Google Tag Manager MCP server: read containers and draft tags from Claude

What already exists for this platform#

Google has not shipped a platform-official Tag Manager MCP server at the time of writing (September 2026). The Tag Manager API scopes are also classified sensitive, which raises the bar for anyone shipping their own.

• No official server, and the sensitive scope classification makes a self-hosted one more work than it looks.
• The API covers containers, workspaces, tags, triggers and variables — enough to audit a site's measurement setup properly.
• Publishing is the dangerous operation, and a generic wrapper treats it like any other call.

What a full MCP server adds#

How to configure it#

1. 1Create a key in API & MCP. tools:read for questions; add tools:write if the agent should be able to change things. Tools mode needs a paid plan and fails closed.
2. 2Connect Google Tag Manager under Integrations — that OAuth step is why the MCP key never carries platform credentials.
3. 3Add the server to Claude Code, Claude Desktop or Codex using the snippet below.
4. 4Have the agent call describe_permissions first — it reports the key's mode, scopes, plan entitlement and connected accounts.
5. 5Call list_accounts for the account ids, and scope each call with one. Resolution is exact or it refuses, naming the candidates.

claude mcp add --transport http agent-plannershttps://www.agentplanners.com/api/mcp \
  --header "Authorization: Bearer ap_live_…"

Claude Desktop and Codex#

Claude Desktop takes the same endpoint as JSON:

{
  "mcpServers": {
    "agent-planners": {
      "url": "https://www.agentplanners.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ap_live_…"
      }
    }
  }
}

Publishing is excluded, not gated#

There is a meaningful difference between "requires approval" and "cannot be reached". publish_workspace is excluded from the MCP tool list by name — an MCP caller is inherently unattended, and a workspace publish is the one action where an unattended path should not exist at all.

Custom HTML tags sit just below that line. They are reachable, but every write of code — a Custom HTML tag, a Custom JavaScript variable, a custom template — is held for a person on every key mode, with the code and an advisory scan shown in the approval, because the payload is JavaScript that will execute in every visitor's browser once someone publishes it. That is not a tag configuration change and treating it as one is how measurement tooling becomes a security incident.

Use cases#

• "What is actually firing on this page, and on what trigger?" — asked in plain language against the real container.
• Measurement audits before a site migration, where the question is what breaks.
• Drafting triggers and variables for a new campaign, reviewed by a person before anything is published.
• GTM and GA4 debugged together, which is how the problem usually presents.

Frequently asked questions#

Can an AI agent publish a GTM container?

Not over MCP. publish_workspace is excluded from the MCP tool list by name, because an MCP caller is inherently unattended and a publish is the one action that should have no unattended path.

Is there an official Google Tag Manager MCP server?

Not from Google at the time of writing (September 2026). The Tag Manager scopes are classified sensitive, which also makes shipping your own more involved than it first appears.

What happens with custom HTML tags?

They are held for a person on every key mode, separately from ordinary draft edits, and the approval shows the code itself, because the payload is JavaScript that runs in every visitor's browser once published.