A command that signs in to Google Analytics through your web browser and saves the credentials locally. OAuth is a standard permission process that lets an application access an account without receiving its password.

Authorizing the ga-mcp-full server to access Google Analytics data and settings.

The Google Analytics server needs permission to access your account. Running this command completes that sign-in once so later sessions can reuse the saved credentials.

auth-login — Command for Claude Code by ringo380

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/ringo380/ga-mcp-full

Made for: Claude Code.

Or install ga-mcp-full, the plugin that ships this one along with the rest of its 5 commands, 2 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/ringo380/ga-mcp-full/auth-login/github.svg)](https://agentmods.dev/commands/ringo380/ga-mcp-full/auth-login)

Your own site

<a href="https://agentmods.dev/commands/ringo380/ga-mcp-full/auth-login"><img src="https://agentmods.dev/badge/commands/ringo380/ga-mcp-full/auth-login/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/ringo380/ga-mcp-full/auth-login"><img src="https://agentmods.dev/badge/commands/ringo380/ga-mcp-full/auth-login.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 410 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00019	$0.00410
Opus 5	$0.00010	$0.00205
Sonnet 5	$0.00004	$0.00082
Haiku 4.5	$0.00002	$0.00041

Measured 9d ago against content hash 5673b93b1ec5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

auth-login scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/auth-login.md · 39 lines

What it actually says

Authenticate the ga-mcp-full MCP server against your Google Analytics account.

What this does

Runs ga-mcp-full auth login, which:

Resolves the OAuth client (env var override → ~/.config/ga-mcp/client_secrets.json → bundled public Desktop client).
Opens your default browser to Google's consent screen with the analytics.edit scope.
Starts a local HTTP server on 127.0.0.1 bound to a random free port (no pre-registration needed — Google's installed-app OAuth accepts any loopback port).
Completes a PKCE-protected (S256) authorization code exchange.
Caches credentials at ~/.config/ga-mcp/credentials.json (mode 0600).

Subsequent Claude Code sessions reuse the cached refresh token automatically — you never need the client ID/secret at runtime after this step.

Steps

Run the login command with Bash:
```
ga-mcp-full auth login
```
Report the result to the user. If the command exits non-zero with client_not_configured, point them at /ga-mcp-full:setup so they can install the CLI or provide a custom OAuth client.
If the browser does not open automatically, the command prints the auth URL to stderr — surface that URL to the user so they can open it manually.

Notes

The MCP server does NOT need to be restarted after login — the next tool call will load the new credentials from disk.
If a cached refresh token has been revoked, tool calls surface "GA auth required: run /ga-mcp-full:auth-login ..." — rerun this command to re-authenticate.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 39 lines · 19 tokens per session scan A 5673b93b1ec5

Subscribe to this mod's changes

auth-login is a command published in the GitHub repository ringo380/ga-mcp-full (0 stars, last pushed 1mo ago), licensed MIT. It adds 19 tokens to every session and 410 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Analytics and metrics Claude Code anthropic claude-desktop ga4 google-analytics

meta-attach-vault

Interactive wizard to attach an Obsidian vault to a code/dev workspace (the common case), bootstrap a standalone vault, or register a remote vault. Provisions plugins + scaffolds wiki structure + binds .env + edits .gitignore + offers a conventions picker. (Skill meta-attach-vault handles natural-language triggers.).

tboome33/obsidian-mcp-router · 67 tokens

meta-sync-template

Propagate the reference (.template) vault's plugins, snippets, and root docs to one or more configured vaults. Interactive picker — lists each vault with online status + REST-API-plugin presence, lets you sync all or a subset, with optional --force re-clone. (Skill meta-sync-template handles natural-language triggers…

tboome33/obsidian-mcp-router · 75 tokens

okf-export

Export a wiki subset as a shareable OKF knowledge bundle (Google's Open Knowledge Format v0.1) — slugified filenames, relative markdown links, per-folder indexes, newest-first log, conformance self-checked. (Skill wiki-export handles the flow via its okf target.).

tboome33/obsidian-mcp-router · 63 tokens

okf-projections

Régénérer les projections OKF du wiki (index racine + index par répertoire + log) ou vérifier leur dérive (--check).

tboome33/obsidian-mcp-router · 30 tokens

wiki-boundary

Rank the wiki's "frontier" pages — the crossroads many pages link to that stay thin inside — to decide where research would pay off. Read-only, deterministic, no LLM. The score proposes attention, not importance. (Skill wiki-boundary handles natural-language triggers.).

tboome33/obsidian-mcp-router · 58 tokens

wiki-graph

Build a typed knowledge graph (Understand-Anything-compatible knowledge-graph.json) from a vault's wiki — articles/entities/claims/sources/topics + relationships — written to wiki-meta/graph/ + a .understand-anything/ copy for the UA dashboard. Deterministic, no LLM. (Skill wiki-graph handles natural-language…

tboome33/obsidian-mcp-router · 72 tokens