// SCAN REPORT

Google Tag Manager MCP Server

18 tools. 17 can modify or destroy data without limits.

14 destructive tools with no built-in limits. Policy required.

Last updated:

17 can modify or destroy data
1 read-only
18 tools total

Community server · catalogue entry verified 11/06/2026

How to control Google Tag Manager MCP Server ↓

TOOL MAP

Read (1) Write / Execute (3) Destructive / Financial (14)

MOST DANGEROUS TOOLS

Critical Risk
Destructive · High gtm_user_permission The tool includes 'remove' (irreversible deletion of user permissions) alongside create/get/list/update. Destructive · High gtm_built_in_variable The tool includes 'remove' which irreversibly deletes built-in variables, and 'revert' which overwrites/undoes changes. Destructive · High gtm_client The tool includes 'remove' which is a destructive/irreversible deletion operation on GTM clients. Destructive · High gtm_container The tool includes 'remove' which is an irreversible destructive operation on GTM containers.

17 of Google Tag Manager MCP Server's 18 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

HOW TO CONTROL GOOGLE TAG MANAGER MCP SERVER

PolicyLayer is an MCP gateway — it sits between your AI agents and Google Tag Manager MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "gtm_built_in_variable": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "gtm_destination": {
    "limits": [
      {
        "counter": "gtm_destination_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "gtm_version_header": {
    "limits": [
      {
        "counter": "gtm_version_header_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Google Tag Manager MCP Server — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON GOOGLE TAG MANAGER →

Free to start. No card required.

ALL 18 GOOGLE TAG MANAGER MCP SERVER TOOLS

DESTRUCTIVE 14 tools
Destructive gtm_built_in_variable Performs all built-in variable operations: create, list, remove, revert. The Destructive gtm_client Performs all client operations: create, get, list, update, remove, revert. The Destructive gtm_container Performs all container-related operations: create, get, update, remove, list, combine, lookup, moveTagId, snip Destructive gtm_environment Performs all environment operations: create, get, list, update, remove, reauthorize. The Destructive gtm_folder Performs all folder operations: create, get, list, update, remove, revert, entities, moveEntitiesToFolder. The Destructive gtm_gtag_config Performs all Google tag config operations: create, get, list, update, remove. The Destructive gtm_tag Performs all GTM tag operations: create, get, list, update, remove, revert. The Destructive gtm_template Performs all GTM custom template operations: create, get, list, update, remove, revert. The Destructive gtm_transformation Performs all GTM transformation operations: create, get, list, update, remove, revert. The Destructive gtm_user_permission Performs all user permission operations: create, get, list, update, remove. The Destructive gtm_variable Performs all GTM variable operations: create, get, list, update, remove, revert. The Destructive gtm_version Performs all container version operations: get, live, publish, remove, setLatest, undelete, update. For Destructive gtm_workspace Performs various workspace operations including create, get, list, update, remove, createVersion, getStatus, s Destructive gtm_zone Performs various zone operations including create, get, list, update, remove, and revert actions. The
EXECUTE 1 tools
Execute gtm_trigger Performs all GTM trigger operations: create, get, list, update, remove, revert. The
WRITE 2 tools
Write gtm_destination Performs all destination operations: get, list, link, unlink. The Write gtm_account Performs all account-related operations: get, list, update. Use the
READ 1 tools
Read gtm_version_header Performs all container version header operations: list, latest. The

RELATED SERVERS

Other MCP servers with similar tools — same risk classification, starter policies for each.

BNB Chain MCP 1240 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Nodebench 724 tools
adminautomation
GoHighLevel MCP Server 566 tools
adminautomation
UnClick 451 tools
adminautomation
NowAIKit — ServiceNow AI Toolkit 446 tools
adminautomation
Mcp Windows 441 tools
adminautomation
0nmcp 407 tools
adminautomation

FAQ

Can an AI agent delete data through the Google Tag Manager MCP Server MCP server? +

Yes. The Google Tag Manager MCP Server server exposes 14 destructive tools including gtm_built_in_variable, gtm_client, gtm_container. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Google Tag Manager MCP Server? +

The Google Tag Manager MCP Server server has 2 write tools including gtm_destination, gtm_account. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Google Tag Manager MCP Server.

How many tools does the Google Tag Manager MCP Server MCP server expose? +

18 tools across 4 categories: Destructive, Execute, Read, Write. 1 are read-only. 17 can modify, create, or delete data.

How do I enforce a policy on Google Tag Manager MCP Server? +

Register the Google Tag Manager MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Google Tag Manager MCP Server tool call.

Deterministic rules across all 18 Google Tag Manager MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON GOOGLE TAG MANAGER →

Free to start. No card required.

18 Google Tag Manager MCP Server tools catalogued and risk-classified — across an index of 42,500+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.