
Research
/Security News
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
@cesteral/dv360-mcp
Advanced tools
DV360 MCP Server - Campaign entity management and configuration for Google Display & Video 360.
Management server for DV360 campaign entities. Provides CRUD operations for campaigns, insertion orders, line items, creatives, and other DV360 entities via the Display & Video 360 API v4.
Self-host quickstart | Compare OSS vs Cesteral Intelligence | Book a workflow demo
outputSchema, prioritize structuredContent as the canonical full payload.The fastest way to get started is using Claude Desktop:
cd packages/dv360-mcp && pnpm run build
See CLAUDE_DESKTOP_SETUP.md for detailed setup instructions.
✅ Production-Ready (all tools fully functional)
The server is built with production-grade architecture and complete functionality:
| Tool | Description |
|---|---|
dv360_list_entities | List entities of any type with filters and pagination |
dv360_get_entity | Get a specific entity by ID |
dv360_create_entity | Create a new entity |
dv360_update_entity | Update an entity with updateMask discipline |
dv360_delete_entity | Delete an entity |
| Tool | Description |
|---|---|
dv360_adjust_line_item_bids | Batch adjust bids for multiple line items |
dv360_bulk_update_status | Batch update status for multiple entities |
dv360_bulk_create_entities | Batch create DV360 entities |
dv360_bulk_update_entities | Batch update DV360 entities |
| Tool | Description |
|---|---|
dv360_create_custom_bidding_algorithm | Create a custom bidding algorithm |
dv360_manage_custom_bidding_script | Upload/manage custom bidding scripts |
dv360_manage_custom_bidding_rules | Manage custom bidding rules |
dv360_list_custom_bidding_algorithms | List custom bidding algorithms |
| Tool | Description |
|---|---|
dv360_list_assigned_targeting | List assigned targeting options |
dv360_get_assigned_targeting | Get a specific assigned targeting option |
dv360_create_assigned_targeting | Assign a targeting option |
dv360_delete_assigned_targeting | Remove an assigned targeting option |
dv360_validate_targeting_config | Validate a targeting configuration |
| Tool | Description |
|---|---|
dv360_validate_entity | Client-side schema validation (no API call) |
updateMask is required for all update operations — omitting it silently ignores fieldsThe server supports 11 DV360 entity types through the dynamic entity system:
Partner - DV360 partner accountsAdvertiser - Advertiser accountsCampaign - Advertising campaignsInsertionOrder - Insertion orders (IO)LineItem - Line itemsAdGroup - Ad groupsAdGroupAd - Ads within ad groupsCreative - Creative assetsCustomBiddingAlgorithm - Custom bidding algorithmsInventorySource - Inventory sourcesLocationList - Geographic location lists| Mode | Header | Description |
|---|---|---|
google-headers (default) | X-DV360-* | Google OAuth2 credentials via request headers |
jwt | Authorization: Bearer <JWT> | JWT token authentication for hosted deployments |
none | — | No authentication (development only) |
Set via MCP_AUTH_MODE environment variable.
# From monorepo root
pnpm install
# Build the package
cd packages/dv360-mcp
pnpm run build
Follow the detailed guide: docs/SERVICE_ACCOUNT_SETUP.md
Quick summary:
For testing with HTTP transport:
cd packages/dv360-mcp
cp .env.example .env
Edit .env and configure ONE of these credential options:
# RECOMMENDED: Path to service account JSON file
DV360_SERVICE_ACCOUNT_FILE=/absolute/path/to/service-account.json
# OR: Base64-encoded credentials
DV360_SERVICE_ACCOUNT_JSON=<base64-encoded-json>
# OR: GCP Secret Manager (production)
SERVICE_ACCOUNT_SECRET_ID=projects/123/secrets/dv360-sa/versions/latest
For using with Claude Desktop, configure via Claude Desktop settings:
See docs/CLAUDE_DESKTOP_SETUP.md for complete instructions.
Quick configuration:
{
"mcpServers": {
"dv360-mcp-local": {
"command": "node",
"args": ["/absolute/path/to/packages/dv360-mcp/dist/index.js"],
"cwd": "/absolute/path/to/packages/dv360-mcp",
"env": {
"NODE_ENV": "development",
"DV360_SERVICE_ACCOUNT_FILE": "/absolute/path/to/service-account.json"
}
}
}
}
Why file-based credentials?
# Option 1: Using dev-server script (from repo root)
./scripts/dev-server.sh dv360-mcp
# Option 2: Direct command
cd packages/dv360-mcp
pnpm run dev:http
Server starts on http://localhost:3002
pnpm run dev:http # Start with hot reload
pnpm run build # Build TypeScript
pnpm run typecheck # Type checking
pnpm run generate:schemas # Regenerate DV360 schemas from API
pnpm run test # Run tests (when implemented)
Health Check:
curl http://localhost:3002/health
MCP Endpoint:
curl -X POST http://localhost:3002/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
The server is containerized and ready for Cloud Run deployment:
# Build Docker image
docker build -t dv360-mcp .
# Run locally
docker run -p 3002:3002 --env-file .env dv360-mcp
For production deployment via Cloud Run, see root-level Terraform configuration.
src/index.ts - Entry point, starts HTTP serversrc/config/ - Environment configurationsrc/container/ - Dependency injection setup (tsyringe)src/mcp-server/server.ts - MCP server creationsrc/mcp-server/transports/streamable-http-transport.ts - Streamable HTTP transport layersrc/mcp-server/tools/ - MCP tool definitionssrc/services/dv360/ - DV360 API client servicesrc/generated/schemas/ - Auto-generated TypeScript types and Zod schemasThe server uses auto-generated schemas from the DV360 OpenAPI specification:
pnpm run generate:schemas
This generates:
src/generated/schemas/types.ts - TypeScript types (1,962 lines)src/generated/schemas/zod.ts - Zod validation schemas (1,874 lines)The schemas provide 80% size reduction from the original Discovery Document (932KB → 185KB).
Comprehensive documentation available in docs/:
"DV360 service account credentials not configured"
Check which credential option you're using:
# For file-based credentials
cat /path/to/service-account.json | jq .
# For base64 credentials
echo $DV360_SERVICE_ACCOUNT_JSON | base64 -d | jq .
# For Claude Desktop, check the logs
tail -50 ~/Library/Logs/Claude/mcp-server-dv360-mcp-local.log | grep -E "config|SERVICE_ACCOUNT"
Verify API access:
display-video scopeCheck dependencies and build:
# Install dependencies
pnpm install
# Rebuild
pnpm run build
# Test locally
node dist/index.js
# Should show: "[config] Loaded .env..." or "Loading service account from file"
The server implements per-advertiser rate limiting (default: 60 requests/minute).
If hitting limits:
DV360_RATE_LIMIT_PER_MINUTE in .env# Local development
pnpm run dev:http
# Production (Cloud Run)
gcloud run services logs tail dv360-mcp --region=europe-west2
The testing infrastructure is in place but tests need to be written:
# Run tests (when implemented)
pnpm run test
For production observability:
# In .env
OTEL_ENABLED=true
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://your-collector/v1/traces
OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://your-collector/v1/metrics
See root CLAUDE.md for development guidelines, build system details, and monorepo conventions. See the root README for full architecture context.
Self-host: Follow the deployment guide to run this server on your own infrastructure.
Cesteral Intelligence: Request access -- governed execution with credential brokering, approvals, audit, and multi-tenant access.
Book a workflow demo: See it in action with your own ad accounts.
Compare options: OSS connectors vs Cesteral Intelligence
Apache License 2.0 — see LICENSE for details. This package is part of Cesteral's open-source connector layer; managed hosting and higher-level governance features live outside this repository.
FAQs
DV360 MCP Server - Campaign entity management and configuration
The npm package @cesteral/dv360-mcp receives a total of 104 weekly downloads. As such, @cesteral/dv360-mcp popularity was classified as not popular.
We found that @cesteral/dv360-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.