samarth-gtm-mcpBLOCK
MCP server for Samarth Analytics Google Tag Manager operations
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/samarthanalytics-sj/samarth-analytics-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/samarth-gtm-mcp) [](./LICENSE)
An open-source Model Context Protocol (MCP) server that lets AI assistants such as Claude Desktop, Claude Code and Cursor work with Google Tag Manager and GA4. It covers the full GTM API v2 surface (100+ tools, including server-side containers), the GA4 Admin and Data APIs, a built-in implementation audit, and a second server that crawls a website to check its tags and Consent Mode v2 setup. Built by Samarth Analytics for our own client work and released under the MIT license for the analytics community.
Read-only by default. Creating, updating, publishing and deleting are each behind a separate environment flag, every write also requires confirm=true, and a dry-run mode simulates writes without touching the API. See Guardrails.
Use it at your own risk, and start on a dummy container. The server acts with your Google credentials, so every change it makes is yours. Try it first on a sandbox GTM container and a test GA4 property, keep the write flags off until you have watched how it behaves, and review the container's version history after any write session. We run it in production, but your setup is not ours.
Three ways to use it
b1c705658c8cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add samarth-gtm-mcp --env GOOGLE_OAUTH_CLIENT_SECRET=${GOOGLE_OAUTH_CLIENT_SECRET} -- npx -y [email protected]Exposed tools (200)
126 read · 104 write · 21 destructive. Blast radius: 21 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Staging | read | QA env |
accounts_get | read | |
accounts_list | read | |
add_ga4_event_parameters | write | Add GA4 event parameters to an existing GA4 Event tag (type |
add_ga4_event_parameters_to_all_tags | write | d |
add_ga4_server_parameters | write | Add event parameters and/or user properties to a GA4 SERVER tag (type |
add_google_ads_negative_keywords | write | Add campaign-level NEGATIVE keywords to a LIVE campaign - the follow-through after |
analytics_scorecard | read | Unified analytics health SCORECARD: a 0-100 score and letter grade with a per-section breakdown and ranked top issues, combining the GTM container audit and, when ga4Property ( |
audit_container | read | |
audit_ga4_data_quality | read | Audit the actual GA4 reporting DATA over the last N days (default 28) and flag data-quality problems that silently corrupt analytics: a high share of |
audit_google_ads_conversion_health | read | THE conversion-health audit: runs every read in one pass (tagging/UTM plumbing, full conversion-action |
audit_google_ads_ga4_link | read | Audit the Ads ↔ GA4 SEAM for one Ads account + one GA4 property: is the property linked to this account |
audit_google_ads_utm_setup | read | Audit the account\ |
audit_gtm_container | read | Audit a GTM workspace and return ACTIONABLE findings: counts, a severity summary, and findings carrying severity, category, the affected resource, a recommendation, and for auto-fixable issues a ready-to-run |
audit_gtm_container_changes | read | Re-audit the workspace AND report what CHANGED since its last audit: NEW issues (regressions), RESOLVED issues, plus the full current report. Records this run so the next call can diff against it. New findings carry the same ready-to-run fixes. Use when the user asks |
audit_server_container | read | Audit a SERVER container workspace. Checks that a client claims incoming requests; that server tags carry their destination id, have a firing trigger and are not paused; and that a tagging server URL is set. Flags duplicate GA4 relays (double-counting), URL-encoded trigger filter values (e.g. |
batch_delete_gtm_entities | destructive | Delete a SPECIFIC SET of tags, triggers AND variables in ONE approval, instead of one card per item. |
bootstrap_server_side_tagging | write | Set up server-side tagging in one step: creates a SERVER container, then a GA4 client and GA4 server tag in its default workspace. Give the Measurement ID to relay either as |
brand_new_thing | read | x |
built_in_variables_disable | destructive | [DELETE] Disable one or more built-in variables in a GTM workspace. |
built_in_variables_enable | write | [WRITE] Enable one or more built-in variables in a GTM workspace. |
built_in_variables_list | read | |
built_in_variables_revert | read | |
check_ga4_compatibility | read | Check which of the given GA4 dimensions/metrics can be combined in ONE report on this property (the Data API rejects incompatible pairs). Call this BEFORE run_ga4_report when combining unusual dimensions/metrics; drop or replace anything reported incompatible instead of retrying blind. |
check_gtm_measurement_ids | read | Cross-check the GA4 measurement ids configured in this GTM container against the GA4 properties the signed-in user can access: flags ids matching NO accessible GA4 web stream (a typo, a wrong id, or a property on another login) and resolves matched ids to their property. Optional ga4Account ( |
consent_banner_detect | read | |
consent_compliance_audit | read | |
consent_scenario_capture | read | |
containers_combine | read | |
containers_create | write | |
containers_get | read | |
containers_list | read | |
containers_lookup | read | |
containers_move_tag_id | write | |
containers_set_tagging_server_urls | write | |
containers_snippet | read | |
create_adroll_capi_server_tag | write | Create an AdRoll SERVER tag from the Stape template (stape-io / adroll-tag), imported automatically. containerId must be the SERVER container. Needs the AdRoll |
create_ga4_property | write | [GA4] Create a new GA4 property under an account. Applies directly to GA4. |
create_google_ads_conversion_action | write | Create a new WEBSITE conversion action in a Google Ads account and return its Conversion ID and Label. |
create_google_ads_conversion_actions_for_tags | write | BATCH one-click: create ONE Google Ads conversion action per GTM tag in the selected Ads account, and (when you ALSO pass the GTM container ids + a trigger per entry) build each one\ |
create_google_ads_user_list | write | Create a CRM-based Customer Match user list (CONTACT_INFO: emails/phones) - the missing target when |
create_gtm_client | write | Create a CLIENT in a SERVER container workspace. |
create_gtm_environment | write | Create a GTM ENVIRONMENT (e.g. a |
create_gtm_folder | write | Create a folder in a GTM workspace to organise tags/triggers/variables. Folders are PURELY organisational, they do not change what fires. File items into it with move_gtm_entities_to_folder using the returned folderId. |
create_gtm_tag | write | Create a tag in a GTM workspace (draft). |
create_gtm_tag_with_trigger | write | One-shot: create a tag that fires on a trigger in a single call. Enables needed built-in |
create_gtm_tracking_tag | write | PREFERRED way to create a tag that fires on an event: builds a CORRECT GTM resource from simple fields (no raw GTM JSON). One call enables needed built-in variables, reuses or creates the named trigger, and creates the tag linked to it, in the draft workspace. |
create_gtm_transformation | write | Create a TRANSFORMATION in a SERVER container workspace (reshape event data before tags run). EITHER pass name + allowParams (an |
create_gtm_trigger | write | Create a trigger in a GTM workspace. |
create_gtm_variable | write | Create a variable in a GTM workspace from a raw GTM Variable resource {name, type, ...}. Prefer create_gtm_variable_typed. |
create_gtm_variable_typed | write | Create a GTM variable with the correct structure (no raw JSON). Fields per kind: constant (value); data_layer (dataLayerName); javascript (a Custom JavaScript variable, e.g. |
create_gtm_workspace | write | Create a new draft workspace in a GTM container to make changes in. |
create_hotjar_tag | write | Create a Hotjar tracking tag (Custom HTML installing the hj() queue and loading static.hotjar.com). |
create_line_yahoo_capi_server_tag | write | Create a LINE Yahoo (Yahoo! JAPAN Ads) Conversion API SERVER tag from the Stape template (stape-io / line-yahoo-tag), imported automatically. containerId must be the SERVER container. Needs the Yahoo |
create_meta_emq_variables | write | Create the standard Meta CAPI |
create_meta_pixel_tag | write | Create a Meta (Facebook) Pixel WEB tag from the official community template (imported automatically) with the CORRECT event fields. Use this instead of hand-building a cvt_ template tag, which gets the event wrong. |
create_nextdoor_capi_server_tag | write | Create a Nextdoor Conversion API SERVER tag from the Stape template (stape-io / nextdoor-tag), imported automatically. containerId must be the SERVER container. Needs the Nextdoor |
create_pinterest_capi_server_tag | write | Create a Pinterest Conversions API SERVER tag from the official Pinterest server template (pinterest / ss-gtm-template), imported automatically: the server counterpart of create_pinterest_tag. containerId must be the SERVER container. advertiserId and apiAccessToken come from Pinterest Ads Manager, |
create_pinterest_tag | write | Create a Pinterest WEB tag from the Pinterest community template, imported automatically. |
create_quora_capi_server_tag | write | Create a Quora Conversion API SERVER tag from the Stape template (stape-io / quora-tag), imported automatically. containerId must be the SERVER container. |
create_rtb_house_server_tag | write | Create an RTB House SERVER tag from the Stape template (stape-io / rtb-house-tag), imported automatically. containerId must be the SERVER container. RTB House is a retargeting tag with NO token: it needs the |
create_server_container | write | Create a SERVER container (server-side GTM, usageContext |
create_server_tag | write | |
create_server_trigger | write | Create the firing trigger for a SERVER container: a Custom Event trigger, optionally SCOPED to a client via |
create_snap_pixel_tag | write | Create a Snap Pixel WEB tag from the Snapchat community template, imported automatically. |
create_spotify_capi_server_tag | write | Create a Spotify Ads Conversion API SERVER tag from the Stape template (stape-io / spotify-tag), imported automatically. containerId must be the SERVER container. Needs the Spotify Ads |
create_tiktok_capi_server_tag | write | Create a TikTok Events API SERVER tag from the Stape template (stape-io / tiktok-tag), imported automatically. containerId must be the SERVER container. DISTINCT from the TikTok WEB pixel and using DIFFERENT field keys (pixelId / accessToken / eventName, NOT the web pixel_code / event). |
create_x_capi_server_tag | write | Create an X (Twitter) Conversion API SERVER tag from the Stape template (stape-io / twitter-tag), imported automatically: the server counterpart of the X Pixel. containerId must be the SERVER container. The template has NO event-name field: |
create_yelp_capi_server_tag | write | Create a Yelp Conversion API SERVER tag from the Stape template (stape-io / yelp-tag), imported automatically. containerId must be the SERVER container. Yelp has no pixel id: only the |
delete_ga4_account | destructive | [GA4] Soft-delete (trash) an entire GA4 account and all its properties. High blast radius. Destructive — two-step approval. |
delete_ga4_property | destructive | [GA4] Soft-delete (trash) a GA4 property — recoverable for a limited time. Destructive — two-step approval. |
delete_gtm_client | destructive | Delete a CLIENT from a SERVER container workspace (draft, not published). The GTM API DOES support this (workspaces.clients.delete); do NOT tell the user clients can only be removed in the GTM UI. Destructive, requires two confirmations: check the client is not the only one claiming requests. |
delete_gtm_folder | destructive | Delete a GTM folder (draft, not published). GTM does NOT delete its contents: the tags/triggers/variables become unfiled. Destructive, requires two confirmations. |
delete_gtm_tag | destructive | Delete a tag from a GTM workspace (draft, not published). Destructive, requires two confirmations. |
delete_gtm_trigger | destructive | Delete a trigger from a GTM workspace (draft, not published). Applies the audit fix for an unused trigger. Destructive, requires two confirmations. |
delete_gtm_variable | destructive | Delete a variable from a GTM workspace (draft, not published). Destructive, requires two confirmations; verify it is not used by a published version first. |
describe_template_fields | read | Read the FIELDS a custom or Community Gallery template accepts, straight from the template\ |
destinations_get | read | |
destinations_link | read | |
destinations_list | read | |
detect_page_phone_numbers | read | Scan one or more live page URLs and return every UNIQUE phone number on them, merged across pages and normalized to E.164 where possible. Read-only. |
diff_gtm_versions | read | Diff two PUBLISHED container versions: tags/triggers/variables added, removed or modified between version A (base) and version B. Answers |
diff_gtm_workspace_vs_live | read | Show CONFIG DRIFT between the draft workspace and the PUBLISHED (live) container version: which tags/triggers/variables the draft adds, removes or modifies, i.e. what publishing it would change. |
discover_site_urls | read | List the pages of a website, from its sitemap.xml (found via robots.txt or the usual locations) and falling back to a link crawl when there is no sitemap. Read-only. Answers |
enable_gtm_builtin_variables | write | Enable built-in variables in a GTM workspace. |
environments_create | write | |
environments_delete | destructive | |
environments_get | read | |
environments_list | read | |
environments_reauthorize | read | |
environments_update | write | |
export_container | read | |
folders_create | write | |
folders_delete | destructive | |
folders_entities | read | |
folders_get | read | |
folders_list | read | |
folders_move_entities | write | |
folders_update | write | |
forget_memory | destructive | Remove saved memories matching a description. Call this when the user says to forget or stop applying |
forms_scan | read | |
ga4_account_summaries_list | read | |
ga4_acknowledge_user_data_collection | read | |
ga4_check_compatibility | read | |
ga4_create_property | write | |
ga4_custom_dimensions_list | read | |
ga4_custom_metrics_list | read | |
ga4_data_retention_get | read | |
ga4_data_streams_list | read | |
ga4_delete_account | destructive | |
ga4_delete_property | destructive | |
ga4_enhanced_measurement_get | read | |
ga4_google_ads_links_list | read | |
ga4_key_events_list | read | |
ga4_properties_list | read | |
ga4_property_get | read | |
ga4_run_realtime_report | write | |
ga4_run_report | write | |
ga4_trash_thing | destructive | [GA4 DELETE] Soft-delete (trash) a thing. |
ga4_update_account | write | |
ga4_update_data_retention | write | |
ga4_update_property | write | |
get_form_tracking_recipe | write | Get the complete, ready-to-create GTM recipe for an AJAX WordPress form plugin (Contact Form 7, Gravity Forms, Ninja Forms, WPForms, Elementor). These submit via AJAX, so GTM |
get_ga4_attribution_settings | read | Get a GA4 property\ |
get_ga4_data_retention | read | Get a GA4 property\ |
get_ga4_enhanced_measurement | read | Get the enhanced-measurement settings of ONE GA4 WEB data stream (page views, scrolls, outbound clicks, site search, video, file downloads, etc.). Requires dataStream — the full stream resource name like |
get_ga4_google_signals | read | Get a GA4 property\ |
get_ga4_property_details | read | Get a GA4 property\ |
get_google_ads_budget_pacing | read | Daily budgets vs ACTUAL average daily spend per enabled campaign over a trailing window (default 14 days): |
get_google_ads_change_history | read | WHO changed WHAT in the Google Ads account, newest first: timestamp, user email, the surface it came from |
get_google_ads_conversion_volume | read | Conversions per conversion ACTION over a window (default last 30 days; or startDate/endDate YYYY-MM-DD), plus |
get_google_ads_recommendations | read | GOOGLE\ |
get_google_ads_structure | read | Structure reads for deeper audits, one view per call: |
get_google_ads_tracking_setup | read | The account\ |
get_google_ads_upload_diagnostics | write | Google\ |
google_ads_campaign_performance | read | Per-campaign performance: impressions, clicks, cost, conversions and conversion value. Read-only. Two ways to |
gtm_tag_suggestions | read | |
gtm_type_reference | read | |
list_ga4_accounts | read | List the Google Analytics 4 account summaries the signed-in user can access. |
list_ga4_audiences | read | List the audiences (remarketing / segmentation) configured on a GA4 property — by display name, with description, membership window in days, whether ads personalization is enabled, and the number of filter clauses. Requires property like |
list_ga4_bigquery_links | read | List a GA4 property\ |
list_ga4_custom_dimensions | read | List a GA4 property\ |
list_ga4_custom_metrics | read | List a GA4 property\ |
list_ga4_data_streams | read | List the data streams of a GA4 property. Requires property like |
list_ga4_firebase_links | read | List a GA4 property\ |
list_ga4_google_ads_links | read | List the Google Ads accounts linked to a GA4 property (customerId, ads-personalization flag). Requires property like |
list_ga4_key_events | read | List the key events (conversions) configured on a GA4 property — by event NAME, with counting method and whether it is a custom event. Requires property like |
list_ga4_measurement_protocol_secrets | read | List Measurement Protocol secrets on a GA4 property, grouped by data stream — by DISPLAY NAME only (the secret value is never returned). Use to see which server-side / MP integrations exist. Requires property like |
list_ga4_properties | read | List GA4 properties under an account. Requires account like |
list_google_ads_accounts | read | List the Google Ads accounts the signed-in user can reach, manager (MCC) accounts included. Returns each |
list_google_ads_audiences | read | The account\ |
list_google_ads_campaigns | read | List a Google Ads account\ |
list_google_ads_conversion_actions | read | List a Google Ads account\ |
list_gtm_accounts | read | List the Google Tag Manager accounts the signed-in user can access. |
list_gtm_clients | read | List the CLIENTS in a SERVER container workspace, e.g. the GA4 client |
list_gtm_containers | read | List the GTM containers within a GTM account. Requires the numeric accountId. |
list_gtm_environments | read | List the container |
list_gtm_folders | read | List the folders in a GTM workspace (name + folderId). The GTM API DOES expose this (folders.list): use it to find a folder id before move_gtm_entities_to_folder / rename_gtm_folder / delete_gtm_folder rather than asking the user. |
list_gtm_tags | read | List the tags in a GTM workspace. Each tag returns tagId, name, type, |
list_gtm_templates | read | List the CUSTOM (community-gallery) templates imported into a workspace with each one\ |
list_gtm_transformations | read | List the TRANSFORMATIONS in a SERVER container workspace; they enrich or redact event data before tags run. |
list_gtm_triggers | read | List the triggers in a GTM workspace. Each returns triggerId, name, type, |
list_gtm_variables | read | List the user-defined variables in a GTM workspace (name + type). Use it to check whether a variable already exists before creating one. |
list_gtm_versions | read | List the container\ |
list_gtm_workspaces | read | List the workspaces in a GTM container. |
list_unused_gtm_triggers | read | List the UNUSED (orphaned) triggers in a GTM workspace: referenced by NO tag (firing or blocking) and not in a Trigger Group, so safe-to-delete clutter. Read-only; use it to show exactly what delete_unused_gtm_triggers would remove (triggerId, name, type). |
lookup_corpus_patterns | read | Look up how tags, triggers and variables were ACTUALLY built across the operator\ |
monitor_ga4_property | write | Run a live HEALTH MONITOR on a GA4 property and return an alert list: is data still being received (realtime active users + last complete day), did a key event stop firing, a sudden traffic spike or drop, conversions not moving with traffic, attribution decay ( |
move_gtm_entities_to_folder | write | Move tags, triggers and/or variables into a GTM folder (organisational only, does NOT change firing). Pass at least one of tagIds / triggerIds / variableIds. To file all GA4 tags: list_gtm_tags, keep the gaawe/gaawc/googtag ids, create_gtm_folder, then call this with those tagIds. |
plan_phone_conversion_tracking | read | Build the COMPLETE, reviewable implementation plan for tracking every phone number on a page as its own Google Ads conversion: one conversion action, one GTM tag and one trigger PER NUMBER. Read-only - it creates nothing. |
plan_server_migration_from_web | read | READ-ONLY: given a WEB container, list every convertible tag and the plan to port it to a SERVER container - which server tool builds each, the destination ids read off the web tag ( |
profile_tag_types | read | Group a workspace\ |
rank_ga4_campaigns | read | Rank a GA4 property |
recall_memories | read | SEARCH the saved memories for this Google account and read back what matches. A few of the most relevant |
remember_memory | write | Save a durable NOTE to the assistant\ |
rename_gtm_folder | write | Rename a GTM folder (organisational only). |
run_ga4_realtime_report | write | Run a GA4 REAL-TIME report (events in the last 30 minutes). dimensions/metrics are GA4 realtime API names (e.g. dimensions [ |
run_ga4_report | write | Run a GA4 report. dimensions/metrics are GA4 API names (e.g. [ |
score_ga4_property | read | Produce a GA4 property health SCORECARD: an overall 0–100 score + letter grade (A–F) and a severity-ranked top-issues list, from the GA4 property audit. The GA4-mode counterpart to analytics_scorecard. Requires property like |
set_ga4_measurement_id_on_all_tags | write | Set/replace the Measurement ID on ALL GA4 tags in the workspace in ONE call (GA4 event tags plus the Google tag). The value may be a literal id (G-/AW-/GT-XXXX) or a GTM variable like {{GA4 Variable}}. PREFER this whenever the user says |
set_google_ads_campaign_status | write | Pause or re-enable a LIVE campaign. Pausing stops spend within minutes; the result returns the previous |
set_gtm_container | write | Switch the ACTIVE GTM container within the current account, by containerId OR containerName (case-insensitive). Optionally set the workspace too; otherwise |
set_gtm_tag_consent | write | Set a tag\ |
set_gtm_tag_paused | write | Pause or unpause a tag in a GTM workspace, preserving its other settings. Applies the audit fix for a paused tag. paused=true pauses, false enables. |
set_gtm_workspace | write | Switch the ACTIVE GTM workspace (the one in the app bar, used by the audit and new operations) within the current account and container. Accepts workspaceId OR workspaceName (case-insensitive). Use when the user says |
set_server_container_tagging_url | write | Set the SERVER container\ |
set_web_server_container_url | write | Wire a WEB container to a server container by setting the web Google tag |
setup_consent_mode_defaults | write | Install the Consent Mode v2 DEFAULT-consent tag in a WEB container: a Custom HTML gtag( |
setup_ecommerce_funnel | write | ONE STEP: install the FULL GA4 ecommerce funnel in a WEB container. Per funnel event (default view_item, add_to_cart, view_cart, begin_checkout, add_shipping_info, add_payment_info, purchase) it creates a Custom Event trigger plus a GA4 event tag with |
site_crawl | read | |
site_pages_discover | read | |
t | read | test tool |
tags_add_ga4_event_parameters | write | |
tags_create | write | |
tags_delete | destructive | [DELETE] Delete a GTM tag. |
tags_get | read | |
tags_list | read | |
tags_type_profile | read | |
tags_update | write | |
templates_describe_fields | read |
Trust audit
BLOCKgrade F · trust 27/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(cmd, (err) => {Delete a CLIENT from a SERVER container workspace (draft, not published). The GTM API DOES support this (workspaces.clients.delete); do NOT tell the user clients can only be removed in the GTM UI. Des
| Jailbreak attempts | System-prompt hardening; write actions gated by out-of-band human approval (UI card, not model text); guardrail flags server-side; refusal + logging of policy-probe patterns; no
workspace-dependencies.ts
workspace-diff.ts
embeddings.ts
install-manifest.ts
log-format.ts
console.log(`[runtime-worker] auth ${TOKEN ? "REQUIRED" : "DISABLED (set RUNTIME_WORKER_TOKEN)"}`);console.log(`Token file (output) : ${getTokenFilePath()}`);url: string; // pixel/beacon URL (protocol-relative //host/path or https, may contain {{variables}})# MCP_URL=http://127.0.0.1:3001/mcp
CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"const raw = readFileSync(configPath, 'utf8').replace(/^/, ''); // strip BOM
check('redact: Anthropic key', (() => { const r = redactSecrets('use sk-ant-api03-abcdefghijklmnopqrstuvwxyz012345'); return r.redacted && !r.text.includes('sk-ant-'); })());loadDbConfig({ DATABASE_URL: "postgres://user:pw@host/db" }),const out = redact({ llm: { provider: 'anthropic', apiKey: 'sk-ant-REALSECRET123' }, developerToken: 'DEVTOKENXYZ', ok: true }) as Record<string, any>;const SECRET = "test-session-secret-0123456789abcdef";
check('redact: private key block', (() => { const r = redactSecrets('x -----BEGIN PRIVATE KEY-----\nMIIabc\n-----END PRIVATE KEY----- y'); return r.redacted && !r.text.includes('MIIabc'); })());batch_delete_gtm_entities, built_in_variables_disable, delete_ga4_account, delete_ga4_property, delete_gtm_client, delete_gtm_folder, delete_gtm_tag, delete_gtm_trigger, delete_gtm_variable, environme
.env.docker.example
.releaserc.json
.vercelignore
verify-driver-payload.test.ts
new Function('window', 'document', 'jQuery', '$', inner)(win, doc, jq, jq);Gates applied: instruction_override, no_behavioural_pass.
b1c705658c8cfull audit observations/trust-audit/mcp-server/samarthanalytics-sj__samarth-analytics-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | b1c705658c8c | BLOCK | F | 27 | first audit |
Questions
What is the samarth-gtm-mcp MCP server?
MCP server for Samarth Analytics Google Tag Manager operations
What tools does samarth-gtm-mcp expose?
200 in total: 126 read-only, 104 that write, and 21 that can delete or overwrite (batch_delete_gtm_entities, built_in_variables_disable, delete_ga4_account, delete_ga4_property, delete_gtm_client). Every one is listed on this page with its risk.
Is samarth-gtm-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (27/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 21 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does samarth-gtm-mcp need?
It reads AUTHORIZE_UI_DIR, GOOGLE_ACCESS_TOKEN, GOOGLE_CLIENT_SECRET, GOOGLE_DESKTOP_CLIENT_SECRET, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, GOOGLE_OAUTH_REDIRECT_URI, GOOGLE_SERVICE_ACCOUNT_KEY_FILE, GTM_MCP_HTTP_AUTH_TOKEN, GTM_MCP_TOKEN_FILE, MCP_AUTH_TOKEN and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does samarth-gtm-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as samarth-gtm-mcp at 1.497.3.
How current is this page?
The grade is for one exact copy of the source (b1c705658c8c), read on 2026-10-11. The repository is watched and re-audited when it changes.