Google Analytics MCP

Findings (17)

• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  python-multipart@0.0.9: 8 known vulnerabilities

  PYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +3 more

  requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  cryptography@49.0.0: 1 known vulnerability

  PYSEC-2026-3552

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  httpx2@2.10.0: 3 known vulnerabilities

  PYSEC-2026-3846, PYSEC-2026-3848, PYSEC-2026-3849

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  mcp@2.0.0: 4 known vulnerabilities

  GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  pyasn1@0.6.3: 7 known vulnerabilities

  PYSEC-2026-3455, PYSEC-2026-3456, PYSEC-2026-3457, GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39 +2 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  urllib3@2.7.0: 3 known vulnerabilities

  PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  opentelemetry-api@1.44.0: 1 known vulnerability

  GHSA-xcq7-p3pf-p88h

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  GA4_SESSION_FILE, SHELL, TERM_PROGRAM, LANG, CI, GITHUB_ACTIONS, GA_MCP_TELEMETRY, GA4_MCP_INTERNAL, GA4_MCP_SOURCE, DOCS_DIR

Network activity

Tools exposed (12)

• check_for_updates

  Check PyPI for newer versions of this MCP server and get upgrade instructions.

• list_properties

  List all GA4 properties associated with an account.

• search_schema

  Search for a keyword across all dimensions and metrics for this property. Returns a ranked list of up to 10 matching fields scored by relevance. Returns: {"top_results": {"DIMENSION: api_name": score, "METRIC: api_name": score, ...}} Use this when you have a concept ("engagement",

• get_property_schema

  Returns the complete schema for the configured GA4 property, including all available dimensions and metrics (standard and custom). Warning: This can be a very large object (10k+ tokens). Use search_schema for most discovery tasks.

• list_dimension_categories

  List all dimension categories for this GA4 property, with a count of dimensions in each category. Returns: {"dimension_categories": {"Category Name": count, ...}} Use this as the first step in dimension exploration — browse categories, then call get_dimensions_by_category with

• list_metric_categories

  List all metric categories for this GA4 property, with a count of metrics in each category. Returns: {"metric_categories": {"Category Name": count, ...}} Use this as the first step in metric exploration — browse categories, then call get_metrics_by_category with the name that

• get_dimensions_by_category

  Return all dimensions in a specific category with their API names and descriptions. Returns: {"dimension_api_name": "description", ...} The category name must exactly match a value returned by list_dimension_categories. Use search_schema instead if you already have a keyword — it

• get_metrics_by_category

  Return all metrics in a specific category with their API names and descriptions. Returns: {"metric_api_name": "description", ...} The category name must exactly match a value returned by list_metric_categories. Use search_schema instead if you already have a keyword — it is faster

• get_ga4_data

  Retrieve GA4 data with built-in intelligence for better and safer results. Returns on success: {"data": [...], "metadata": {...}, "_skills_tip": "..."}. For multi-row pulls (a time series like ['date'], or any breakdown) the result also carries "totals": {metric: value} — GA4 s

• get_troubleshooting_guide

  Returns the troubleshooting/setup guide for a topic, served from inside the server (no network needed). Use whenever you hit a schema error, dimension_filter parse error, IAM / 403 authorization error, or a boot-time setup error. Args: topic: One of "setup", "iam", or "

• search_skills

  Fetch analytical recipes and how-to guides from the GA4 skills library. Skills are domain-specific playbooks for common GA4 analysis patterns — exact dimensions, metrics, filters, and interpretation logic for each use case. Call this BEFORE querying get_ga4_data for any domain-spec

• setup_ga4_access

  Interactively fix a broken GA4 MCP setup (missing property ID, missing or expired credentials, or missing GA4 access) by asking the user for the needed input through the client, then re-initializing without a restart. Call this whenever a configuration or authentication error is rep