mcp-ga4 2.0.10 → 2.0.12

package/README.md

@@ -27,6 +27,8 @@ npm run build
 
 ## Configuration
 
+**Security:** Never share your `.mcp.json` file or commit it to git -- it may contain API credentials. Add `.mcp.json` to your `.gitignore`.
+
 ### Mode 1: Single Property (env vars)
 
 Set environment variables to connect to a single GA4 property:

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"0a22160","builtAt":"2026-04-09T22:24:08.905Z"}
+{"sha":"3bd9339","builtAt":"2026-04-09T23:11:56.896Z"}

package/dist/index.js

@@ -184,12 +184,19 @@ class Ga4Manager {
         const mets = (options.metrics || "eventCount").split(",").map(m => ({ name: m.trim() })).filter(m => m.name);
         const startDate = options.startDate || "7daysAgo";
         const endDate = options.endDate || "today";
+        // Future date validation (skip relative dates like "7daysAgo")
+        const today_ga4 = new Date().toISOString().slice(0, 10);
+        if (startDate && !startDate.includes("daysAgo") && !startDate.includes("yesterday") && !startDate.includes("today") && startDate > today_ga4) {
+            return { rows: [], row_count: 0, error: `start_date "${startDate}" is in the future. Reports only cover historical data.` };
+        }
+        // Cap limit at 10,000 for sanity (GA4 API max is 100,000)
+        const limit = Math.min(options.limit || 100, 10000);
         const request = {
             property: `properties/${propertyId}`,
             dimensions: dims,
             metrics: mets,
             dateRanges: [{ startDate, endDate }],
-            limit: options.limit || 100,
+            limit,
         };
         if (options.dimensionFilter && options.dimensionFilter.includes("==")) {
             const [field, value] = options.dimensionFilter.split("==", 2);
@@ -443,9 +450,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         else {
             response.details = rawError.stack;
         }
+        // Size-limit error responses through safeResponse to prevent oversized payloads
+        const safeErrorResponse = safeResponse(response, "error");
         return {
             isError: true,
-            content: [{ type: "text", text: JSON.stringify(response, null, 2) }],
+            content: [{ type: "text", text: JSON.stringify(safeErrorResponse, null, 2) }],
         };
     }
 });

package/dist/resilience.js

@@ -25,6 +25,10 @@ export function safeResponse(data, context) {
         const sizeBytes = Buffer.byteLength(jsonStr, "utf-8");
         if (sizeBytes <= MAX_RESPONSE_SIZE)
             return current;
+        // Deep clone on first truncation pass to avoid mutating the original object
+        if (pass === 0 && typeof current === "object" && current !== null) {
+            current = JSON.parse(JSON.stringify(current));
+        }
         logger.warn({ sizeBytes, maxSize: MAX_RESPONSE_SIZE, context, pass }, "Response exceeds size limit, truncating");
         if (Array.isArray(current)) {
             current = current.slice(0, Math.max(1, Math.floor(current.length * 0.5)));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-ga4",
   "mcpName": "io.github.mharnett/ga4",
-  "version": "2.0.10",
+  "version": "2.0.12",
   "description": "MCP server for Google Analytics 4 - query GA4 data with natural language via Claude.",
   "main": "dist/index.js",
   "bin": {