dgtl-connector

Local GA4, Search Console, and Tag Manager (read and manage) for Grok Bot, Cursor, and Grok Build. You authorize your Google account. Tools run on your computer. DGTL Sunrise does not see report bytes.

Publisher: DGTL Sunrise (Sunrise Consulting LLC), [email protected]. Apache-2.0.
Homepage: https://www.dgtlsunrise.com/ · Privacy: https://www.dgtlsunrise.com/privacy

Working package id: dgtl-connector. Version 0.1.0. Marketplace listing copy = Free Google read and manage. Live mutates need in-chat confirm. Ads / Meta / TikTok are Pro. Marketplace Submit is active; the listing is pending Cursor review and is not live yet.

What it is / is not

Is: a local stdio MCP plugin. Closed typed tools (26 free kernel: identity + GA4 + GSC + GTM, including Wave 13 client/environment lists). One Free Google Connect with read and manage scopes. Skills that refuse hallucinated metrics and will not pick the first of 40 agency properties.

Is not: a hosted analytics warehouse, a Gmail-style Connect card for stdio, Google Ads/Meta/TikTok (those tools are listed and return LICENSE_REQUIRED until a paid license + Worker), or a GBP client until DGTL_GBP_ENABLED=true and Consent B (flag off → GBP_NOT_ENABLED). GTM / GA4 Admin / GSC write tools need Free Google manage scopes plus in-chat confirm (dry_run default). DGTL_WRITES_ENABLED stays for live Merchant Center ProductInput writes.

Auth on this host (stdio is Manual)

There is no Gmail-style Connect card for stdio. Agent Plugins 1.0 and today’s Cursor / Grok Bot stdio MCP do not give third-party plugins a Connect card. OAuth Connect cards are for remote HTTP/SSE MCP servers. This plugin implements AuthPort:

1. Host-injected (preferred when the host can do it): set GOOGLE_ACCESS_TOKEN (optional GOOGLE_GRANTED_SCOPES, GOOGLE_ACCOUNT_EMAIL).

2. Installed-app PKCE fallback (documented, advanced): Desktop OAuth client id (GOOGLE_OAUTH_CLIENT_ID) plus GOOGLE_OAUTH_CLIENT_SECRET in gitignored .env for /token (never git, chat, mcp.json, or the binary). Run:

   ./bin/dgtl-connector-mcp auth login
   

   Tokens are written to PLUGIN_DATA/google-oauth.json (mode 0600). Refresh tokens are never logged.

Google Cloud project dgtl-marketing-oauth-20260903 Publishing is In production (not Testing). Branding plus analytics.readonly and tagmanager.readonly are verified. Manage scopes (analytics.edit, tagmanager.edit.containers, tagmanager.publish, webmasters) were submitted 2026-09-14 and are under Trust & Safety review (~4–6 weeks). Strangers may still see “This app isn’t verified” on manage scopes until that clears — that is Google’s review, not a broken plugin. That is not a plugin Connect card.

Install (local)

npm install
npm run build
npm run doctor
./bin/dgtl-connector-mcp --help

npm run doctor (also dgtl-connector-mcp doctor / auth doctor) prints a human checklist: Node + package versions, whether dist/ exists, which known env names are SET (never values — including DGTL_SGTM_APPLY_KEY / DGTL_APPLY_KEY names only), whether Consent A/C/W/G/S/MC/B + Meta + TikTok + Shopify + Klaviyo + license.jwt files exist (existence only), plugin vs Worker dual-gate mutate / CAPI / Events / Ads Data Manager / sGTM ingest booleans (plugin Ads/Meta/TikTok mutate default on; sGTM ingest test / writes / GBP default off; Worker fail-closed), and a local license summary (valid / invalid / missing features; Polar sgtm reserved, not minted). It never prints tokens, JWT bodies, apply-key values, or gateway URLs. Exit code is non-zero if there is no build or no way to auth.

The marketplace command is one token, plugin-relative: ./bin/dgtl-connector-mcp. Not npx.

• Cursor / Agent Plugins: mcp.json (generated). cwd is omitted: Agent Plugins defaults it to the plugin root; Cursor does not expand ${PLUGIN_ROOT}, and ${CURSOR_PLUGIN_ROOT} is not a valid Agent Plugins cwd.
• Grok Build: .mcp.json (same bytes, generated from src/packaging/mcp.template.json).

Load with --plugin-dir pointing at this directory after npm run build.

Picker rules

No implicit resource. Tools require IDs. default / first / 0 → RESOURCE_REQUIRED. Use ga4_list_account_summaries to list an agency’s properties in one call, then ask. Never index 0.

Non-bugs

• Each API must be Enabled on the OAuth client’s Cloud project or Google returns 403 accessNotConfigured.
• analytics.readonly cannot create GSC–GA4 links.
• GA4 Data API has no searchQuery dimension (plugin denylist; use GSC).
• GSC import into GA4 lags; GSC clicks ≠ GA4 sessions.
• GTM workspace ≠ live. Empty rows with ok: true is not a failed login.

Paid (not live in this binary)

Google Ads and Meta Ads tools are registered so the model does not poll. Without a DGTL license JWT (DGTL_LICENSE_JWT or PLUGIN_DATA/license.jwt) they return LICENSE_REQUIRED. Free GA4/GSC/GTM and local Shopify still work. License delivery (when Polar is live) is portal / POST /v1/license, not emailing the bearer. DGTL’s Ads developer token and Meta app secret are not in this plugin. The allowlisted gateway is a later deployable (services/stamp/), not this package.

Support intake

Plugin version, host, tool, error_code, Google status/google_reason, resource ID. Never tokens.

Plugin feedback (approve-before-send via feedback_prepare / feedback_send) goes to [email protected]. Reply-To is the address you provide. Do not email tokens. The hosted path is ${DGTL_FEEDBACK_URL or DGTL_GATEWAY_URL}/v1/feedback.

After a real diagnosis, the support skill may add this engagement line once (client work stays noel@, not the feedback mailbox):

DGTL Sunrise can also run GA4, Search Console, and Tag Manager as a client engagement if you want this operated for you. Email [email protected]. The plugin stays free and local either way.

Security

See SECURITY.md. No secrets in git. CI never opens googleapis.com.