CAT
/MCP
SkillsMCPMarketplacesDigestToolsAdvertise

This week in Claude

Every Monday: Claude Code, Agent SDK, MCP, and the Anthropic platform moves worth your time.

Skills by Category
Frontend DevelopmentBackend & APIsTesting & QASecurityDevOps & CI/CDGit & Pull RequestsDocumentationCode Review & QualityAI & Agent BuildingSkill Development
MCP Servers by Category
Sales & MarketingWeb & Browser AutomationDatabasesAI & LLM ToolsCloud & InfrastructureCommunication & MessagingDeveloper ToolsDesign & CreativeDocuments & KnowledgeSearch & Web Crawling
Marketplaces by Category
AI Agents & OrchestrationLLM IntegrationDevelopment ToolsFrontend & UIBackend & APIsDatabasesTesting & Code QualityDevOps & CloudSecurity & ComplianceGit & Version Control

Cross AI Tools

Discover Claude Code plugins, extensions, and tools. Automatically updated directory of Anthropic Claude AI marketplaces with development tools, productivity plugins, and integrations.

Resources

  • Browse Skills
  • Browse MCP Servers
  • Browse Marketplaces
  • Plugins Reference

Community

  • About
  • Tools
  • Feedback
  • Privacy Policy
  • Advertise

Built for the Claude Code community with Claude Code by @mertduzgun

Independent project, not affiliated with Anthropic

Google Analytics 4

mindstone/mcp-servers
25 toolsauthSTDIOregistry active
Summary

Connects Claude to your Google Analytics 4 properties through the GA4 Reporting API. You get schema discovery so you can explore dimensions and metrics available in your account, reporting tools to query sessions, events, and custom conversions, and admin visibility into account and property structure. Part of Mindstone's 35-server catalog. Useful when you need to pull analytics data into a workflow without leaving your editor, or when you want Claude to analyze traffic patterns, build reports, or answer questions about user behavior by querying GA4 directly. Authentication follows the standard Google OAuth flow.

CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
Keep your Mac awake
Keep your Mac awake
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →
Context.devContext.dev
Context.dev
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make money from your Skills
Make money from your Skills
On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →
AppSignal
AppSignal
Monitor with ease. Code with confidence.
Start Free Trial →
CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
Keep your Mac awake
Keep your Mac awake
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →
Context.devContext.dev
Context.dev
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make money from your Skills
Make money from your Skills
On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →
AppSignal
AppSignal
Monitor with ease. Code with confidence.
Start Free Trial →

Tools

Public tool metadata for what this MCP can expose to an agent.

25 tools
GOOGLE_ANALYTICS_BATCH_RUN_REPORTSTool to return multiple analytics data reports in a batch. Use when you need to fetch multiple reports for one GA4 property in a single request.2 params

Tool to return multiple analytics data reports in a batch. Use when you need to fetch multiple reports for one GA4 property in a single request.

Parameters* required
propertystring
Required. The property resource name. Format: properties/{property_id}
requestsarray
Required. Up to 5 individual RunReportRequest objects.
GOOGLE_ANALYTICS_CHECK_COMPATIBILITYTool to list dimensions and metrics compatible with a GA4 report request. Use when you need to validate compatibility of chosen dimensions or metrics before running a report.6 params

Tool to list dimensions and metrics compatible with a GA4 report request. Use when you need to validate compatibility of chosen dimensions or metrics before running a report.

Parameters* required
metricsarray
Optional. List of metrics to check compatibility for.
propertystring
Required. GA4 property resource name. Format: properties/{property_id}.
dimensionsarray
Optional. List of dimensions to check compatibility for.
metricFilterobject
Optional. A FilterExpression for metrics; must follow GA4 FilterExpression JSON schema.
dimensionFilterobject
Optional. A FilterExpression for dimensions; must follow GA4 FilterExpression JSON schema.
compatibilityFilterstring
Compatibility status for dimensions or metrics.one of COMPATIBILITY_UNSPECIFIED · COMPATIBLE · INCOMPATIBLE
GOOGLE_ANALYTICS_CREATE_AUDIENCE_EXPORTTool to create an audience export. Use after configuring the audience and dimensions to produce a long-running Operation.3 params

Tool to create an audience export. Use after configuring the audience and dimensions to produce a long-running Operation.

Parameters* required
parentstring
Parent resource name. Format: properties/{property_id}.
audiencestring
Audience resource name to export. Format: properties/{property_id}/audiences/{audience_id}.
dimensionsarray
List of dimensions to include in the export.
GOOGLE_ANALYTICS_CREATE_AUDIENCE_LISTTool to create an audience list. Use when you need to define and asynchronously populate a new AudienceList resource under a GA4 property.4 params

Tool to create an audience list. Use when you need to define and asynchronously populate a new AudienceList resource under a GA4 property.

Parameters* required
parentstring
Parent property resource name. Format: properties/{property_id}.
audiencestring
Audience resource name. Format: properties/{property_id}/audiences/{audience_id}.
dimensionsarray
List of dimensions to include in the audience list output.
webhookNotificationobject
Configuration for receiving webhook notifications about operation status.
GOOGLE_ANALYTICS_CREATE_EXPANDED_DATA_SETTool to create an expanded data set for a property. Use when you need to combine specific dimensions and metrics into a custom dataset after property creation.2 params

Tool to create an expanded data set for a property. Use when you need to combine specific dimensions and metrics into a custom dataset after property creation.

Parameters* required
parentstring
Parent property resource name. Format: properties/{propertyId}
expandedDataSetobject
Definition of the ExpandedDataSet to create.
GOOGLE_ANALYTICS_CREATE_ROLLUP_PROPERTYTool to create a GA4 Roll-up Property and optionally initial source links.4 params

Tool to create a GA4 Roll-up Property and optionally initial source links.

Parameters* required
accountstring
Required. Parent account resource. Format: accounts/{account_id}
timeZonestring
Required. IANA time zone for the roll-up property.
displayNamestring
Required. Display name for the roll-up property.
sourcePropertiesarray
Optional. List of source property resource names to link. Format: properties/{property_id}.
GOOGLE_ANALYTICS_GET_ACCOUNTTool to retrieve a single Account by its resource name. Use when you need detailed account info after confirming the account resource name (e.g., accounts/100).1 params

Tool to retrieve a single Account by its resource name. Use when you need detailed account info after confirming the account resource name (e.g., accounts/100).

Parameters* required
namestring
Required. The resource name of the Account to retrieve. Format: accounts/{account_id}, e.g., 'accounts/100'.
GOOGLE_ANALYTICS_GET_AUDIENCE_EXPORTTool to get configuration metadata for an Audience Export. Use after creating an Audience Export to retrieve its status and details.1 params

Tool to get configuration metadata for an Audience Export. Use after creating an Audience Export to retrieve its status and details.

Parameters* required
namestring
Required. The resource name of the Audience Export to retrieve. Format: properties/{property}/audienceExports/{audienceExport}.
GOOGLE_ANALYTICS_GET_AUDIENCE_LISTTool to get configuration metadata about a specific audience list. Use after confirming the audience list resource name.1 params

Tool to get configuration metadata about a specific audience list. Use after confirming the audience list resource name.

Parameters* required
namestring
Required. The resource name of the Audience List to retrieve. Format: properties/{property}/audienceLists/{audienceList}.
GOOGLE_ANALYTICS_GET_KEY_EVENTTool to retrieve a Key Event. Use after confirming the key event resource name.1 params

Tool to retrieve a Key Event. Use after confirming the key event resource name.

Parameters* required
namestring
Required. Resource name of the Key Event to retrieve. Format: properties/{property}/keyEvents/{keyEvent}.
GOOGLE_ANALYTICS_GET_METADATATool to get metadata for dimensions, metrics, and comparisons for a GA4 property. Use when you need to discover available fields before building a report.1 params

Tool to get metadata for dimensions, metrics, and comparisons for a GA4 property. Use when you need to discover available fields before building a report.

Parameters* required
namestring
Resource name of the metadata to retrieve. Format: properties/{property_id}/metadata. Use property_id=0 to return only universal (non-custom) metadata.
GOOGLE_ANALYTICS_GET_PROPERTY_QUOTAS_SNAPSHOTTool to retrieve all property quotas organized by category for a given property. Use when you need to check current quota usage for a GA4 property.1 params

Tool to retrieve all property quotas organized by category for a given property. Use when you need to check current quota usage for a GA4 property.

Parameters* required
propertystring
Required. The property resource. Format: properties/{property_id}.
GOOGLE_ANALYTICS_LIST_ACCOUNTSTool to list all Accounts accessible by the caller. Use when you need to enumerate all Google Analytics accounts your credentials can access.3 params

Tool to list all Accounts accessible by the caller. Use when you need to enumerate all Google Analytics accounts your credentials can access.

Parameters* required
pageSizeinteger
Optional. Maximum number of accounts to return. Must be ≥1.
pageTokenstring
Optional. Token for retrieving the next page of results.
showDeletedboolean
Optional. Whether to include soft-deleted (trashed) Accounts.
GOOGLE_ANALYTICS_LIST_AUDIENCE_EXPORTSTool to list all audience exports for a GA4 property. Use when you need to fetch its export history after initiating exports.3 params

Tool to list all audience exports for a GA4 property. Use when you need to fetch its export history after initiating exports.

Parameters* required
parentstring
Required. Resource name of the parent property. Format: properties/{property_id}
pageSizeinteger
Optional. Maximum number of results to return. Defaults to 200; larger values are coerced to 1000.
pageTokenstring
Optional. Token for retrieving the next page of results; other parameters must match original call when paginating.
GOOGLE_ANALYTICS_LIST_AUDIENCE_LISTSTool to list all audience lists for a GA4 property. Use when you need to retrieve a property's configured audience lists after confirming the property ID.3 params

Tool to list all audience lists for a GA4 property. Use when you need to retrieve a property's configured audience lists after confirming the property ID.

Parameters* required
parentstring
Required. Resource name of the parent property. Format: properties/{property_id}
pageSizeinteger
Optional. Maximum number of audience lists to return. Defaults to 200; maximum is 1000.
pageTokenstring
Optional. Token for retrieving the next page of results.
GOOGLE_ANALYTICS_LIST_AUDIENCESTool to list all audiences on a property. Use when you need to fetch all audiences for a GA4 property after confirming its existence.3 params

Tool to list all audiences on a property. Use when you need to fetch all audiences for a GA4 property after confirming its existence.

Parameters* required
parentstring
Required. Property ID or full resource name. Accepts: '123456789' or 'properties/123456789'
pageSizeinteger
Optional. Maximum number of Audiences to return.
pageTokenstring
Optional. Token for retrieving the next page of results.
GOOGLE_ANALYTICS_LIST_KEY_EVENTSTool to list Key Events. Use when you need to retrieve all key event definitions for a given property.3 params

Tool to list Key Events. Use when you need to retrieve all key event definitions for a given property.

Parameters* required
parentstring
Required. Resource name of the parent property. Format: properties/{property_id}.
pageSizeinteger
Optional. Maximum number of results to return. Must be between 1 and 200.
pageTokenstring
Optional. Token for retrieving the next page of results.
GOOGLE_ANALYTICS_LIST_PROPERTIESTool to list GA4 properties under a specific account. Use after obtaining an account ID; supports pagination and including soft-deleted properties.4 params

Tool to list GA4 properties under a specific account. Use after obtaining an account ID; supports pagination and including soft-deleted properties.

Parameters* required
accountstring
Required. The account resource name. Format: accounts/{account_id}
pageSizeinteger
Optional. Maximum number of properties to return; must be between 1 and 200.
pageTokenstring
Optional. Token returned from a previous call to retrieve the next page of results.
showDeletedboolean
Optional. Whether to include soft-deleted (trashed) properties.
GOOGLE_ANALYTICS_LIST_REPORTING_DATA_ANNOTATIONSTool to list all Reporting Data Annotations on a property. Use when you need to retrieve or inspect annotations for a GA4 property.4 params

Tool to list all Reporting Data Annotations on a property. Use when you need to retrieve or inspect annotations for a GA4 property.

Parameters* required
filterstring
Restricts which annotations are listed. Supported fields: name, title, description, annotationDate, annotationDateRange, color; operations: =, !=, <, >, <=, >=, :, =~, !~, NOT, AND, OR; helper functions: annotation_duration(), is_annotation_in_range(startDate,endDate).
parentstring
Resource name of the property. Format: properties/{property_id}.
pageSizeinteger
Optional. Maximum number of annotations to return. Defaults to 50, max 200.
pageTokenstring
Optional. Token for retrieving the next page of results.
GOOGLE_ANALYTICS_LIST_ROLLUP_PROPERTIESTool to list roll-up GA4 properties accessible to the caller. Use when you need to identify roll-up properties across all accessible accounts.1 params

Tool to list roll-up GA4 properties accessible to the caller. Use when you need to identify roll-up properties across all accessible accounts.

Parameters* required
pageSizeinteger
Optional. Maximum number of account summaries to return; must be between 1 and 200.
GOOGLE_ANALYTICS_LIST_SEARCH_ADS360_LINKSTool to list all SearchAds360Links on a property. Use when you need to fetch all Search Ads 360 links for a given property after authenticating.3 params

Tool to list all SearchAds360Links on a property. Use when you need to fetch all Search Ads 360 links for a given property after authenticating.

Parameters* required
parentstring
Required. Resource name of the property. Format: properties/{propertyId} (e.g., properties/1234).
pageSizeinteger
Optional. Maximum number of results to return. Must be between 1 and 200. Defaults to 50.
pageTokenstring
Optional. Token for retrieving the next page of results.
GOOGLE_ANALYTICS_QUERY_AUDIENCE_EXPORTTool to query a completed audience export. Use when you need to fetch user rows with pagination.3 params

Tool to query a completed audience export. Use when you need to fetch user rows with pagination.

Parameters* required
namestring
Required. Resource name of the audience export. Format: properties/{property}/audienceExports/{audienceExport}.
limitinteger
Optional. Number of rows to return. Must be between 1 and 250000. Defaults to 10000.
offsetinteger
Optional. Zero-based start row index for pagination. Defaults to 0.
GOOGLE_ANALYTICS_QUERY_AUDIENCE_LISTTool to query an audience list. Use when you need to retrieve user rows from a GA4 audience list with pagination.3 params

Tool to query an audience list. Use when you need to retrieve user rows from a GA4 audience list with pagination.

Parameters* required
namestring
Required. Audience list resource to query. Format: properties/{property}/audienceLists/{audienceList}.
limitinteger
Optional. Number of rows to return; default 10,000; maximum 250,000.
offsetinteger
Optional. Zero-based row offset for pagination.
GOOGLE_ANALYTICS_RUN_FUNNEL_REPORTTool to run a GA4 funnel report. Use when you need a customized funnel analysis report for a given property.10 params

Tool to run a GA4 funnel report. Use when you need a customized funnel analysis report for a given property.

Parameters* required
limitinteger
Number of rows to return. Default 10000; max 250000.
funnelobject
Funnel configuration object following the API schema (must include 'steps').
propertystring
GA4 property resource name, format: properties/{property_id}.
segmentsarray
Up to 4 segments; each yields its own row in the report.
dateRangesarray
List of date ranges to read; overlapping ranges duplicate days across ranges.
dimensionFilterobject
Dimension-only filter expression.
funnelBreakdownobject
Breakdown dimension configuration for the funnel table sub-report.
funnelNextActionobject
Next-action dimension configuration for the funnel visualization sub-report.
returnPropertyQuotaboolean
If true, includes the property's current quota state.
funnelVisualizationTypestring
Visualization type: STANDARD_FUNNEL (default) or TRENDED_FUNNEL.one of STANDARD_FUNNEL · TRENDED_FUNNEL
GOOGLE_ANALYTICS_RUN_REPORTTool to run a customized GA4 data report. Use when you need event data after specifying dimensions, metrics, and date ranges.15 params

Tool to run a customized GA4 data report. Use when you need event data after specifying dimensions, metrics, and date ranges.

Parameters* required
limitinteger
Optional. Number of rows to return. Must be between 1 and 250000.
offsetinteger
Optional. 0-based start row for pagination. Must be >= 0.
metricsarray
Optional. The metrics to request and display. Each metric is an object with a 'name' field.
orderBysarray
Optional. Specify how rows are ordered. Each object defines dimension or metric ordering.
propertystring
Required. The property resource on which to run the report. Format: properties/{property_id}.
cohortSpecobject
Optional. Cohort specification. Requires requesting the cohort dimension.
dateRangesarray
Optional. The date ranges to read. Each range requires 'startDate' and 'endDate'.
dimensionsarray
Optional. The dimensions to request and display. Each dimension is an object with a 'name' field.
comparisonsarray
Optional. The comparison configuration. Adds a comparison column to the response.
currencyCodestring
Optional. The currency code to apply, in ISO 4217 format. Defaults to property currency.
metricFilterobject
Optional. The filter expression to restrict metric values. Applied after aggregation.
keepEmptyRowsboolean
Optional. If true, rows with all zero metrics will be returned; otherwise omitted.
dimensionFilterobject
Optional. The filter expression to restrict dimension values. Only dimensions are allowed.
metricAggregationsarray
Optional. Aggregation types to include over metrics, e.g., 'TOTAL', 'MINIMUM', 'MAXIMUM'.
returnPropertyQuotaboolean
Optional. If true, include the property's current quota state in the response.

Rogue, the Rebel character for safe action and control

mcp-servers

OpenSSF Scorecard

Source-available MCP servers by Mindstone. Works with any MCP host — Claude Desktop, Cursor, Rebel, and others.

Browse all 35 connectors with their version, auth model, and tool count at the catalogue site (regenerated from each connector's STATUS.json on every push).

Connectors

ConnectorDescription
apple-shortcutsRun and list Apple Shortcuts on macOS via the shortcuts CLI
browser-automationHeadless browser control via accessibility snapshots — navigate, fill forms, click, and screenshot pages via the agent-browser CLI
elevenlabsGenerate speech, music, and sound effects, browse voices, and transcribe audio via the ElevenLabs API
email-imapRead, search, send, and manage emails through IMAP and SMTP
fathomList and search meetings, view details, read transcripts, and manage teams via Fathom AI
freshdeskManage helpdesk tickets, search support requests, reply to customers, and add internal notes
gammaCreate AI-powered presentations, documents, webpages, and social posts via Gamma
google-analyticsDiscover GA4 accounts and properties, explore the live schema, and run reports via the Google Analytics API
google-workspaceRead, search, and send across Gmail, Calendar, Drive, Docs, Sheets, Slides, Contacts, and Comments with host-orchestrated OAuth and per-account on-disk credentials
hubspotManage HubSpot CRM — contacts, companies, deals, tickets, leads, tasks, notes, properties, lists, workflows, knowledge base, and files — with multi-account, host-orchestrated OAuth
humaansQuery employee profiles, job roles, time-away requests, and company info via Humaans HR
klingGenerate AI videos from text descriptions or images via Kling AI
microsoft-calendarList, create, update, and respond to Outlook calendar events, check free/busy, and list calendars; reuses the cohort's host-orchestrated Microsoft 365 OAuth surface
microsoft-filesList, search, upload, download, share, and read OneDrive files via Microsoft Graph; reuses the cohort's host-orchestrated Microsoft 365 OAuth surface
microsoft-mailList, search, read, send, reply, forward, draft, move, and delete Outlook email; owns the cohort's host-orchestrated Microsoft 365 OAuth surface
microsoft-sharepointDiscover sites, browse libraries, read pages and lists, search content, and mutate SharePoint files/lists with incremental Sites.Read.All consent
microsoft-teamsList and read Teams chats, send chat messages, list teams and channels, and read presence; reuses the cohort's host-orchestrated Microsoft 365 OAuth surface
mixmaxManage sequences, send tracked emails, use templates, and monitor engagement via Mixmax
nano-bananaGenerate and edit images using Google Gemini's AI capabilities
napkinGenerate professional visuals — diagrams, infographics, and illustrations — from text via Napkin AI
officeRead and edit Word documents, Excel workbooks, and PowerPoint presentations from desktop Microsoft 365 via an Office Add-in sidecar
openai-imageGenerate and edit images via OpenAI's gpt-image-2 — sharp text rendering, multilingual support, and four quality levels
outreachManage prospects, sequences, accounts, tasks, and mailings via the Outreach sales engagement API
pandadocCreate, send, and manage documents, templates, and e-signatures via PandaDoc
quickbooksManage invoices, bills, customers, vendors, employees, and accounts in QuickBooks Online
replit-sshRead, write, list, and check files on Replit projects over SSH/SFTP, with one-shot SSH key + config setup on the operator's machine
retell-aiPlace voice-agent phone calls, manage agents and LLM prompts, and discover voices via the Retell AI API
runwayGenerate AI video, images, audio, speech, and sound effects via Runway ML
salesforceManage accounts, contacts, opportunities, leads, tasks, users, and custom objects via the Salesforce API
servicenowManage incidents, change requests, users, and knowledge base articles in ServiceNow
slackMulti-workspace Slack — channels, messages, threads, reactions, users, files, bookmarks, and scheduled messages via the Slack Web API, with host-orchestrated OAuth
talentlmsManage users, courses, groups, branches, enrolments, and assessments in TalentLMS
vantaRead and manage compliance posture in Vanta — vulnerabilities, tests, controls, evidence, resources, people, vendors, documents, and compliance summary
workdayQuery workers, profiles, and organizations in Workday HCM
zendeskManage tickets, macros, users, and views in Zendesk Support

Quick Start

Each server builds independently:

cd connectors/<name>
npm install
npm run build

Or run directly via npx (once published):

npx -y @mindstone/mcp-server-zendesk

Moving from @mindstone-engineering/? Every server has been republished under the shorter @mindstone/ npm scope. The legacy @mindstone-engineering/mcp-server-* packages still install but are marked deprecated. See MIGRATION.md for the consumer one-liner and the deprecation timeline.

See each server's README for configuration and host setup instructions. Some connectors require additional environment variables to opt into specific behaviour (e.g. QB_ALLOW_PROD_WRITES for QuickBooks production writes, MCP_WORKSPACE_PATH for sandboxed file reads, BROWSER_AUTOMATION_ALLOW_EVAL for browser-automation script eval) — see the per-connector READMEs for the full list.

Security & Hardening

This monorepo follows a defence-in-depth posture for tool-call hosts. Highlights include:

  • Workflow safety. GitHub Actions workflows are env-fy'd against script injection (CWE-94), every action is pinned to a commit SHA (kept current by Dependabot), and each job is granted a least-privilege permissions: block. Publish is split into a build job (does the install/test/pack with no publish credentials) and a publish job (downloads the packed tarball, runs only npm publish --ignore-scripts --provenance under OIDC trusted publishing, gated by the npm-publish environment). The publish job invokes NO third-party JS — tsc, vitest, lifecycle scripts, etc. all run upstream, away from id-token: write. See docs/security/AUDIT_FOX-3319_tanstack_supply_chain.md for the supply-chain threat model and docs/security/BRANCH_PROTECTION.md for required GitHub settings.
  • Release-age cool-down. The repo-level .npmrc sets min-release-age=7 (days), so CI refuses to install dependency versions published in the last week. This blocks the "same-day malicious re-publish" path that ships post-npm audit-clean PRs into a release tag.
  • Provenance-attested releases. Releases are published by CI (.github/workflows/release.yml) under the @mindstone/ npm scope via Trusted Publishing OIDC — no long-lived npm token exists anywhere — with --provenance Sigstore attestations consumers can verify via npm audit signatures. Every publishable release commit must carry a Release-Gate trailer pointing at its pre-release security review, and every publish posts an alert; the full gate chain is in docs/PUBLISH_APPROVAL_PROCESS.md. (Only a brand-new connector's first publish is manual and WebAuthn-gated; those tarballs carry no provenance attestation but remain shasum-verifiable — check out the release commit and run npm pack; see MIGRATION.md.)
  • OpenSSF Scorecard. The repo runs the OpenSSF Scorecard weekly via .github/workflows/scorecard.yml. The report is generated by a third party from the source tree, so every claim above (action pinning, branch protection, token usage, dependency hygiene) is independently checked rather than just asserted here. The current score is shown by the badge at the top of this README.

Recommendations for consumers

These connectors are published as plain npm packages. The strongest single thing you can do to protect yourself from a future supply-chain compromise of any npm package (these or otherwise) is to use a client that does not run lifecycle scripts by default:

  • pnpm (pnpm install / pnpm dlx) — does not execute postinstall/prepare hooks unless explicitly allowlisted via onlyBuiltDependencies. pnpm v11+ also defaults to a 24-hour minimumReleaseAge cool-down.
  • bun (bunx) — same default, no lifecycle scripts unless allowlisted.
  • npm — if you must use npm, set min-release-age=7 and ignore-scripts=true in your global ~/.npmrc. Requires npm v11.10+ for min-release-age.

None of our published packages need postinstall to function, so disabling lifecycle scripts in your installer of choice is safe.

  • Untrusted-content envelopes. External content from email, helpdesk, and ticketing systems (email-imap, freshdesk, zendesk) is wrapped in <untrusted-content source="..."> envelopes with close-tag breakout escaping, so an LLM host can recognise and refuse instruction-injection attempts.
  • Workspace sandboxing. File-uploading connectors (nano-banana, pandadoc, elevenlabs) constrain reads to MCP_WORKSPACE_PATH (or os.tmpdir()) with canonical-prefix containment that handles symlinked roots like /tmp → /private/tmp.
  • Secure-by-default writes. Production-impacting writes (QuickBooks invoices/bills/customers/vendors) require an explicit QB_ALLOW_PROD_WRITES=1 opt-in env var; outreach prospect-enrolment and mixmax sequence-recipient tools carry destructiveHint: true so hosts surface confirmation prompts.
  • SSRF & path traversal. Download connectors (napkin, runway) enforce host allow-lists, manual-redirect handling, and symlink-safe write paths under a configurable root.
  • Loopback OAuth bind. Connectors with local OAuth callback servers (salesforce, outreach) hard-code 127.0.0.1, ignoring any MCP_OAUTH_BIND_HOST override.
  • E.164 validation. Outbound phone-call tools (retell-ai) reject non-E.164 numbers before any upstream API call.

For per-connector security notes, see each connector's README.

To report a vulnerability, please see SECURITY.md.

The Mindstone open-source family

This repo is one of several open-source projects from Mindstone:

  • Rebel — the AI workspace desktop app that ships these connectors out of the box (source release in progress).
  • Super-MCP — a proxy MCP router that loads only the tools you actually need, saving your context window.
  • rebel-system — the public Rebel system: skills, prompts, operators, help docs, and templates.
  • meeting-note-recorder — meeting detection, recording, and live transcripts (the Rebel note-taker).

Licence

Each connector is licensed under FSL-1.1-MIT — see the LICENSE file in each connector directory for details.

Featured
CodeRabbit
CodeRabbit
AI writes the code. CodeRabbit catches the slop.
Try For Free →
Keep your Mac awake
Keep your Mac awake
Keep your Mac awake while Claude Code and 40+ AI agents run. Sleeps when they're idle.
One time payment $9 →
Context.devContext.dev
Context.dev
Integrate web data into your AI product. One API to scrape website & brand data.
Get API Key Now →
Make your agent a DeFi expert
Make your agent a DeFi expert
Agent, run crypto. Access onchain data & trade routes via 1inch.
Install now →
Make money from your Skills
Make money from your Skills
On Capafy, your Skill runs online 24/7 as an agent product, and you get paid every time someone uses it.
Start earning →
AppSignal
AppSignal
Monitor with ease. Code with confidence.
Start Free Trial →

Configuration

GOOGLE_APPLICATION_CREDENTIALS*

Absolute path to ADC or service-account JSON file

GA4_PROPERTY_ID

Default GA4 property ID (e.g. 123456789)

Categories
Monitoring & ObservabilityData & Analytics
Registryactive
Package@mindstone/mcp-server-google-analytics
TransportSTDIO
AuthRequired
UpdatedMay 21, 2026
View on GitHub

Related Monitoring & Observability MCP Servers

View all →
Mcp Observability

io.github.infoinlet-marketplace/mcp-observability

Observability for incident agents — query Loki (LogQL), Prometheus (PromQL), Elasticsearch.
Monitor

betterdb-inc/monitor

BetterDB MCP server - Valkey observability for Claude Code and other MCP clients
1.1k
Datadog

com.mcparmory/datadog

Monitor infrastructure, manage agents and deployments, track metrics, logs, and events
25
Observability Mcp

thotischner/observability-mcp

Unified observability gateway for AI agents — Prometheus, Loki & more, with anomaly detection.
5
Datadog Mcp

io.github.tantiope/datadog-mcp

Full Datadog API access: monitors, logs, metrics, traces, dashboards, and observability tools
4
Datadog

io.github.us-all/datadog

Datadog MCP — 165 tools for metrics, monitors, logs, APM, RUM, incidents, CI/CD, fleet
1