
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
mcp-google-business
Advanced tools
MCP server for Google Business Profile — locations, reviews, local posts and performance metrics for AI agents (Claude, Cursor, Codex and others).
English | Русский
A1 Google Business Profile MCP lets an AI app work with your Google Business Profile locations in natural language. Inspect locations and performance, respond to reviews, prepare local posts and update profile information deliberately.
It connects to Google’s current Business Profile APIs and the legacy API where reviews and posts still live. A Google account and OAuth credentials alone are not enough: Google must approve Basic API Access for the Cloud project.
business.manage OAuth scope.Start with a read-only question:
List my locations and show the newest reviews that do not have a reply.
Connect the server · Explore use cases · Open technical documentation
You: List my locations and show the newest reviews that do not have a reply.
Assistant: Shows the locations and recent reviews. Nothing changes.
You: Draft a reply to the newest three-star review at the downtown location. Apologize and offer to help.
Assistant: Shows the location, review and proposed reply, then asks for confirmation before publishing it.
You: Confirm.
Assistant: Publishes the reply. It does not alter the review, other locations or posts.
You need Node.js 20+, a verified Google Business Profile, a Google Cloud OAuth client and an approved Basic API Access application.
In Settings → Plugins → MCP servers, choose Add server, then add npx -y mcp-google-business@latest with GOOGLE_BUSINESS_CLIENT_ID, GOOGLE_BUSINESS_CLIENT_SECRET and GOOGLE_BUSINESS_REFRESH_TOKEN.
codex mcp add google-business \
--env GOOGLE_BUSINESS_CLIENT_ID=your_client_id \
--env GOOGLE_BUSINESS_CLIENT_SECRET=your_client_secret \
--env GOOGLE_BUSINESS_REFRESH_TOKEN=your_refresh_token \
-- npx -y mcp-google-business@latest
codex mcp list
claude mcp add \
--env GOOGLE_BUSINESS_CLIENT_ID=your_client_id \
--env GOOGLE_BUSINESS_CLIENT_SECRET=your_client_secret \
--env GOOGLE_BUSINESS_REFRESH_TOKEN=your_refresh_token \
--transport stdio --scope user google-business \
-- npx -y mcp-google-business@latest
claude mcp list
Open Settings → Developer → Edit Config and add:
{"mcpServers":{"google-business":{"command":"npx","args":["-y","mcp-google-business@latest"],"env":{"GOOGLE_BUSINESS_CLIENT_ID":"your_client_id","GOOGLE_BUSINESS_CLIENT_SECRET":"your_client_secret","GOOGLE_BUSINESS_REFRESH_TOKEN":"your_refresh_token"}}}}
If Edit Config is unavailable, edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows. Claude Desktop MCP documentation
Add {"mcpServers":{"google-business":{"type":"stdio","command":"npx","args":["-y","mcp-google-business@latest"],"env":{"GOOGLE_BUSINESS_CLIENT_ID":"your_client_id","GOOGLE_BUSINESS_CLIENT_SECRET":"your_client_secret","GOOGLE_BUSINESS_REFRESH_TOKEN":"your_refresh_token"}}}} to ~/.cursor/mcp.json on macOS/Linux or %USERPROFILE%\.cursor\mcp.json on Windows. Cursor MCP documentation
Run MCP: Open User Configuration and add:
{"servers":{"google-business":{"type":"stdio","command":"npx","args":["-y","mcp-google-business@latest"],"env":{"GOOGLE_BUSINESS_CLIENT_ID":"${input:gbp_client_id}","GOOGLE_BUSINESS_CLIENT_SECRET":"${input:gbp_client_secret}","GOOGLE_BUSINESS_REFRESH_TOKEN":"${input:gbp_refresh_token}"}}},"inputs":[{"type":"promptString","id":"gbp_client_id","description":"Google OAuth client ID"},{"type":"promptString","id":"gbp_client_secret","description":"Google OAuth client secret","password":true},{"type":"promptString","id":"gbp_refresh_token","description":"Google OAuth refresh token","password":true}]}
Check it with MCP: List Servers. VS Code MCP documentation
| Operation | What happens | Confirmation boundary |
|---|---|---|
| Accounts, locations, categories, attributes, performance, reviews and posts | Reads existing profile data | No change |
| Update a location or its attributes | Changes public business profile data | Changes a location |
| Reply to a review | Publishes a public owner reply | Changes public content |
| Create or update a local post | Publishes or changes public local content | Changes public content |
| Delete a review reply or local post | Removes public content | Destructive |
| Raw API request | May call any write or delete endpoint | Potentially destructive |
The AI client controls confirmations; the server marks tools so the client can distinguish inspection from a live change.
Google requires both OAuth and Basic API Access approval.
https://www.googleapis.com/auth/business.manage, and set the three GOOGLE_BUSINESS_* variables.Treat the client secret and refresh token as passwords. An access token is a short-lived alternative for one-off use.
| Variable | Required | Description |
|---|---|---|
GOOGLE_BUSINESS_CLIENT_ID | Yes* | OAuth client ID. |
GOOGLE_BUSINESS_CLIENT_SECRET | Yes* | OAuth client secret. |
GOOGLE_BUSINESS_REFRESH_TOKEN | Yes* | OAuth refresh token with business.manage. |
GOOGLE_BUSINESS_ACCESS_TOKEN | Yes* | Short-lived alternative to the OAuth trio. |
GOOGLE_BUSINESS_TIMEOUT_MS | No | Per-request timeout; default 60000 ms. |
GOOGLE_BUSINESS_MAX_RETRIES | No | Temporary-error retries; default 3. |
* Provide either the OAuth trio or an access token. API host overrides are documented in the tool reference.
ASKADS_TELEMETRY=0 to opt out.Found a bug or need a scenario? Create an issue or write in Telegram.
You made it to the end!
FAQs
MCP server for Google Business Profile — locations, reviews, local posts and performance metrics for AI agents (Claude, Cursor, Codex and others).
We found that mcp-google-business demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.