mcp-ga4 2.0.9 → 2.0.11

package/README.md

@@ -27,6 +27,8 @@ npm run build
 
 ## Configuration
 
+**Security:** Never share your `.mcp.json` file or commit it to git -- it may contain API credentials. Add `.mcp.json` to your `.gitignore`.
+
 ### Mode 1: Single Property (env vars)
 
 Set environment variables to connect to a single GA4 property:

package/dist/build-info.json

@@ -1 +1 @@
-{"sha":"2bb300b","builtAt":"2026-04-09T22:09:46.643Z"}
+{"sha":"5b5fb2c","builtAt":"2026-04-09T23:02:54.441Z"}

package/dist/errors.js

@@ -29,14 +29,21 @@ export function validateCredentials() {
         missing.push("GA4_PROPERTY_ID");
     if (!process.env.GOOGLE_APPLICATION_CREDENTIALS?.trim())
         missing.push("GOOGLE_APPLICATION_CREDENTIALS");
+    // Basic format validation: credentials should have reasonable length > 5 chars
+    if (process.env.GOOGLE_APPLICATION_CREDENTIALS?.trim() && process.env.GOOGLE_APPLICATION_CREDENTIALS.trim().length > 0 && process.env.GOOGLE_APPLICATION_CREDENTIALS.trim().length < 5) {
+        missing.push("GOOGLE_APPLICATION_CREDENTIALS (format: path too short, expected length > 5)");
+    }
     return { valid: missing.length === 0, missing };
 }
 export function classifyError(error) {
     const message = error?.message || String(error);
     const code = error?.code || error?.status;
+    // Check response body for error objects (gRPC/REST can return errors in body)
+    const bodyError = error?.response?.body?.error || error?.data?.error || error?.errors?.[0];
     if (code === 401 || code === 403 || code === 7 || code === 16 ||
         message.includes("PERMISSION_DENIED") || message.includes("UNAUTHENTICATED") ||
-        message.includes("invalid_grant")) {
+        message.includes("invalid_grant") ||
+        bodyError?.code === 7 || bodyError?.code === 16) {
         return new Ga4AuthError(`GA4 auth failed: ${message}. Check credentials.`, error);
     }
     if (code === 429 || code === 8 || message.includes("RESOURCE_EXHAUSTED") || message.includes("rateLimitExceeded")) {

package/dist/index.js

@@ -11,6 +11,7 @@ import { GoogleAuth } from "google-auth-library";
 import { Ga4AuthError, Ga4RateLimitError, Ga4ServiceError, classifyError, } from "./errors.js";
 import { tools } from "./tools.js";
 import { withResilience, safeResponse, logger } from "./resilience.js";
+import v8 from "v8";
 // CLI package info
 const __cliPkg = JSON.parse(readFileSync(join(dirname(new URL(import.meta.url).pathname), "..", "package.json"), "utf-8"));
 // Log build fingerprint at startup
@@ -42,6 +43,15 @@ if (process.argv.includes("--version") || process.argv.includes("-v")) {
     console.error(__cliPkg.version);
     process.exit(0);
 }
+// Startup: detect npx vs direct node
+if (process.argv[1]?.includes('.npm/_npx')) {
+    console.error("[startup] Running via npx -- first run may be slow due to package resolution");
+}
+// Startup: check heap size
+const heapLimit = v8.getHeapStatistics().heap_size_limit;
+if (heapLimit < 256 * 1024 * 1024) {
+    console.error(`[startup] WARNING: Heap limit is ${Math.round(heapLimit / 1024 / 1024)}MB`);
+}
 // ============================================
 // ENV VAR TRIMMING
 // ============================================
@@ -433,9 +443,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         else {
             response.details = rawError.stack;
         }
+        // Size-limit error responses through safeResponse to prevent oversized payloads
+        const safeErrorResponse = safeResponse(response, "error");
         return {
             isError: true,
-            content: [{ type: "text", text: JSON.stringify(response, null, 2) }],
+            content: [{ type: "text", text: JSON.stringify(safeErrorResponse, null, 2) }],
         };
     }
 });

package/dist/resilience.js

@@ -2,6 +2,7 @@ import { retry, circuitBreaker, wrap, handleWhen, timeout, TimeoutStrategy, Expo
 import pino from "pino";
 export const logger = pino({
     level: process.env.LOG_LEVEL || "info",
+    redact: ["access_token", "refresh_token", "client_secret", "*.access_token", "*.refresh_token", "*.client_secret"],
     ...(process.env.NODE_ENV !== "test" && process.stderr.isTTY && {
         transport: {
             target: "pino-pretty",
@@ -24,6 +25,10 @@ export function safeResponse(data, context) {
         const sizeBytes = Buffer.byteLength(jsonStr, "utf-8");
         if (sizeBytes <= MAX_RESPONSE_SIZE)
             return current;
+        // Deep clone on first truncation pass to avoid mutating the original object
+        if (pass === 0 && typeof current === "object" && current !== null) {
+            current = JSON.parse(JSON.stringify(current));
+        }
         logger.warn({ sizeBytes, maxSize: MAX_RESPONSE_SIZE, context, pass }, "Response exceeds size limit, truncating");
         if (Array.isArray(current)) {
             current = current.slice(0, Math.max(1, Math.floor(current.length * 0.5)));

package/dist/tools.js

@@ -3,6 +3,7 @@ export const tools = [
         name: "ga4_get_client_context",
         description: "Get the current GA4 client context and health status based on working directory. Call this first to confirm which GA4 property you're working with.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 working_directory: { type: "string", description: "The current working directory" },
@@ -14,6 +15,7 @@ export const tools = [
         name: "ga4_run_report",
         description: 'Query GA4 historical report. Common patterns: top pages (dimensions="pagePath", metrics="screenPageViews"), traffic sources (dimensions="sessionSource,sessionMedium", metrics="sessions,totalUsers"), daily trend (dimensions="date", metrics="sessions").',
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -32,6 +34,7 @@ export const tools = [
         name: "ga4_realtime_report",
         description: "Query GA4 Realtime Report (last 30 minutes).",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -46,6 +49,7 @@ export const tools = [
         name: "ga4_list_custom_dimensions",
         description: "List all registered custom dimensions for a GA4 property.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -57,6 +61,7 @@ export const tools = [
         name: "ga4_create_custom_dimension",
         description: "Register a new custom dimension in a GA4 property.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -72,6 +77,7 @@ export const tools = [
         name: "ga4_list_custom_metrics",
         description: "List all registered custom metrics for a GA4 property.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -83,6 +89,7 @@ export const tools = [
         name: "ga4_list_data_streams",
         description: "List all data streams for a GA4 property.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 property_id: { type: "string", description: "GA4 property ID (numeric)" },
@@ -94,6 +101,7 @@ export const tools = [
         name: "ga4_send_feedback",
         description: "Send feedback about the GA4 MCP tools. Use when a query didn't work as expected.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 feedback_type: { type: "string", description: "One of: bug, feature, question" },
@@ -107,6 +115,7 @@ export const tools = [
         name: "ga4_suggest_improvement",
         description: "Log a GA4 query pattern that didn't work well, so it can be improved.",
         inputSchema: {
+            additionalProperties: false,
             type: "object",
             properties: {
                 failed_query: { type: "string", description: "The natural language question the user asked" },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-ga4",
   "mcpName": "io.github.mharnett/ga4",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "MCP server for Google Analytics 4 - query GA4 data with natural language via Claude.",
   "main": "dist/index.js",
   "bin": {