GA4 Analytics (MCP)

What it does

The MCP server exposes five tools for pulling GA4 reports from any AI assistant connected to BlackOps (Claude, ChatGPT, etc). Each tool takes a domain argument matching a BlackOps site you own.

• ga4_traffic_overview — sessions, users, pageviews, bounce rate, average session duration
• ga4_top_pages — top pages ranked by pageviews with title, path, and time on page
• ga4_traffic_sources — source/medium/channel breakdown
• ga4_trend — daily time-series for sessions, users, pageviews, or newUsers
• ga4_site_comparison — side-by-side metrics for multiple sites in one call

Setup

1. Create a Google Cloud service account

1. Open the Google Cloud service accounts page and create a new service account (any project will do).
2. Enable the Google Analytics Data API for that project (APIs & Services → Library → search "Analytics Data API" → Enable).
3. On the service account, generate a new JSON key and download it.

2. Grant the service account access to your GA4 property

1. In Google Analytics, go to Admin → Property Access Management.
2. Add the service account email (looks like name@project.iam.gserviceaccount.com) with the Viewer role.
3. While in Admin → Property Settings, copy the numeric Property ID (e.g. 123456789). This is not the G-XXXX measurement ID.

3. Save credentials in BlackOps

1. Go to Admin → Sites and open the site you want to enable.
2. Open the Analytics tab. Find the "GA4 Data API (MCP)" card.
3. Paste the numeric Property ID and the full service account JSON.
4. Click Save GA4 Credentials.

Once saved, the badge changes to Configured. The JSON is encrypted with AES-256-GCM and is never sent back to the browser. To rotate, paste new JSON and save. To remove, click Clear.

Example chats

From any MCP-connected AI (Claude Code, Claude Desktop, ChatGPT with the BlackOps connector), just ask in natural language. The AI picks the right tool and arguments for you. A few real-world prompts to copy:

Calling tools directly

If you're scripting against the MCP yourself, the JSON-RPC arguments look like this:

{
  "name": "ga4_traffic_overview",
  "arguments": {
    "domain": "benenewton.com",
    "days": 28
  }
}

{
  "name": "ga4_site_comparison",
  "arguments": {
    "domains": ["benenewton.com", "blackopscenter.com"],
    "days": 7
  }
}

How it works under the hood

When the MCP receives a ga4_* call, it:

1. Calls GET /api/v2/analytics/ga4-credentials?domain=… with the user's bearer token.
2. The endpoint validates the token, confirms the user owns the site, decrypts the stored ciphertext, and returns the property ID + service account JSON.
3. The MCP constructs a Google Auth client with read-only Analytics scope and runs the requested report against the GA4 Data API.
4. The Google client is cached per-domain for the MCP process lifetime. To pick up rotated credentials, restart the MCP server.

Troubleshooting