Google Launches Official MCP Server Letting AI Query Analytics Data Directly

·2 views

Google has released an official Model Context Protocol (MCP) server for Google Analytics, hosted under the googleanalytics GitHub organization and licensed under Apache-2.0. The tool allows AI assistants to query Analytics data in real time without requiring users to export CSV reports manually. It offers tools for account summaries, standard and funnel reports, and real-time user data, with read-only access enforced via analytics.readonly credentials. The project, created in July 2025 and now on version 0.7.0, records over 73,000 downloads per month despite having around 3,200 GitHub stars, suggesting far wider adoption than star counts indicate. Google's move follows MCP becoming a vendor-neutral open standard in December 2025 after Anthropic donated it to the Linux Foundation-backed Agentic AI Foundation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Lost 48 Hours Debugging CSV Error Caused by Missing UTF-8 Locale on Server

A developer spent nearly two days troubleshooting a UnicodeDecodeError in a Python script that read a UTF-8 CSV file, only to find the file itself was never the problem. The script passed all local tests because the developer's machine had PYTHONUTF8=1 set in their shell config and a sitecustomize.py enabling UTF-8 mode by default. The clean Linux server lacked both settings, causing Python to fall back to the POSIX locale, which defaults to ASCII encoding in practice. The root cause was finally identified by stripping the local environment variables to replicate the server's bare conditions. The fix required explicitly setting encoding='utf-8' on every file open call rather than relying on system-level locale defaults.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Freeze JSON Serializer Output Before Refactoring Call Sites

Codebases that scatter json.dumps calls with inconsistent flags risk silent wire-format changes when those calls are later consolidated into a single helper function. Parameters like ensure_ascii, sort_keys, separators, and custom default handlers each affect the exact bytes produced, and downstream systems such as gateways and log processors may break without any test failure. The recommended approach is to pin the exact UTF-8 bytes output by every distinct dumps call site before extracting a shared serializer. Pins should record the byte output, the exception type raised on invalid input, and whether a default handler was present — not just parsed Python dict equality. Once byte-level fixtures are committed and passing, a single serializer function can be safely extracted without merging incompatible serialization dialects.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Your Session Cookie Acts Like a Password After You Log In

Once a user logs in, most web applications stop using the password for subsequent requests and instead rely on a session identifier stored in a browser cookie. The server creates a session after verifying credentials, assigns it a unique ID, and uses that ID to recognize the user on every future request. Because the browser sends only the session ID — not the password — an attacker who obtains that identifier can potentially impersonate the user without ever knowing their password. This makes session IDs function as temporary credentials, and their theft can lead to full account compromise. Developers are advised to generate session IDs using cryptographically secure methods and to understand key cookie security settings to reduce this risk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Diagnose Conflicting IP Reputation Scores Before Replacing a Proxy

When two IP reputation providers return contradicting scores, the problem may lie in the lookup itself rather than the proxy being tested. Issues such as expired API credentials, cached results, HTTP errors, or failed parsers can produce misleading data, making proxy replacement an unnecessary expense. Reputation APIs and destination services operate as separate systems, so a rejected API request does not confirm that the target service has blocked the IP. Different providers also measure different things — AbuseIPDB tracks user reports while IP2Proxy uses fraud-risk and threat fields — meaning score disagreement reflects differing methodologies, not clear-cut answers. Analysts are advised to record HTTP status, timestamps, and cache age alongside each result, and to examine abuse report recency and data-center classification before drawing conclusions.

0 comments Read more at DEV Community