Google Analytics MCP Server (Experimental)

This repo contains the source code for running a local MCP server that interacts with APIs for Google Analytics.

Join the discussion and ask questions in the 🤖-analytics-mcp channel on Discord.

The server uses the Google Analytics Admin API and Google Analytics Data API to provide several Tools for use with LLMs.

• get_account_summaries: Retrieves information about the user's Google Analytics accounts and properties.
• get_property_details: Returns details about a property.
• list_google_ads_links: Returns a list of links to Google Ads accounts for a property.

• run_report: Runs a Google Analytics report using the Data API.
• run_funnel_report: Runs a Google Analytics funnel report using the Data API.
• get_custom_dimensions_and_metrics: Retrieves the custom dimensions and metrics for a specific property.

• run_realtime_report: Runs a Google Analytics realtime report using the Data API.

✨ Watch the Google Analytics MCP Setup Tutorial on YouTube for a step-by-step walkthrough of these instructions.

Setup involves the following steps:

1. Configure Python.
2. Configure credentials for Google Analytics.
3. Configure Gemini.

Install pipx.

Follow the instructions to enable the following APIs in your Google Cloud project:

• Google Analytics Admin API
• Google Analytics Data API

Configure your Application Default Credentials (ADC). Make sure the credentials are for a user with access to your Google Analytics accounts or properties.

Credentials must include the Google Analytics read-only scope:

https://www.googleapis.com/auth/analytics.readonly

Check out Manage OAuth Clients for how to create an OAuth client.

Here are some sample gcloud commands you might find useful:

• Set up ADC using user credentials and an OAuth desktop or web client after downloading the client JSON to YOUR_CLIENT_JSON_FILE.

  gcloud auth application-default login \
    --scopes https://www.googleapis.com/auth/analytics.readonly,https://www.googleapis.com/auth/cloud-platform \
    --client-id-file=YOUR_CLIENT_JSON_FILE

• Set up ADC using service account impersonation.

  gcloud auth application-default login \
    --impersonate-service-account=SERVICE_ACCOUNT_EMAIL \
    --scopes=https://www.googleapis.com/auth/analytics.readonly,https://www.googleapis.com/auth/cloud-platform

When the gcloud auth application-default command completes, copy the PATH_TO_CREDENTIALS_JSON file location printed to the console in the following message. You'll need this for the next step!

Credentials saved to file: [PATH_TO_CREDENTIALS_JSON]

1. Install Gemini CLI or Gemini Code Assist.

2. Create or edit the file at ~/.gemini/settings.json, adding your server to the mcpServers list.

   Replace PATH_TO_CREDENTIALS_JSON with the path you copied in the previous step.

   We also recommend that you add a GOOGLE_CLOUD_PROJECT attribute to the env object. Replace YOUR_PROJECT_ID in the following example with the project ID of your Google Cloud project.

   {
     "mcpServers": {
       "analytics-mcp": {
         "command": "pipx",
         "args": ["run", "analytics-mcp"],
         "env": {
           "GOOGLE_APPLICATION_CREDENTIALS": "PATH_TO_CREDENTIALS_JSON",
           "GOOGLE_PROJECT_ID": "YOUR_PROJECT_ID"
         }
       }
     }
   }

1. Add the MCP server with the following command:

   Replace PATH_TO_CREDENTIALS_JSON with the path you copied in the previous step, and replace YOUR_PROJECT_ID with the project ID of your Google Cloud project.

   claude mcp add analytics-mcp \
     --scope user \
     -e "GOOGLE_APPLICATION_CREDENTIALS=PATH_TO_CREDENTIALS_JSON" \
     -e "GOOGLE_PROJECT_ID=YOUR_PROJECT_ID" \
     -- pipx run analytics-mcp

The default transport remains stdio. For a remote MCP client such as ChatGPT, run the server with Streamable HTTP:

MCP_TRANSPORT=streamable-http \
MCP_HOST=0.0.0.0 \
MCP_PORT=3001 \
analytics-mcp

The remote MCP endpoint is:

https://YOUR_DOMAIN/mcp

For container deployments, mount a Google Application Default Credentials file into the container and point GOOGLE_APPLICATION_CREDENTIALS to it:

/app/credentials.json

GOOGLE_APPLICATION_CREDENTIALS=/app/credentials.json

A service account can be used if its email has access to the required Google Analytics accounts or properties. The Google Analytics Admin API and Data API must also be enabled in the Google Cloud project.

Remote endpoints can require Auth0 OAuth 2.1 bearer tokens. Create an Auth0 API whose Identifier exactly matches the public MCP resource URL:

https://YOUR_DOMAIN/mcp

Use the RFC 9068 JWT profile with RS256 and add a permission such as:

ga:read

Configure the server:

MCP_AUTH_ENABLED=true
MCP_AUTH_ISSUER_URL=https://YOUR_AUTH0_DOMAIN/
MCP_AUTH_AUDIENCE=https://YOUR_DOMAIN/mcp
MCP_AUTH_RESOURCE=https://YOUR_DOMAIN/mcp
MCP_AUTH_REQUIRED_SCOPES=ga:read

To restrict access to one Auth0 user, also set that user's stable Auth0 sub value:

MCP_AUTH_ALLOWED_SUBJECT=google-oauth2|YOUR_AUTH0_USER_ID

The server validates the JWT signature, issuer, audience, expiry, required scope, and optional subject. When authentication is enabled it also exposes RFC 9728 protected-resource metadata at:

https://YOUR_DOMAIN/.well-known/oauth-protected-resource/mcp

For ChatGPT DCR-based OAuth, enable Auth0 Resource Parameter Compatibility and Dynamic Client Registration. If Google is the login provider, make the Google social connection available at the domain level. Third-party user-delegated access should grant only the ga:read permission.

The repository includes a Dockerfile. A typical deployment uses:

docker build -t analytics-mcp .

docker run \
  -e MCP_TRANSPORT=streamable-http \
  -e MCP_HOST=0.0.0.0 \
  -e MCP_PORT=3001 \
  -e MCP_AUTH_ENABLED=true \
  -e MCP_AUTH_ISSUER_URL=https://YOUR_AUTH0_DOMAIN/ \
  -e MCP_AUTH_AUDIENCE=https://YOUR_DOMAIN/mcp \
  -e MCP_AUTH_RESOURCE=https://YOUR_DOMAIN/mcp \
  -e MCP_AUTH_REQUIRED_SCOPES=ga:read \
  -e GOOGLE_APPLICATION_CREDENTIALS=/app/credentials.json \
  -v /path/to/credentials.json:/app/credentials.json:ro \
  -p 3001:3001 \
  analytics-mcp

For reverse-proxy deployments, the public hostname is automatically allowed when MCP_AUTH_RESOURCE is configured. Additional hosts or browser origins can be supplied with comma-separated MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS.

Launch Gemini Code Assist or Gemini CLI and type /mcp. You should see analytics-mcp listed in the results.

Here are some sample prompts to get you started:

• Ask what the server can do:

  what can the analytics-mcp server do?
  

• Ask about a Google Analytics property

  Give me details about my Google Analytics property with 'xyz' in the name
  

• Prompt for analysis:

  what are the most popular events in my Google Analytics property in the last 180 days?
  

• Ask about signed-in users:

  were most of my users in the last 6 months logged in?
  

• Ask about property configuration:

  what are the custom dimensions and custom metrics in my property?
  

Contributions welcome! See the Contributing Guide.