flin-gmp-mcp

Read-only MCP server for Google Marketing Platform, built like the other flin MCPs: Python, FastMCP, uv, browser OAuth, private local tokens, and stdio transport.

Supported products

GA4 reporting belongs in the separate flin-ga4-mcp. Google Ads, Search Console and Google Tag Manager are outside this package's scope. GMP account links are Analytics account links, not a universal cross-product account directory.

No campaign mutations, account linking, report creation/execution, or arbitrary HTTP requests are exposed. DV360 and CM360 report tools return existing metadata and URLs, not downloaded CSV contents. SA360 returns performance rows directly. DV360 uses v4; v5 was still labelled beta in Google's documentation when this implementation was verified on 2026-10-30.

Quickstart from this repository

Requires Python 3.10+ and uv.

uv sync --locked --extra dev

Create a Google Cloud project and enable the APIs you will use:

• Google Marketing Platform Admin API (marketingplatformadmin.googleapis.com)
• Display & Video 360 API (displayvideo.googleapis.com)
• DoubleClick Bid Manager API (doubleclickbidmanager.googleapis.com)
• Campaign Manager 360 API (dfareporting.googleapis.com)
• Search Ads 360 Reporting API (searchads360.googleapis.com)

Configure the Google OAuth consent screen, add your account as a test user if using Testing mode, and create an OAuth client of type Desktop app. The Google account must already have access to the relevant products. OAuth consent alone does not grant product access. CM360 also requires an API-enabled user profile.

Add this configuration to a stdio MCP client such as Claude Desktop, replacing the checkout path and OAuth values:

{
  "mcpServers": {
    "flin-gmp-mcp": {
      "command": "uv",
      "args": [
        "run", "--directory", "/absolute/path/to/flin-gmp-mcp",
        "--locked", "flin-gmp-mcp"
      ],
      "env": {
        "GOOGLE_CLIENT_ID": "your-desktop-client-id",
        "GOOGLE_CLIENT_SECRET": "your-desktop-client-secret"
      }
    }
  }
}

Restart your MCP client. Then ask it to:

1. Run health_check.
2. Run authenticate, finish Google sign-in in the browser, and grant the requested permissions.
3. Discover IDs using list_organizations, list_dv360_partners, list_cm360_profiles, or list_sa360_customers.
4. Use those IDs in the corresponding data tools.

authenticate waits up to 180 seconds; configure a longer tool timeout in your client if necessary. It requires a browser on the computer running the server. Data tools never launch a browser; they return oauth_required when sign-in is needed. Access tokens refresh automatically. Use authenticate(force=true) to replace a stale login or switch the selected account. No secrets are returned.

Install from PyPI

uvx flin-gmp-mcp@0.1.1

In an MCP client, use command: "uvx" with args: ["flin-gmp-mcp@0.1.1"] and the same Google environment variables shown above.

macOS desktop installation

Download flin-gmp-mcp-0.1.1.mcpb from the v0.1.1 release and import it into Claude Desktop. The package includes the server and locked dependency definitions; the first launch needs internet access. Enter your own Google OAuth credentials in the extension settings.

See macOS instructions, privacy and support. The bundle is unsigned and accompanied by a SHA-256 checksum.

Configuration

Environment variables are read from the process. .env.example is a reference; .env files are not automatically loaded.

Only enabled products' scopes are requested. Disabled products return a configuration error. After adding a product, run authenticate again to grant its scopes. A token created by a different OAuth client is rejected.

Multiple accounts and token storage

Pass account="work" to authenticate and subsequent calls to use a separate Google login. Aliases use lower-case letters, digits, _ and -, start with a letter or digit, and have at most 64 characters. Omit account for the default login; the name default is reserved.

Default directories:

• macOS: ~/Library/Application Support/flin-gmp-mcp/
• Linux: $XDG_CONFIG_HOME/flin-gmp-mcp/ or ~/.config/flin-gmp-mcp/
• Windows: %APPDATA%\flin-gmp-mcp\

The default token is default.json; named accounts use <account>.json. Writes are atomic and files use mode 0600 on POSIX. New directories use 0700. Existing directories must be owned by the user and not writable by others. Never commit these files. To disconnect locally, stop the server and delete the corresponding token file; revoke the app in your Google account to invalidate its access.

OAuth scopes and read-only boundary

Google's 360 APIs require scopes that can also permit writes. The MCP enforces read-only behavior with a fixed endpoint/method allowlist: GET requests and only SA360 reporting/field-search POST requests. Use read-only product roles wherever available for an additional account-level boundary. Authentication writes local credentials and is annotated separately from read-only data tools.

Results and pagination

Data tools return { "ok": true, "service": "...", "account": "...", "data": {...} }. data preserves Google's native response, including field masks, currencies, report statuses and nextPageToken. The list key varies by API (organizations, advertisers, items, results, etc.). Empty responses are valid.

Each list/search call returns one page. If data.nextPageToken is present, pass it as page_token with all other arguments unchanged. Do not report the first page as the full account total. Limits: DV360 200, Bid Manager 100, GMP Admin 1000, CM360 1000 (local cap), SA360 data search 10000. Responses over 10 MiB are rejected; reduce the page size or selected fields. Requests have a 10-second connection and 60-second read timeout, with no automatic quota retries.

SA360 IDs are bare digits without hyphens. login_customer_id selects the manager through which access is granted. list_sa360_customers lists directly accessible customers only; get_sa360_customer_clients discovers manager children. get_sa360_campaign_performance uses inclusive account-timezone dates and returns costMicros in millionths of customer.currencyCode.

Development

uv sync --locked --extra dev
uv run ruff check .
uv run pytest
uv build

Tests use mocked Google responses, including transport/authentication failures, request contracts and a real local MCP stdio handshake. No Google credentials are required. Live product access must be verified separately with your account.

• Tool reference and examples
• Testing and live verification
• Release checklist

References

Implementation conventions follow flin Search Console and flin Google Ads.

Verified against Google's REST references and live discovery documents:

• GMP Admin API
• DV360 v4
• Bid Manager v2
• CM360 v5
• SA360 Reporting v0
• Desktop OAuth

MIT © flin GmbH.