measure-analytics-mcp 0.2.0__tar.gz

measure_analytics_mcp-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Sync (resolves measure-sdk from PyPI)
+        run: uv sync --all-extras
+      - name: Ruff (lint)
+        run: uv run ruff check .
+      - name: Ruff (format)
+        run: uv run ruff format --check .
+      - name: MyPy (strict)
+        run: uv run mypy .
+      - name: Pytest
+        run: uv run pytest -ra

measure_analytics_mcp-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,23 @@
+name: Release to PyPI
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch: {}      # allow manual publish of the current version
+
+permissions:
+  contents: read
+  id-token: write          # OIDC token for PyPI Trusted Publishing (no API token stored)
+
+jobs:
+  pypi-publish:
+    runs-on: ubuntu-latest
+    environment: pypi        # create a matching GitHub environment + PyPI Trusted Publisher
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1

measure_analytics_mcp-0.2.0/.gitignore

@@ -0,0 +1,47 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.python-version
+
+# uv
+uv.lock.bak
+
+# Testing / coverage
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+
+# Secrets & credentials — NEVER commit these
+.env
+.env.*
+!.env.example
+*.json.key
+service-account*.json
+client_secret*.json
+credentials/
+.secrets/
+token.json
+*.pem
+
+# Local alert database (Alerts Engine)
+.measure/
+*.db
+
+# Docs build
+site/
+
+# IDE / OS
+.idea/
+.vscode/
+.DS_Store
+*.swp

measure_analytics_mcp-0.2.0/CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+All notable changes to **measure-analytics-mcp** are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] — 2026-07-07
+
+### Changed
+
+- **Consolidated into a single installable package.** The repo was a `uv`
+  workspace of seven sub-packages (`measure-ga4-intelligence`,
+  `measure-bigquery-analyst`, …) that were never published to PyPI, so
+  `pip install measure-analytics-mcp` could not resolve them. All seven servers
+  now ship from one wheel: their code moved from `apps/*/src/` to `src/`, tests
+  to `tests/<domain>/`, and a single `pyproject.toml` exposes the seven console
+  scripts (`measure-ga4`, `measure-gtm`, `measure-bigquery`, `measure-consent`,
+  `measure-sgtm`, `measure-dataquality`, `measure-alerts`). The only external
+  dependency remains `measure-sdk`. No server behaviour or import paths changed.
+
+## [0.1.1] — 2026-06-29
+
+### Changed
+
+- Pin `measure-sdk` v0.1.4 — ships the bundled default OAuth client, so users
+  can `pip install` and log in (`measure_login`) with no Google Cloud setup.
+
+## [0.1.0] — 2026-06-26
+
+First release as an independent product of the
+[Measure MCP ecosystem](https://github.com/measure-mcp), built on
+`measure-sdk>=0.1,<0.2`.
+
+### Added
+
+- Seven focused MCP servers, each consuming the shared SDK:
+  **BigQuery Analyst** (cost-aware read-only SQL), **GA4 Intelligence**
+  (Admin + Data audits), **Consent Mode Auditor** (Consent Mode v2), **Data
+  Quality** (GA4-export health), **GTM Operations** (web audits + guarded
+  writes), **Server-Side Auditor** (sGTM + Cloud Run health), and the persistent
+  **Alerts Engine**.
+
+### Changed
+
+- Extracted from the original `measure-analytics-mcp` monorepo: shared
+  infrastructure and domain models moved to the standalone `measure-sdk`; servers
+  now consume `measure_sdk` exclusively. Google Ads analysis moved to the sibling
+  **measure-paid-media-mcp**.
+
+[0.2.0]: https://github.com/measure-mcp/measure-analytics-mcp/releases/tag/v0.2.0
+[0.1.1]: https://github.com/measure-mcp/measure-analytics-mcp/releases/tag/v0.1.1
+[0.1.0]: https://github.com/measure-mcp/measure-analytics-mcp/releases/tag/v0.1.0

measure_analytics_mcp-0.2.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,34 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors and leaders pledge to make participation in the
+Measure AI community a harassment-free experience for everyone, regardless of
+age, body size, visible or invisible disability, ethnicity, sex characteristics,
+gender identity and expression, level of experience, education, socio-economic
+status, nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+## Our Standards
+
+Examples of behaviour that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints and experiences
+- Giving and gracefully accepting constructive feedback
+
+Examples of unacceptable behaviour:
+
+- Trolling, insulting or derogatory comments, and personal attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+
+## Enforcement
+
+Instances of abusive, harassing or otherwise unacceptable behaviour may be
+reported to the maintainers via a private GitHub security advisory or the
+contact in [SECURITY.md](SECURITY.md). All complaints will be reviewed and
+investigated promptly and fairly.
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1.

measure_analytics_mcp-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing
+
+Thanks for helping build Measure Analytics MCP! 🎉
+
+## Setup
+
+```bash
+uv sync --all-extras --dev
+```
+
+## Before you push
+
+```bash
+uv run ruff check . && uv run ruff format --check .
+uv run mypy packages apps
+uv run pytest
+```
+
+All four must pass; CI enforces them.
+
+## Adding a new MCP server
+
+1. Copy the structure of `src/measure_bigquery` (add a new `src/measure_<name>` package).
+2. Add a `<Name>Settings(CoreSettings)` in `config.py`.
+3. Put domain logic in `service.py` (no MCP imports — keep it unit-testable).
+4. Keep `server.py` thin: validate inputs, delegate, wrap with `tool_errors`.
+5. Default to read-only. Any write tool must go through the confirmation ritual
+   and call `ctx.audit.record(...)`.
+6. Add tests under `tests/` and a docs page under `docs/servers/`.
+
+## Conventions
+
+- Python 3.12+, full type hints, `from __future__ import annotations`.
+- Public functions/classes have docstrings.
+- No credentials, tokens, or secrets in code, logs, or tests.
+- Conventional-commit style messages are appreciated.
+
+## Code of conduct
+
+Be kind and constructive. By participating you agree to uphold a welcoming,
+harassment-free environment.

measure_analytics_mcp-0.2.0/LICENSE

@@ -0,0 +1,20 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Copyright 2026 Measure Analytics MCP contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   The full text of the Apache License 2.0 is available at the URL above and
+   should be vendored into this file before the first public release.

measure_analytics_mcp-0.2.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.4
+Name: measure-analytics-mcp
+Version: 0.2.0
+Summary: AI-powered Measurement Operations for the Google analytics stack (GA4, GTM, BigQuery, Consent Mode, Server-Side, Data Quality, Alerts), over the Model Context Protocol.
+Project-URL: Homepage, https://github.com/measure-mcp/measure-analytics-mcp
+Project-URL: Repository, https://github.com/measure-mcp/measure-analytics-mcp
+Author: Measure AI contributors
+License: Apache-2.0
+License-File: LICENSE
+Keywords: bigquery,consent-mode,ga4,google-tag-manager,mcp,measureops,model-context-protocol
+Requires-Python: >=3.12
+Requires-Dist: google-analytics-admin>=0.22.0
+Requires-Dist: google-analytics-data>=0.18.0
+Requires-Dist: google-api-python-client>=2.100.0
+Requires-Dist: google-cloud-bigquery>=3.25.0
+Requires-Dist: measure-sdk<0.2,>=0.1
+Requires-Dist: sqlalchemy>=2.0.30
+Requires-Dist: sqlglot>=25.0.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.11.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0.0; extra == 'dev'
+Requires-Dist: pytest>=8.3.0; extra == 'dev'
+Requires-Dist: ruff>=0.6.0; extra == 'dev'
+Requires-Dist: types-requests; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9.5.0; extra == 'docs'
+Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
+Requires-Dist: mkdocstrings[python]>=0.26.0; extra == 'docs'
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+# 📊 Measure Analytics MCP
+
+**AI-powered Measurement Operations for the Google analytics stack, over the
+[Model Context Protocol](https://modelcontextprotocol.io).**
+
+A product of the [Measure MCP ecosystem](https://github.com/measure-mcp) ·
+built on **[measure-sdk](https://github.com/measure-mcp/measure-sdk)**.
+
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.12%2B-blue.svg)](pyproject.toml)
+[![SDK](https://img.shields.io/badge/measure--sdk-%3E%3D0.1%2C%3C0.2-blue.svg)](https://github.com/measure-mcp/measure-sdk)
+
+</div>
+
+---
+
+## What it is
+
+Audit, analyse and monitor your Google analytics stack in natural language, from
+Claude Desktop, ChatGPT or any MCP client. Seven focused MCP servers, each
+consuming the shared **measure-sdk** (domain models, Health Score, OAuth, …):
+
+| Server | Run with | Domain |
+| --- | --- | --- |
+| **BigQuery Analyst** | `measure-bigquery` | Cost-aware, read-only SQL. |
+| **GA4 Intelligence** | `measure-ga4` | GA4 Admin + Data API audits. |
+| **Consent Mode Auditor** | `measure-consent` | Consent Mode v2 compliance. |
+| **Data Quality** | `measure-dataquality` | GA4-export health monitoring. |
+| **GTM Operations** | `measure-gtm` | Web container audits + guarded writes. |
+| **Server-Side Auditor** | `measure-sgtm` | sGTM config + Cloud Run health. |
+| **Alerts Engine** | `measure-alerts` | Persistent cross-domain alerts. |
+
+> Paid-media analysis (Google Ads, Meta, …) lives in the sibling product
+> **[measure-paid-media-mcp](https://github.com/measure-mcp/measure-paid-media-mcp)**.
+
+## Install
+
+```bash
+pip install measure-analytics-mcp     # pulls measure-sdk automatically
+measure login                         # Google OAuth — that's all you need
+measure doctor                        # see what's connected
+measure-bigquery                      # start a server (stdio)
+```
+
+`measure login` (from the SDK) caches an OAuth token locally; every server then
+works with **no `.env`** and no manual IDs. ADC / service accounts still work as a
+fallback. Read-only by default; writes require explicit confirmation.
+
+## Develop
+
+```bash
+git clone https://github.com/measure-mcp/measure-analytics-mcp.git
+cd measure-analytics-mcp
+uv sync --all-extras            # resolves measure-sdk from its pinned tag
+uv run ruff check . && uv run mypy . && uv run pytest
+```
+
+This repo is a **single installable package** (`measure-analytics-mcp`) that
+ships seven focused MCP servers under `src/` (`measure_ga4`, `measure_gtm`,
+`measure_bigquery`, `measure_consent`, `measure_sgtm`, `measure_dataquality`,
+`measure_alerts`). It depends only on **measure-sdk**.
+
+## Ecosystem
+
+| | |
+| --- | --- |
+| **measure-sdk** | Shared core: domain models, enums, Health Score, infra. |
+| **measure-analytics-mcp** | This product. |
+| **measure-paid-media-mcp** | Google Ads, Meta, LinkedIn, TikTok, CM360. |
+
+See **[CHANGELOG.md](CHANGELOG.md)** · **[ROADMAP.md](ROADMAP.md)** ·
+**[SECURITY.md](SECURITY.md)** · **[CONTRIBUTING.md](CONTRIBUTING.md)**.
+
+## License
+
+[Apache-2.0](LICENSE).

measure_analytics_mcp-0.2.0/README.md

@@ -0,0 +1,78 @@
+<div align="center">
+
+# 📊 Measure Analytics MCP
+
+**AI-powered Measurement Operations for the Google analytics stack, over the
+[Model Context Protocol](https://modelcontextprotocol.io).**
+
+A product of the [Measure MCP ecosystem](https://github.com/measure-mcp) ·
+built on **[measure-sdk](https://github.com/measure-mcp/measure-sdk)**.
+
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.12%2B-blue.svg)](pyproject.toml)
+[![SDK](https://img.shields.io/badge/measure--sdk-%3E%3D0.1%2C%3C0.2-blue.svg)](https://github.com/measure-mcp/measure-sdk)
+
+</div>
+
+---
+
+## What it is
+
+Audit, analyse and monitor your Google analytics stack in natural language, from
+Claude Desktop, ChatGPT or any MCP client. Seven focused MCP servers, each
+consuming the shared **measure-sdk** (domain models, Health Score, OAuth, …):
+
+| Server | Run with | Domain |
+| --- | --- | --- |
+| **BigQuery Analyst** | `measure-bigquery` | Cost-aware, read-only SQL. |
+| **GA4 Intelligence** | `measure-ga4` | GA4 Admin + Data API audits. |
+| **Consent Mode Auditor** | `measure-consent` | Consent Mode v2 compliance. |
+| **Data Quality** | `measure-dataquality` | GA4-export health monitoring. |
+| **GTM Operations** | `measure-gtm` | Web container audits + guarded writes. |
+| **Server-Side Auditor** | `measure-sgtm` | sGTM config + Cloud Run health. |
+| **Alerts Engine** | `measure-alerts` | Persistent cross-domain alerts. |
+
+> Paid-media analysis (Google Ads, Meta, …) lives in the sibling product
+> **[measure-paid-media-mcp](https://github.com/measure-mcp/measure-paid-media-mcp)**.
+
+## Install
+
+```bash
+pip install measure-analytics-mcp     # pulls measure-sdk automatically
+measure login                         # Google OAuth — that's all you need
+measure doctor                        # see what's connected
+measure-bigquery                      # start a server (stdio)
+```
+
+`measure login` (from the SDK) caches an OAuth token locally; every server then
+works with **no `.env`** and no manual IDs. ADC / service accounts still work as a
+fallback. Read-only by default; writes require explicit confirmation.
+
+## Develop
+
+```bash
+git clone https://github.com/measure-mcp/measure-analytics-mcp.git
+cd measure-analytics-mcp
+uv sync --all-extras            # resolves measure-sdk from its pinned tag
+uv run ruff check . && uv run mypy . && uv run pytest
+```
+
+This repo is a **single installable package** (`measure-analytics-mcp`) that
+ships seven focused MCP servers under `src/` (`measure_ga4`, `measure_gtm`,
+`measure_bigquery`, `measure_consent`, `measure_sgtm`, `measure_dataquality`,
+`measure_alerts`). It depends only on **measure-sdk**.
+
+## Ecosystem
+
+| | |
+| --- | --- |
+| **measure-sdk** | Shared core: domain models, enums, Health Score, infra. |
+| **measure-analytics-mcp** | This product. |
+| **measure-paid-media-mcp** | Google Ads, Meta, LinkedIn, TikTok, CM360. |
+
+See **[CHANGELOG.md](CHANGELOG.md)** · **[ROADMAP.md](ROADMAP.md)** ·
+**[SECURITY.md](SECURITY.md)** · **[CONTRIBUTING.md](CONTRIBUTING.md)**.
+
+## License
+
+[Apache-2.0](LICENSE).

measure_analytics_mcp-0.2.0/ROADMAP.md

@@ -0,0 +1,26 @@
+# Roadmap — measure-analytics-mcp
+
+This product covers the **Google analytics stack**. It depends only on
+`measure-sdk` and never on other MCPs.
+
+## Now (0.1.x)
+
+- Seven servers: BigQuery, GA4, Consent Mode, Data Quality, GTM, Server-Side,
+  Alerts Engine.
+
+## Next
+
+- Surface a per-property **Health Score** (from `measure_sdk`) in `audit_*` tools
+  so analytics health is comparable with paid-media health.
+- CMP adapters for Consent Mode (OneTrust, Cookiebot, Didomi, Usercentrics).
+- Publish to PyPI (`pip install measure-analytics-mcp`).
+- Hosted mode with remote transport (SSE/HTTP).
+
+## Compatibility
+
+| measure-analytics-mcp | requires measure-sdk |
+| --- | --- |
+| 0.1.x | `>=0.1,<0.2` |
+
+When `measure-sdk` ships a breaking (major) change, this product bumps its own
+minor/major and updates the table.

measure_analytics_mcp-0.2.0/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems. Instead, open a
+private security advisory on the repository (GitHub → Security → Advisories), or
+email the maintainers listed in `pyproject.toml`.
+
+We aim to acknowledge reports within 72 hours.
+
+## Scope & guarantees
+
+- Credentials are resolved at runtime and held only in memory. The platform
+  never writes them to disk, logs them, or transmits them anywhere except to
+  Google APIs.
+- Servers default to `read_only` mode. Writes require an explicit confirmation.
+- Every privileged action is recorded by the audit log.
+
+See [docs/security.md](docs/security.md) for the full model.

measure_analytics_mcp-0.2.0/docker/alerts-engine.Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+# ---------------------------------------------------------------------------
+# alerts-engine MCP server image.
+# Built from the repo root:
+#   docker build -f docker/alerts-engine.Dockerfile -t measure/alerts-engine .
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# measure-analytics-mcp is a single package shipping all seven servers.
+COPY pyproject.toml uv.lock* README.md ./
+COPY src src
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev || uv sync --no-dev
+
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+RUN useradd --create-home --uid 10001 measure
+WORKDIR /app
+
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    MEASURE_PERMISSION_MODE=read_only \
+    MEASURE_LOG_FORMAT=json
+
+USER measure
+
+ENTRYPOINT ["python", "-m", "measure_alerts"]

measure_analytics_mcp-0.2.0/docker/bigquery-analyst.Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+# ---------------------------------------------------------------------------
+# bigquery-analyst MCP server image.
+# Built from the repo root:
+#   docker build -f docker/bigquery-analyst.Dockerfile -t measure/bigquery-analyst .
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# measure-analytics-mcp is a single package shipping all seven servers.
+COPY pyproject.toml uv.lock* README.md ./
+COPY src src
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev || uv sync --no-dev
+
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+RUN useradd --create-home --uid 10001 measure
+WORKDIR /app
+
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    MEASURE_PERMISSION_MODE=read_only \
+    MEASURE_LOG_FORMAT=json
+
+USER measure
+
+ENTRYPOINT ["python", "-m", "measure_bigquery"]

measure_analytics_mcp-0.2.0/docker/consent-mode-auditor.Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+# ---------------------------------------------------------------------------
+# consent-mode-auditor MCP server image.
+# Built from the repo root:
+#   docker build -f docker/consent-mode-auditor.Dockerfile -t measure/consent-mode-auditor .
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# measure-analytics-mcp is a single package shipping all seven servers.
+COPY pyproject.toml uv.lock* README.md ./
+COPY src src
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev || uv sync --no-dev
+
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+RUN useradd --create-home --uid 10001 measure
+WORKDIR /app
+
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    MEASURE_PERMISSION_MODE=read_only \
+    MEASURE_LOG_FORMAT=json
+
+USER measure
+
+ENTRYPOINT ["python", "-m", "measure_consent"]

measure_analytics_mcp-0.2.0/docker/data-quality.Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+# ---------------------------------------------------------------------------
+# data-quality MCP server image.
+# Built from the repo root:
+#   docker build -f docker/data-quality.Dockerfile -t measure/data-quality .
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# measure-analytics-mcp is a single package shipping all seven servers.
+COPY pyproject.toml uv.lock* README.md ./
+COPY src src
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev || uv sync --no-dev
+
+# ---------------------------------------------------------------------------
+FROM python:3.12-slim AS runtime
+
+RUN useradd --create-home --uid 10001 measure
+WORKDIR /app
+
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    MEASURE_PERMISSION_MODE=read_only \
+    MEASURE_LOG_FORMAT=json
+
+USER measure
+
+ENTRYPOINT ["python", "-m", "measure_dataquality"]