fix(google): GA funnel on v1alpha + Workspace MCP agentic-client readiness

Merged
YU
8d ago
+68-8

Two Google fixes, kept together on request.

1. google-analytics: run-funnel-report uses v1alpha

runFunnelReport only exists on the GA4 Data API v1alpha; the tool called v1beta and every call failed with Google Analytics API error: 404 (verified 2026-10-21 via a Studio connection, property 355495152; the same steps on v1alpha return the funnel table). decocms/reports already does this in api/connectors/data/ga4.ts. Insights MCP's INTERACTIONS_DASHBOARD needs it for "did X, then purchased".

2. google-workspace: ready for Google's is_agentic OAuth clients

Google's notice: from 2026-11-11 its Workspace MCP servers only accept OAuth clients marked agentic; from 2026-11-12 the flag is permanent (changing it = new client ID, everyone reconnects).

Which MCPs here are affected (checked in code):

  • google-workspace ā€” affected. It proxies to gmailmcp / drivemcp / calendarmcp / chatmcp / people.googleapis.com/mcp/v1. Without the flag it stops working on 11/11.
  • REST-based ones (google-gmail, google-drive, google-calendar, google-analytics, google-search-console, ...) ā€” not affected on 11/11; Google still asks to mark agent clients.
  • Nothing here uses the Data Analytics API with Gemini (Conversational Analytics), so the 2027-01-01 billing change does not apply.

Code changes:

  • mcp-proxy.ts: a "not marked as an AI agent" rejection now says exactly that and that re-auth will not help (today every 403 says "missing scope, re-authenticate").
  • main.ts: optional GOOGLE_WORKSPACE_CLIENT_ID / GOOGLE_WORKSPACE_CLIENT_SECRET for a dedicated agentic client; falls back to the shared GOOGLE_CLIENT_ID.
  • README section with the dates and the decision.
  • mcp-proxy.test.ts (2 tests, pass).

Still a console action (not code)

Mark the OAuth client(s) used by these MCPs as agentic in Google Cloud (projects decocms, deco-chat-460601) before 2026-11-11. If the shared GOOGLE_CLIENT_ID is also used for non-agent traffic (e.g. human sign-in), create a separate agentic client and set the two new env vars instead.

šŸ¤– Generated with Claude Code

Summary by cubic

Fixes GA4 funnel reports (the v1beta path for runFunnelReport always 404s) and gets google-workspace ready for Google's 2026-11-11 requirement that Workspace MCP OAuth clients be marked agentic.

google-analytics

  • run-funnel-report now calls the Data API's v1alpha endpoint, where runFunnelReport exists.

google-workspace

  • 403s and backend errors that mention "agentic" or "AI agent" now explain the client isn't marked agentic and that re-authenticating won't help, instead of the generic missing-scope hint.
  • Optional GOOGLE_WORKSPACE_CLIENT_ID/GOOGLE_WORKSPACE_CLIENT_SECRET allow a dedicated agentic client, falling back to the shared GOOGLE_CLIENT_ID; switching clients invalidates existing refresh tokens, so users reconnect once.
  • README documents the deadline and the Google Cloud Console action required.