mcp-google-multi 6.0.0-alpha.13 → 6.0.0-alpha.15

package/README.md

@@ -1,6 +1,6 @@
 # mcp-google-multi
 
-The most complete **local Google Workspace MCP server**: Gmail, Drive, Calendar, Sheets, Docs, Slides, Forms, Contacts, Tasks, Chat, Meet, Classroom, Vault, Admin and more — **every OAuth-reachable Workspace API method** as a tool, across **multiple Google accounts** at once, from Claude Code or any MCP client.
+The most complete **local Google Workspace MCP server**: Gmail, Drive, Calendar, Sheets, Docs, Slides, Forms, Contacts, Tasks, Chat, Meet, Analytics (GA4), Search Console, Classroom, Vault, Admin and more — **every OAuth-reachable API method** as a tool, across **multiple Google accounts** at once, from Claude Code or any MCP client.
 
 [![npm](https://img.shields.io/npm/v/mcp-google-multi?label=npm&color=cb3837)](https://www.npmjs.com/package/mcp-google-multi)
 

package/dist/discovery-client.d.ts

@@ -1,4 +1,4 @@
-export declare const WORKSPACE_APIS: Record<string, {
+export declare const SUPPORTED_APIS: Record<string, {
     id: string;
     version: string;
 }>;

package/dist/discovery-client.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-export const WORKSPACE_APIS = {
+export const SUPPORTED_APIS = {
     gmail: { id: 'gmail', version: 'v1' },
     drive: { id: 'drive', version: 'v3' },
     calendar: { id: 'calendar', version: 'v3' },
@@ -98,9 +98,9 @@ export async function loadMethodIndex(api, deps = {}) {
     const cached = memoryCache.get(api);
     if (cached && now() < cached.refreshAfter)
         return cached.index;
-    const spec = WORKSPACE_APIS[api];
+    const spec = SUPPORTED_APIS[api];
     if (!spec) {
-        throw new Error(`Unknown api "${api}". Known: ${Object.keys(WORKSPACE_APIS).join(', ')}`);
+        throw new Error(`Unknown api "${api}". Known: ${Object.keys(SUPPORTED_APIS).join(', ')}`);
     }
     const fetchFn = deps.fetchFn ?? ((url) => fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) }));
     const cacheDir = deps.cacheDir ?? discoveryCacheDir();
@@ -126,20 +126,34 @@ export async function loadMethodIndex(api, deps = {}) {
     if (cacheFresh())
         doc = readCache();
     if (!doc) {
-        const url = `https://www.googleapis.com/discovery/v1/apis/${spec.id}/${spec.version}/rest`;
-        try {
-            const res = await fetchFn(url);
-            if (!res.ok)
-                throw new Error(`HTTP ${res.status}`);
-            doc = (await res.json());
-            fs.mkdirSync(cacheDir, { recursive: true });
-            fs.writeFileSync(cacheFile, JSON.stringify(doc), { mode: 0o600 });
+        // Newer APIs (analyticsadmin/analyticsdata) are absent from the central
+        // discovery directory (404); each service's own $discovery endpoint is
+        // authoritative, so try both — same fallback as scripts/fetch-discovery.
+        const urls = [
+            `https://www.googleapis.com/discovery/v1/apis/${spec.id}/${spec.version}/rest`,
+            `https://${spec.id}.googleapis.com/$discovery/rest?version=${spec.version}`,
+        ];
+        let fetchError;
+        for (const url of urls) {
+            try {
+                const res = await fetchFn(url);
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                doc = (await res.json());
+                fs.mkdirSync(cacheDir, { recursive: true });
+                fs.writeFileSync(cacheFile, JSON.stringify(doc), { mode: 0o600 });
+                break;
+            }
+            catch (err) {
+                fetchError = err;
+                doc = undefined;
+            }
         }
-        catch (err) {
+        if (!doc) {
             doc = readCache();
             staleFallback = true;
             if (!doc) {
-                throw new Error(`Could not fetch the Google API Discovery document for "${api}" and no local cache exists (${err.message}). Retry when online.`, { cause: err });
+                throw new Error(`Could not fetch the Google API Discovery document for "${api}" and no local cache exists (${fetchError?.message ?? 'fetch failed'}). Retry when online.`, { cause: fetchError });
             }
         }
     }

package/dist/scope-catalog.js

@@ -108,13 +108,22 @@ export const BUNDLE_CATALOG = {
         description: 'Read Gmail Postmaster Tools deliverability data.',
         risk: 'low',
     },
-    // Read-only by design: GA4 admin writes need analytics.edit, which ships as
-    // a separate opt-in bundle only if real demand appears (plan 6.0.0 GA-1).
     analytics: {
         scopes: ['https://www.googleapis.com/auth/analytics.readonly'],
         description: 'Read Google Analytics (GA4): run reports and inspect accounts, properties and their configuration.',
         risk: 'low',
     },
+    // Includes readonly so it is self-sufficient: analytics.edit alone does not
+    // authorize Data API reads. The smaller `analytics` bundle stays the hint
+    // target for read scopes (scope-observability sorts bundles by size).
+    analytics_write: {
+        scopes: [
+            'https://www.googleapis.com/auth/analytics.readonly',
+            'https://www.googleapis.com/auth/analytics.edit',
+        ],
+        description: 'Edit Google Analytics (GA4) configuration: properties, data streams, key events, custom dimensions and metrics. Includes read access.',
+        risk: 'medium',
+    },
     groupssettings: {
         scopes: ['https://www.googleapis.com/auth/apps.groups.settings'],
         description: 'Change Google Groups settings for the domain.',

package/dist/services.js

@@ -26,7 +26,7 @@ export const SERVICES = [
     { name: 'slides', register: registerSlidesTools, enabled: () => new Set(getOptionalBundles()).has('slides') },
     { name: 'forms', register: registerFormsTools, enabled: () => new Set(getOptionalBundles()).has('forms') },
     { name: 'chat', register: registerChatTools, enabled: () => new Set(getOptionalBundles()).has('chat') },
-    { name: 'analytics', register: registerAnalyticsTools, enabled: () => new Set(getOptionalBundles()).has('analytics') },
+    { name: 'analytics', register: registerAnalyticsTools, enabled: () => { const b = new Set(getOptionalBundles()); return b.has('analytics') || b.has('analytics_write'); } },
     { name: 'admin', register: registerAdminTools, enabled: () => getAdminAccounts().length > 0 },
 ];
 // Generated-only services with opt-in scopes; admin/forms/chat/analytics reuse their curated gate in buildRegistry,

package/dist/tools/_errors.js

@@ -129,6 +129,19 @@ export function mapGoogleError(error, account, forbiddenHint, scopeContext) {
     }
     if (status === 429) {
         const retryAfter = error?.response?.headers?.['retry-after'];
+        // GA4 quota exhaustion ("Exhausted property tokens ...") is a per-property
+        // token bucket, not a transient rate spike: shrinking the request is the
+        // lever that helps, and a blind immediate retry only burns more tokens.
+        if (/property tokens/i.test(message)) {
+            return {
+                error: 'rate_limited',
+                message,
+                hint: 'GA4 quotas are per-property token buckets that refill over the hour/day. ' +
+                    'Narrow the date range, request fewer dimensions/metrics/rows, and pass returnPropertyQuota to see the remaining tokens before retrying.',
+                retriable: true,
+                account,
+            };
+        }
         return {
             error: 'rate_limited',
             message,

package/dist/tools/google-api.js

@@ -6,7 +6,7 @@ import { coerceJson } from './_coerce.js';
 import { getToolsets, toolsetEnabled } from '../toolsets.js';
 import { editDistance } from '../scope-catalog.js';
 import { executeApiMethod, jsonResult } from '../executor.js';
-import { WORKSPACE_APIS, cudFromMethod, loadMethodIndex, searchMethods, } from '../discovery-client.js';
+import { SUPPORTED_APIS, cudFromMethod, loadMethodIndex, searchMethods, } from '../discovery-client.js';
 const accountEnum = accountAliasSchema.optional();
 // Policy/toolset namespace for each API alias must match the NAMED tools' service
 // names, or user deny globs and GOOGLE_TOOLSETS silently miss escape-hatch calls.
@@ -61,7 +61,7 @@ export function registerEscapeTools(registry, policy, deps = {}) {
     const apiEnabled = (alias) => {
         return toolsetEnabled(toolsets, serviceForAlias(alias));
     };
-    const enabledApis = Object.keys(WORKSPACE_APIS).filter(apiEnabled);
+    const enabledApis = Object.keys(SUPPORTED_APIS).filter(apiEnabled);
     const apiList = enabledApis.join(', ');
     const toolsetDisabled = (alias) => jsonResult({
         error: 'toolset_disabled',
@@ -80,7 +80,7 @@ export function registerEscapeTools(registry, policy, deps = {}) {
         },
         annotations: { openWorldHint: true },
     }, async ({ query, api, maxResults }) => {
-        if (api && !WORKSPACE_APIS[api]) {
+        if (api && !SUPPORTED_APIS[api]) {
             return jsonResult({ error: 'unknown_api', message: `Unknown api "${api}".`, hint: `Known APIs: ${apiList}`, retriable: false }, true);
         }
         if (api && !apiEnabled(api))
@@ -129,7 +129,7 @@ export function registerEscapeTools(registry, policy, deps = {}) {
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         _meta: { 'anthropic/maxResultSizeChars': 100_000 },
     }, async ({ account, api, methodId, pathParams, queryParams, body }) => {
-        if (!WORKSPACE_APIS[api]) {
+        if (!SUPPORTED_APIS[api]) {
             return jsonResult({ error: 'unknown_api', message: `Unknown api "${api}".`, hint: `Known APIs: ${apiList}`, retriable: false, account }, true);
         }
         if (!apiEnabled(api))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.13",
+  "version": "6.0.0-alpha.15",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
   "license": "MIT",