
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
MCP server for Google Tag Manager API v2. Provides programmatic access to GTM accounts, containers, workspaces, tags, triggers, variables, and version management.
npm install -g gtm-mcp
Or install locally:
npm install gtm-mcp
git clone https://github.com/pouyanafisi/gtm-mcp.git
cd gtm-mcp
npm install
npm run build
credentials.json in gtm-mcp directoryIf installed globally, use the binary directly:
{
"mcpServers": {
"gtm": {
"command": "gtm-mcp",
"env": {
"GTM_CREDENTIALS_FILE": "/absolute/path/to/credentials.json",
"GTM_TOKEN_FILE": "/absolute/path/to/token.json"
}
}
}
}
If installed locally, use npx:
{
"mcpServers": {
"gtm": {
"command": "npx",
"args": ["gtm-mcp"],
"env": {
"GTM_CREDENTIALS_FILE": "/absolute/path/to/credentials.json",
"GTM_TOKEN_FILE": "/absolute/path/to/token.json"
}
}
}
}
{
"mcpServers": {
"gtm": {
"command": "node",
"args": ["/absolute/path/to/gtm-mcp/dist/index.js"],
"env": {
"GTM_CREDENTIALS_FILE": "/absolute/path/to/gtm-mcp/credentials.json",
"GTM_TOKEN_FILE": "/absolute/path/to/gtm-mcp/token.json"
}
}
}
}
See MCP_SETUP.md for platform-specific instructions.
If installed globally:
gtm-mcp-auth
Or with npx:
npx gtm-mcp-auth
npm run auth
Token saved to token.json and auto-refreshed.
99 operations available (95 API operations + 4 workflow helpers). See OPERATIONS.md for complete reference.
List all containers for account 123456
Create GA4 setup with measurement ID G-XXXXXXXXXX for account 123456, container 7890123
Update tag 1 in account 123456, container 7890123 with new parameters
Publish version for account 123456, container 7890123 with name "Version 1.0"
123456)7890123)1 for default)GTM-XXXXXXX format (not used by API)Find IDs in GTM UI URL or container settings.
gtm-mcp/
├── src/
│ ├── index.ts # MCP server
│ ├── gtm-client.ts # GTM API client
│ ├── gtm-components.ts # Workflow templates
│ ├── auth-helper.ts # OAuth2 helper
│ └── auth.ts # Auth script
├── docs/ # API documentation
├── dist/ # Compiled output
└── package.json
npm run dev # Watch mode
npm run type-check # Type checking
npm run build # Build
npm run auth # Authenticate
npm test # Run tests
npm run test:run # Run tests once
npm run test:ui # Test UI
npm run test:coverage # Coverage report
Authentication fails: Run npm run auth separately. Verify credentials.json exists.
Permission errors: Verify account has edit access to container. Use numeric IDs, not GTM-XXX.
API errors: Check account/container IDs. Verify workspace exists. Check rate limits.
Build errors: Node.js 18+, run npm install, verify TypeScript config.
MIT
FAQs
MCP server for Google Tag Manager
We found that gtm-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.