Re: [Action Needed] OAuth Verification Request Acknowledgement
Suren
Hi Google team,
This message confirms that you can now complete the OAuth verification review for GA4 MCP. Both required action items have been addressed.
1. Accessing the demonstration video
You can view the publicly accessible demonstration video at the following link: https://youtu.be/AqaYJgg6qW8
Video configuration notes:
- Access permissions: Public / Anyone with the link can view (no Google account login required).
- Content displayed: The video displays the OAuth Client ID (
1033652992783-qgt8c9nffk9pcjsckau23og14240jb45.apps.googleusercontent.com) in the browser address bar, shows the OAuth consent screen requestinghttps://www.googleapis.com/auth/analytics.readonly, and demonstrates the user consent and analytical query workflow.
2. Reviewing sensitive data protection disclosures in the Privacy Policy
You can inspect the updated Privacy Policy at: https://ga4mcp.com/privacy
To review the specific disclosures addressing your policy requirements, refer to the following sections:
Top Summary Card: "Summary of Google User Data Handling & Protection (At a Glance)"
Located immediately below the document header, this section summarizes the architectural guarantees, confirming that zero user data is stored on external servers and detailing encryption and deletion controls.
Section 4: "Data Protection Mechanisms for Sensitive Data"
- Security procedures and confidentiality: Confirms that strict technical and organizational controls protect the confidentiality, integrity, and availability of all data processed by GA4 MCP.
- Encryption in transit: Enforces Transport Layer Security (TLS 1.2 and TLS 1.3) over HTTPS for all network communication between the local client, Google Analytics APIs (
analyticsdata.googleapis.com), and OAuth endpoints. Rejects unencrypted HTTP transmissions. - Protection at rest: Stores OAuth refresh and access tokens exclusively on the user's local workstation at
~/.config/ga4-mcp/session.json. Enforces restricted operating system file permissions (chmod 0600) to restrict read and write access solely to the authenticated OS user, augmented by the host platform's full-disk encryption (FileVault, BitLocker, LUKS). - Stateless ephemeral relay: Confirms that the Cloudflare Worker gateway operates strictly in-memory to exchange authorization codes, maintains zero persistent databases, zero caches, and zero credential logs, and purges credentials from memory immediately upon transmission to localhost.
- Direct analytics payloads: Confirms that Google Analytics reporting data streams directly between the user's machine and Google's servers without transiting or persisting on intermediary infrastructure.
Section 5: "Data Retention and Deletion"
- Retention limits: Retains credentials locally only for the duration needed to execute user-initiated analytical requests. Retains zero credentials or reporting payloads on cloud infrastructure.
- Local deletion mechanism: Allows users to purge all local tokens and cached data at any time by deleting the configuration directory:bashrm -rf ~/.config/ga4-mcp
- Revoking access: Provides direct instructions for users to revoke OAuth tokens at any time via Google Account Permissions.
Section 3: "Google API Services User Data Policy Compliance"
- AI/ML model training prohibition: Affirms explicitly that Google Analytics user data accessed via Google APIs is never used to develop, improve, fine-tune, or train non-personalized AI and/or machine learning models.
- Third-party disclosure prohibition: Affirms explicitly that Google user data is never sold, rented, or transferred to third parties, data brokers, or advertising networks.
3. Verification status in Google Cloud Console
The application configuration has been updated and resubmitted for verification in the Google Cloud Console.
Please let us know if you require any additional technical details to finalize approval.
Sincerely,
Surendran
Hello Google Developer,
Thank you for your patience while we reviewed your submission for project 1033652992783(Project ID: gcp-experiments-387402). We need you to address the following items for us to continue your app’s verification:
Demo Video:
- We are unable to access the video link that you provided.
Privacy Policy :
- Your privacy policy does not specify any data protection mechanisms for sensitive data.
Please take the following action(s) to continue with your request⤷ Reply to this email with the following information:
- A publicly accessible demo video (Learn more)
⤷ Update and resubmit your app in Cloud Console with the following:
- A link to the updated privacy policy containing data protection disclosures (Learn more)
© 2026 Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043Important! Once you have addressed the issues above, reply directly to this email to confirm. You must reply to this email after fixing the highlighted issues to continue with the app verification process.
No longer need access to these scopes?
Please reply to this email to cancel the verification request.
Need to make changes to your verification request?
Please make direct changes on the Cloud Console. Save and submit the changes when finished.
How do I check my submission status?
Please visit the Verification Center in the Cloud Console to check the review progress for each verification requirement
What are the verification requirements?
As a reminder, before your application can be approved you must meet the below requirements:
All Scopes (Non-Sensitive, Sensitive, Restricted)
Restricted and Sensitive Only
- App Privacy Policy
- Demo Video
- In-app Testing
- Application Use Cases
- Requesting Minimum Scopes
- AI/ML Model Training Privacy Policy Disclosure for Workspace APIs
Data Portability APIs Scope
Restricted Only
Need other help?
For more information on OAuth Verification, you can read the terms or policies for the APIs or products your app uses, as well as the following resources:
General Information
Verification Overviews
Troubleshooting
Thank you,
The Third Party Data Safety Team
You have received this mandatory service announcement to update you about important changes to Google Cloud Platform or your account.
Suren
https://youtu.be/AqaYJgg6qW8
Hello Google Developer,
Thank you for your patience while we reviewed your submission for project 1033652992783(Project ID: gcp-experiments-387402). We need you to address the following items for us to continue your app’s verification:
- The video link you shared is inaccessible.
Please take the following action(s) to continue with your request⤷ Reply to this email with the following information:
- A publicly accessible demo video (Learn more)
Important! Once you have addressed the issues above, reply directly to this email to confirm. You must reply to this email after fixing the highlighted issues to continue with the app verification process.
Suren
Thank you for the guidance. Below is the clarification regarding our requested scope and least-privilege architecture, along with an updated demonstration video.
1. Architectural context & least-privilege justification
- Application type: GA4 MCP is an open-source Model Context Protocol (MCP) integration. It enables local AI developer assistants (such as Claude Desktop and Cursor) to query Google Analytics data via natural language on behalf of the user.
- Narrowest available scope: The Google Analytics Data API (
analyticsdata.googleapis.com) and Admin API (analyticsadmin.googleapis.com) provide only two access tiers: full read/write (analytics) and read-only (analytics.readonly). We do not request edit, write, manage, or delete permissions.https://www.googleapis.com/auth/analytics.readonlyis the narrowest and lowest-privilege scope available to query reports and property metadata. - Zero server storage: The software executes locally on the user's workstation. Query responses stream directly from Google APIs to the user's local AI client. No reporting data or credentials are ever stored on external servers.
2. Demonstration video
You can view the updated demonstration video at: https://youtu.be/GcWp3IBdBvE
Rubric criteria confirmed in this demonstration:
- OAuth consent screen & Client ID: Displays the full Client ID (
1033652992783-qgt8c9nffk9pcjsckau23og14240jb45.apps.googleusercontent.com) in the address bar. - Expanded scope details: The permission dialog is expanded on screen showing
https://www.googleapis.com/auth/analytics.readonlyclearly readable before user consent. - In-app user-facing functionality: Demonstrates the end-to-end user workflow—the user prompts their AI client in natural language, the integration executes the read-only GA4 query, and the analytics report is displayed directly in the interface.
Please let us know if you need any additional clarification to finalize our verification.
Best regards,
Surendran Balachandran
Maintainer, GA4 MCP
Hello Google Developer,
Thank you for your patience while we reviewed your verification request.
The Google API Services User Data Policy mandates the principle of least privilege and requires developers to request the narrowest permissions critical to implementing your production-ready features.
The demo video you provided does not sufficiently demonstrate why the following scope(s) are necessary or why narrower permissions cannot be used.
As user data access is granted based on evidenced need, your video must demonstrate the maximum extent of the user facing features using the scope(s).
Action Required: Provide a comprehensive new demonstration video that satisfies the following criteria:
In-App Functionality: Demonstrate the full operational functionality of every requested scope. (Inform us if your application is an integration platform offering many granular permissions under a least privilege auth model.)
Source Account Impact: For write or delete permissions, show the changes triggered in the app reflected in the user's Google account. For example, if the app demonstrates "permanent deletion," the video must also show the email being purged in the Gmail source account.
Consent Screen: The OAuth consent flow and permission screen must be displayed with all requested scopes fully expanded and readable—if the scopes are obscured, click “Show all services.”
Scope Matching: The scopes requested by your app or manifest must exactly match the scopes configured and submitted for verification in the Google Cloud Console.
Critical Note For Live Apps: If your integration is already live to your users, do not deploy unverified scopes to production traffic. This will disrupt your users and consume your unverified user quota. Instead, trigger new scopes only in a staging environment within your production app. If your app has reached its user cap, use a separate project to record the demo. The publishing status should remain “In Production.”
Once you have updated your demo and/or your scope configuration in the Google Cloud Console, please reply directly to this email to continue the review.
Best regards,
The Third-Party Data Safety Team