";
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
apps/desktop/src/shared/__tests__/chat-memory.test.ts:30
check('redact: private key block', (() => { const r = redactSecrets('x -----BEGIN PRIVATE KEY-----\nMIIabc\n-----END PRIVATE KEY----- y'); return r.redacted && !r.text.includes('MIIabc'); })());
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
batch_delete_gtm_entities, built_in_variables_disable, delete_ga4_account, delete_ga4_property, delete_gtm_client, delete_gtm_folder, delete_gtm_tag, delete_gtm_trigger, delete_gtm_variable, environme
Why it matters. 21 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.env.docker.example
.env.docker.example
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.releaserc.json
.releaserc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
apps/portal/.vercelignore
.vercelignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.suspicious_name · CWE-1104
apps/desktop/src/main/suggestions/__tests__/verify-driver-payload.test.ts
verify-driver-payload.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/desktop/src/main/tools/__tests__/form-recipe-runtime.test.ts:34
new Function('window', 'document', 'jQuery', '$', inner)(win, doc, jq, jq);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha b1c705658c8cfull audit observations/trust-audit/mcp-server/samarthanalytics-sj__samarth-analytics-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11b1c705658c8cBLOCKF27first audit
06

Questions

What is the samarth-gtm-mcp MCP server?

MCP server for Samarth Analytics Google Tag Manager operations

What tools does samarth-gtm-mcp expose?

200 in total: 126 read-only, 104 that write, and 21 that can delete or overwrite (batch_delete_gtm_entities, built_in_variables_disable, delete_ga4_account, delete_ga4_property, delete_gtm_client). Every one is listed on this page with its risk.

Is samarth-gtm-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (27/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 21 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does samarth-gtm-mcp need?

It reads AUTHORIZE_UI_DIR, GOOGLE_ACCESS_TOKEN, GOOGLE_CLIENT_SECRET, GOOGLE_DESKTOP_CLIENT_SECRET, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_REDIRECT_URI, GOOGLE_SERVICE_ACCOUNT_KEY_FILE, GTM_MCP_HTTP_AUTH_TOKEN, GTM_MCP_TOKEN_FILE, MCP_AUTH_TOKEN and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does samarth-gtm-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as samarth-gtm-mcp at 1.497.3.

How current is this page?

The grade is for one exact copy of the source (b1c705658c8c), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement