Google Analytics MCP for Coolify

This package places a secure FastMCP HTTP/OAuth gateway in front of Google's official experimental analytics-mcp package. It is intended to be deployed as a separate Coolify application and does not modify an existing Google Ads MCP deployment.

What it provides

• Streamable HTTP MCP endpoint at /mcp
• Google OAuth protection for the remote MCP endpoint
• Encrypted persistent storage for MCP OAuth registrations and tokens
• Google Analytics Admin API and Data API tools from the official analytics-mcp package
• Support for either authorized-user ADC JSON or a service-account JSON key

Required Coolify configuration

Create a persistent storage mount at /data and expose port 8080.

Set these environment variables in the new Analytics application:

Variable	Purpose
GOOGLE_PROJECT_ID	Existing Google Cloud project ID
GOOGLE_ANALYTICS_MCP_BASE_URL	Final HTTPS origin, without /mcp
GOOGLE_ANALYTICS_MCP_OAUTH_CLIENT_ID	Google OAuth web client ID
GOOGLE_ANALYTICS_MCP_OAUTH_CLIENT_SECRET	Google OAuth web client secret
GOOGLE_ANALYTICS_MCP_JWT_SIGNING_KEY	Long random secret used to sign MCP tokens
GOOGLE_ANALYTICS_MCP_STORAGE_ENCRYPTION_KEY	Fernet key used to encrypt stored OAuth data
GOOGLE_ANALYTICS_CREDENTIALS_JSON	Analytics-authorized ADC JSON, entered as one secret value

PORT is optional and defaults to 8080.

Google Cloud configuration

Enable both APIs in the same Google Cloud project:

• Google Analytics Admin API
• Google Analytics Data API

The OAuth client must be a Web application. Add this authorized redirect URI after the final domain is assigned:

https://YOUR-ANALYTICS-MCP-DOMAIN/auth/callback

The MCP URL added to ChatGPT is:

https://YOUR-ANALYTICS-MCP-DOMAIN/mcp

Important credential separation

Do not alter the existing Ads application or replace its credentials. The GOOGLE_ANALYTICS_CREDENTIALS_JSON value belongs only to this separate Analytics application and must include the https://www.googleapis.com/auth/analytics.readonly scope.

When the Google OAuth consent screen is in Testing, Google may expire authorized-user refresh tokens after seven days. That is a Google OAuth testing limitation, not a Coolify failure.

Versions

• analytics-mcp==0.7.0
• fastmcp==3.4.7
• Python 3.11

The version pins make deployments repeatable. Review upstream releases before updating them.