Can an AI agent publish a GTM container?

Not over MCP. publish_workspace is excluded from the MCP tool list by name, because an MCP caller is inherently unattended and a publish is the one action that should have no unattended path.

Is there an official Google Tag Manager MCP server?

Not from Google at the time of writing (September 2026). The Tag Manager scopes are classified sensitive, which also makes shipping your own more involved than it first appears.

What happens with custom HTML tags?

They are fenced to the most restricted lane, separately from ordinary draft edits, because the payload is JavaScript that runs in every visitor's browser once published.

MCP

Google Tag Manager MCP server: read containers and draft tags from Claude

TL;DR

Tag Manager is the family where the write gate is least negotiable. A published container runs JavaScript in every visitor's browser, so publishing is excluded from the MCP surface entirely rather than merely gated — no scope, no pre-authorization and no autonomy setting reaches it.

What already exists for this platform

Google has not shipped a platform-official Tag Manager MCP server at the time of writing (September 2026). The Tag Manager API scopes are also classified sensitive, which raises the bar for anyone shipping their own.

No official server, and the sensitive scope classification makes a self-hosted one more work than it looks.
The API covers containers, workspaces, tags, triggers and variables — enough to audit a site's measurement setup properly.
Publishing is the dangerous operation, and a generic wrapper treats it like any other call.

What a full MCP server adds

	Typical option today	Agent Planners MCP
Tag Manager tools	Community, if any	10 reads, 9 writes
Publish a workspace	Just another API call	Excluded from MCP by name
Custom HTML tags	Just another write	Fenced to the most restricted lane
Approval before a draft edit	None	Every write, with an audit row
GA4 in the same session	No	Yes — the two you actually debug together

Tool counts are derived from the live catalogue rather than typed by hand: this family exposes 10 reads and 9 writes of the 384 tools on the endpoint. A key only sees the writes if it carries `tools:write`.

How to configure it

1Create a key in API & MCP. `tools:read` for questions; add `tools:write` if the agent should be able to change things. Tools mode needs a paid plan and fails closed.
2Connect Google Tag Manager under Integrations — that OAuth step is why the MCP key never carries platform credentials.
3Add the server to Claude Code, Claude Desktop or Codex using the snippet below.
4Have the agent call `describe_permissions` first — it reports the key's mode, scopes, plan entitlement and connected accounts.
5Call `list_accounts` for the account ids, and scope each call with one. Resolution is exact or it refuses, naming the candidates.

bash

claude mcp add --transport http agentplanners https://www.agentplanners.com/api/mcp \
  --header "Authorization: Bearer ap_live_…"

Claude Desktop and Codex

Claude Desktop takes the same endpoint as JSON:

json

{
  "mcpServers": {
    "agentplanners": {
      "url": "https://www.agentplanners.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ap_live_…"
      }
    }
  }
}

Codex uses the same endpoint from `~/.codex/config.toml`, with the key in an environment variable rather than the file: `[mcp_servers.agentplanners]` / `url = "…/api/mcp"` / `bearer_token_env_var = "AGENTPLANNERS_API_KEY"`.

Publishing is excluded, not gated

There is a meaningful difference between "requires approval" and "cannot be reached". `publish_workspace` is excluded from the MCP tool list by name — an MCP caller is inherently unattended, and a workspace publish is the one action where an unattended path should not exist at all.

Custom HTML tags sit just below that line. They are reachable but fenced to the most restricted lane, because the payload is JavaScript that will execute in every visitor's browser once someone publishes it. That is not a tag configuration change and treating it as one is how measurement tooling becomes a security incident.

A container discovery cap is worth knowing about generally: an integration that lists only the first N accounts looks like it works right up until account N+1 matters. Ours was silently capped at 10 for a while, against 33 real containers.

Use cases

"What is actually firing on this page, and on what trigger?" — asked in plain language against the real container.
Measurement audits before a site migration, where the question is what breaks.
Drafting triggers and variables for a new campaign, reviewed by a person before anything is published.
GTM and GA4 debugged together, which is how the problem usually presents.

Frequently asked questions

Can an AI agent publish a GTM container?: Not over MCP. publish_workspace is excluded from the MCP tool list by name, because an MCP caller is inherently unattended and a publish is the one action that should have no unattended path.
Is there an official Google Tag Manager MCP server?: Not from Google at the time of writing (September 2026). The Tag Manager scopes are classified sensitive, which also makes shipping your own more involved than it first appears.
What happens with custom HTML tags?: They are fenced to the most restricted lane, separately from ordinary draft edits, because the payload is JavaScript that runs in every visitor's browser once published.