
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@cesteral/dv360-mcp
Advanced tools
DV360 MCP Server - Campaign entity management and configuration for Google Display & Video 360.
Management server for DV360 campaign entities. Provides CRUD operations for campaigns, insertion orders, line items, creatives, and other DV360 entities via the Display & Video 360 API v4.
Self-host quickstart | Compare OSS vs Cesteral Intelligence | Book a workflow demo
outputSchema, prioritize structuredContent as the canonical full payload.The fastest way to get started is using Claude Desktop:
cd packages/dv360-mcp && pnpm run build
See CLAUDE_DESKTOP_SETUP.md for detailed setup instructions.
✅ Production-Ready (all tools fully functional)
The server is built with production-grade architecture and complete functionality:
| Tool | Description |
|---|---|
dv360_list_entities | List entities of any type with filters and pagination |
dv360_get_entity | Get a specific entity by ID |
dv360_create_entity | Create a new entity |
dv360_update_entity | Update an entity with updateMask discipline |
dv360_delete_entity | Delete an entity |
| Tool | Description |
|---|---|
dv360_adjust_line_item_bids | Batch adjust bids for multiple line items |
dv360_bulk_update_status | Batch update status for multiple entities |
dv360_bulk_create_entities | Batch create DV360 entities |
dv360_bulk_update_entities | Batch update DV360 entities |
| Tool | Description |
|---|---|
dv360_create_custom_bidding_algorithm | Create a custom bidding algorithm |
dv360_manage_custom_bidding_script | Upload/manage custom bidding scripts |
dv360_manage_custom_bidding_rules | Manage custom bidding rules |
dv360_list_custom_bidding_algorithms | List custom bidding algorithms |
| Tool | Description |
|---|---|
dv360_list_assigned_targeting | List assigned targeting options |
dv360_get_assigned_targeting | Get a specific assigned targeting option |
dv360_create_assigned_targeting | Assign a targeting option |
dv360_delete_assigned_targeting | Remove an assigned targeting option |
dv360_validate_targeting_config | Validate a targeting configuration |
| Tool | Description |
|---|---|
dv360_validate_entity | Client-side schema validation (no API call) |
updateMask is required for all update operations — omitting it silently ignores fieldsThe server supports 11 DV360 entity types through the dynamic entity system:
Partner - DV360 partner accountsAdvertiser - Advertiser accountsCampaign - Advertising campaignsInsertionOrder - Insertion orders (IO)LineItem - Line itemsAdGroup - Ad groupsAdGroupAd - Ads within ad groupsCreative - Creative assetsCustomBiddingAlgorithm - Custom bidding algorithmsInventorySource - Inventory sourcesLocationList - Geographic location lists| Mode | Header | Description |
|---|---|---|
google-headers (default) | X-DV360-* | Google OAuth2 credentials via request headers |
jwt | Authorization: Bearer <JWT> | JWT token authentication for hosted deployments |
none | — | No authentication (development only) |
Set via MCP_AUTH_MODE environment variable.
# From monorepo root
pnpm install
# Build the package
cd packages/dv360-mcp
pnpm run build
Follow the detailed guide: docs/SERVICE_ACCOUNT_SETUP.md
Quick summary:
For testing with HTTP transport:
cd packages/dv360-mcp
cp .env.example .env
Edit .env and configure ONE of these credential options:
# RECOMMENDED: Path to service account JSON file
DV360_SERVICE_ACCOUNT_FILE=/absolute/path/to/service-account.json
# OR: Base64-encoded credentials
DV360_SERVICE_ACCOUNT_JSON=<base64-encoded-json>
# OR: GCP Secret Manager (production)
SERVICE_ACCOUNT_SECRET_ID=projects/123/secrets/dv360-sa/versions/latest
For using with Claude Desktop, configure via Claude Desktop settings:
See docs/CLAUDE_DESKTOP_SETUP.md for complete instructions.
Quick configuration:
{
"mcpServers": {
"dv360-mcp-local": {
"command": "node",
"args": ["/absolute/path/to/packages/dv360-mcp/dist/index.js"],
"cwd": "/absolute/path/to/packages/dv360-mcp",
"env": {
"NODE_ENV": "development",
"DV360_SERVICE_ACCOUNT_FILE": "/absolute/path/to/service-account.json"
}
}
}
}
Why file-based credentials?
# Option 1: Using dev-server script (from repo root)
./scripts/dev-server.sh dv360-mcp
# Option 2: Direct command
cd packages/dv360-mcp
pnpm run dev:http
Server starts on http://localhost:3002
pnpm run dev:http # Start with hot reload
pnpm run build # Build TypeScript
pnpm run typecheck # Type checking
pnpm run generate:schemas # Regenerate DV360 schemas from API
pnpm run test # Run tests (when implemented)
Health Check:
curl http://localhost:3002/health
MCP Endpoint:
curl -X POST http://localhost:3002/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
The server is containerized and ready for Cloud Run deployment:
# Build Docker image
docker build -t dv360-mcp .
# Run locally
docker run -p 3002:3002 --env-file .env dv360-mcp
For production deployment via Cloud Run, see root-level Terraform configuration.
src/index.ts - Entry point, starts HTTP serversrc/config/ - Environment configurationsrc/container/ - Dependency injection setup (tsyringe)src/mcp-server/server.ts - MCP server creationsrc/mcp-server/transports/streamable-http-transport.ts - Streamable HTTP transport layersrc/mcp-server/tools/ - MCP tool definitionssrc/services/dv360/ - DV360 API client servicesrc/generated/schemas/ - Auto-generated TypeScript types and Zod schemasThe server uses auto-generated schemas from the DV360 OpenAPI specification:
pnpm run generate:schemas
This generates:
src/generated/schemas/types.ts - TypeScript types (1,962 lines)src/generated/schemas/zod.ts - Zod validation schemas (1,874 lines)The schemas provide 80% size reduction from the original Discovery Document (932KB → 185KB).
Comprehensive documentation available in docs/:
"DV360 service account credentials not configured"
Check which credential option you're using:
# For file-based credentials
cat /path/to/service-account.json | jq .
# For base64 credentials
echo $DV360_SERVICE_ACCOUNT_JSON | base64 -d | jq .
# For Claude Desktop, check the logs
tail -50 ~/Library/Logs/Claude/mcp-server-dv360-mcp-local.log | grep -E "config|SERVICE_ACCOUNT"
Verify API access:
display-video scopeCheck dependencies and build:
# Install dependencies
pnpm install
# Rebuild
pnpm run build
# Test locally
node dist/index.js
# Should show: "[config] Loaded .env..." or "Loading service account from file"
The server implements per-advertiser rate limiting (default: 60 requests/minute).
If hitting limits:
DV360_RATE_LIMIT_PER_MINUTE in .env# Local development
pnpm run dev:http
# Production (Cloud Run)
gcloud run services logs tail dv360-mcp --region=europe-west2
The testing infrastructure is in place but tests need to be written:
# Run tests (when implemented)
pnpm run test
For production observability:
# In .env
OTEL_ENABLED=true
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://your-collector/v1/traces
OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://your-collector/v1/metrics
See root CLAUDE.md for development guidelines, build system details, and monorepo conventions. See the root README for full architecture context.
Self-host: Follow the deployment guide to run this server on your own infrastructure.
Cesteral Intelligence: Request access -- governed execution with credential brokering, approvals, audit, and multi-tenant access.
Book a workflow demo: See it in action with your own ad accounts.
Compare options: OSS connectors vs Cesteral Intelligence
Apache License 2.0 — see LICENSE for details. This package is part of Cesteral's open-source connector layer; managed hosting and higher-level governance features live outside this repository.
FAQs
DV360 MCP Server - Campaign entity management and configuration
The npm package @cesteral/dv360-mcp receives a total of 74 weekly downloads. As such, @cesteral/dv360-mcp popularity was classified as not popular.
We found that @cesteral/dv360-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.