# Google Business Profile MCP [Health: Active]

**Category:** 📊 Monitoring  
**Repository:** https://github.com/A1-x-Tech/mcp-google-business  
**GitHub Stars:** 3  
**npm Downloads (last month):** 1362  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/google-business-profile-mcp

## Description
MCP server for Google Business Profile: locations, reviews, local posts and performance metrics.

## Tools
Capabilities this server exposes over MCP:

- **auth_status** — Shows whether this server is connected to Google: token presence and source (env variables or a stored in-chat login), expiry, the Google account email, granted vs missing OAuth scopes, where the credentials file lives and where the OAuth client comes from. Makes no network calls and never returns the token itself. Call it first when other tools report the server is not connected.
- **setup_instructions** — Step-by-step checklist for connecting this server to Google: creating a Google Cloud project and a Desktop-app OAuth client, publishing the consent screen (mandatory — Testing-mode refresh tokens die after 7 days), downloading the client JSON and handing its PATH to set_client. Works without any credentials; the checklist shortens to 'enable the API + log in' when an OAuth client is already configured (one client serves the whole mcp-google-* line). Never asks the user to paste secrets into the chat.
- **set_client** — Saves the OAuth client credentials from the JSON file downloaded from Google Cloud Console ('Download JSON' on a Desktop-app client). Pass the file PATH — the secret must never be pasted into the chat. The client is stored once in the shared ~/.config/mcp-google-auth/client.json (owner-only) and reused by every mcp-google-* server; tokens stay per-server. After this, call start_login.
- **start_login** — First step of connecting from the chat, without editing config files or restarting the client. Returns authorizeUrl — show it to the user as a clickable link and ask them to open it in the browser ON THIS MACHINE, pick the Google account and approve access. A one-shot listener on 127.0.0.1 catches Google's redirect; the code is exchanged locally and never passes through the chat. Does not open the browser itself. The attempt lives 10 minutes; when the browser shows the success page, call finish_login.
- **finish_login** — Second step: confirms the browser consent finished, saves the tokens to an owner-only file and verifies the login with a read-only identity call, returning the account email and the granted scopes. After success every tool works immediately — no client restart. If the user granted only part of the requested permissions, the login is still saved and missingScopes lists what will not work. Logging in under a different Google account replaces the previous login (its refresh token is revoked best-effort) and the response carries previousAccountEmail so the change never goes unnoticed.
- **logout** — Revokes the stored token at Google (oauth2.googleapis.com/revoke) and deletes the local credentials file. Tokens supplied via env variables are NOT touched — remove them from the MCP client config manually; envTokenStillSet in the response says whether any are still in effect.
- **list_accounts** — Lists all Google Business Profile accounts the authenticated user can access (the personal account first). Each account has name (accounts/{id} — the id feeds the accountId of other tools), accountName, type (PERSONAL / LOCATION_GROUP / USER_GROUP / ORGANIZATION), role, and verificationState. The API caps pageSize at 20 (unusually small), so follow nextPageToken to see every account.
- **list_locations** — Lists the business locations under an account (Business Information API). Each location's name is locations/{id} — that id feeds locationId everywhere else (including the Performance API and, together with the account id, the v4 reviews/posts tools). totalSize is only present when filter is set. Fields are limited by readMask; ask for metadata to get mapsUri/placeId/newReviewUri.
- **get_location** — Returns one location by id (Business Information API; v1 uses the bare locations/{id} name, no account prefix). The readMask picks which fields come back: title, categories, storefrontAddress, phoneNumbers, websiteUri, regularHours, specialHours, openInfo, profile (description), storeCode, latlng, metadata (mapsUri, newReviewUri, placeId).
- **update_location** — Updates fields of a location (PATCH with a required updateMask — only masked fields change). Pass the new values in `location`, e.g. {"title": "New name"} with updateMask "title". Set validateOnly to check the change without applying it. Note: every profile has a hard cap of 10 edits per minute (not raisable) — batch your changes into one call where possible. Returns the updated Location.
- **list_categories** — Lists/searches the reference taxonomy of business categories (e.g. gcid:restaurant). Category names (categories/gcid:...) feed location.categories on update_location and categoryName on list_attribute_metadata. view=FULL also returns serviceTypes and moreHoursTypes per category; filter narrows by display name, e.g. "displayName=coffee".
- **list_attribute_metadata** — Lists which attributes (e.g. wheelchair accessibility, wi-fi, payment options) are legal for a location or for a category+region. Pass locationId for a concrete location, OR categoryName+regionCode to explore. Each entry has parent (the attribute id for update_location_attributes), valueType (BOOL / ENUM / REPEATED_ENUM / URL), displayName, repeatable and valueMetadata (legal values).
- **update_location_attributes** — Updates attributes of a location (PATCH). Each attribute needs its name (attributes/{attribute_id} from list_attribute_metadata's parent field) plus values (BOOL/ENUM), uriValues (URL) or repeatedEnumValue ({setValues, unsetValues}). attributeMask defaults to the names of the attributes you pass; name an attribute in the mask with no values to clear it. Counts against the 10 edits/min per-profile cap.
- **search_chains** — Searches business chains by name (exact/partial/fuzzy), ranked by relevance. Each chain has name (chains/{chain_id}), chainNames, websites and locationCount. Use the chain name when relating a location to its brand (location.relationshipData).
- **get_daily_metrics** — Returns a daily time series for ONE performance metric of a location: impressions by surface (Maps/Search × desktop/mobile), direction requests, call clicks, website clicks, conversations, bookings, food orders or menu clicks. Response: timeSeries.datedValues[] of {date{year,month,day}, value} — value is int64 serialized as a string; a missing value means no data for that day. Metrics for the most recent days are not available immediately (multi-day lag, typically a few days) — empty values near today are normal, not an error.
- **fetch_multi_daily_metrics** — Returns daily time series for SEVERAL performance metrics of a location in one call — same data as get_daily_metrics, but batched. Response: multiDailyMetricTimeSeries[].dailyMetricTimeSeries[] of {dailyMetric, timeSeries.datedValues[]}; values are int64 strings. Prefer this over several get_daily_metrics calls to save quota. Metrics for the most recent days are not available immediately (multi-day lag, typically a few days) — empty values near today are normal, not an error.
- **list_search_keyword_impressions** — Returns the search keywords that surfaced the business on Google, month by month. Response: searchKeywordsCounts[] of {searchKeyword, insightsValue} — insightsValue is a UNION: either an exact {value} or a {threshold} for low-volume keywords (the true count is below it; never sum thresholds as exact counts). Months are calendar months; data for the current month appears with a lag.
- **list_reviews** — Lists reviews of a location, newest-updated first by default. Response: reviews[] of {name, reviewId, reviewer{displayName, isAnonymous}, starRating (ONE..FIVE enum, not a number), comment, createTime, updateTime, reviewReply{comment, updateTime} if answered}, plus averageRating (1–5) and totalReviewCount. pageSize caps at 50. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **get_review** — Returns one review by id — same shape as a list_reviews entry (starRating is an enum ONE..FIVE, reviewReply present only if the business already answered). Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **reply_to_review** — Creates OR replaces the business's public reply to a review (PUT upsert — there is no separate create, and calling it again overwrites the previous reply). Only works on verified locations. Returns the ReviewReply {comment, updateTime}. Counts against the 10 edits/min per-profile cap. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **delete_review_reply** — Deletes the business's reply to a review (the review itself is the customer's and cannot be deleted). Empty response on success. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **list_local_posts** — Lists the local posts (What's New / Event / Offer updates shown on the Business Profile) of a location. Each post has name (accounts/*/locations/*/localPosts/{post_id}), summary, topicType, state (LIVE / PROCESSING / REJECTED), searchUrl, createTime and updateTime. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **create_local_post** — Publishes a new local post on the Business Profile. Pass the LocalPost as `post`. LocalPost fields: languageCode; summary (the post text); topicType (STANDARD | EVENT | OFFER | ALERT); callToAction {actionType: BOOK | ORDER | SHOP | LEARN_MORE | SIGN_UP | CALL, url}; event {title, schedule{startDate{year,month,day}, startTime{hours,minutes}, endDate, endTime}} — required for EVENT and OFFER; offer {couponCode, redeemOnlineUrl, termsConditions}; media [{mediaFormat: "PHOTO", sourceUrl}]. ALERT posts are restricted to Google-initiated campaigns and are typically rejected. Returns the created post with its name and state (a fresh post is usually PROCESSING before it goes LIVE). Counts against the 10 edits/min per-profile cap. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **update_local_post** — Updates fields of an existing local post (PATCH with a required updateMask — only masked fields change, e.g. updateMask "summary" with post {"summary": "New text"}). LocalPost fields: languageCode; summary (the post text); topicType (STANDARD | EVENT | OFFER | ALERT); callToAction {actionType: BOOK | ORDER | SHOP | LEARN_MORE | SIGN_UP | CALL, url}; event {title, schedule{startDate{year,month,day}, startTime{hours,minutes}, endDate, endTime}} — required for EVENT and OFFER; offer {couponCode, redeemOnlineUrl, termsConditions}; media [{mediaFormat: "PHOTO", sourceUrl}]. ALERT posts are restricted to Google-initiated campaigns and are typically rejected. Returns the updated post. Counts against the 10 edits/min per-profile cap. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **delete_local_post** — Deletes a local post from the Business Profile. Empty response on success. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.
- **raw_request** — Escape hatch to call any Google Business Profile endpoint directly, for endpoints without a dedicated tool. `service` picks the host: accounts (mybusinessaccountmanagement, v1), businessinfo (mybusinessbusinessinformation, v1), performance (businessprofileperformance, v1) or v4 (legacy mybusiness.googleapis.com — reviews, posts, media). `path` is relative to the host, e.g. "v1/accounts" or "v4/accounts/1/locations/2/media". Remember v1 quirks: readMask/updateMask go in `query`. The Bearer token is attached automatically; a path resolving to a foreign origin is rejected.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "google-business-profile-mcp": {
    "command": "npx",
    "args": ["-y","mcp-google-business@latest"],
    "env": {
      "GOOGLE_BUSINESS_CLIENT_ID": "",
      "GOOGLE_BUSINESS_CLIENT_SECRET": "",
      "GOOGLE_BUSINESS_REFRESH_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `GOOGLE_BUSINESS_CLIENT_ID`, `GOOGLE_BUSINESS_CLIENT_SECRET`, `GOOGLE_BUSINESS_REFRESH_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Google Business Profile MCP does

Google Business Profile MCP exposes Google Business Profile operations as MCP tools for AI clients. It covers account discovery, location details, categories, attributes, performance reporting, customer reviews, and local posts. Read operations can retrieve profile and engagement data, while write operations can change public business information or content.

The server works across Google's current Business Information, Account Management, and Performance APIs, plus the legacy v4 API that still hosts reviews and local posts. A single `business.manage` OAuth scope covers these API surfaces.

## How it works

Authentication can use `GOOGLE_BUSINESS_CLIENT_ID`, `GOOGLE_BUSINESS_CLIENT_SECRET`, and `GOOGLE_BUSINESS_REFRESH_TOKEN`, or the server's browser-based login flow. `auth_status` reports the connection state without making a network request or exposing tokens. For interactive setup, `start_login` returns a URL, a local listener receives Google's redirect, and `finish_login` stores and verifies the resulting credentials. `logout` revokes stored credentials and removes the local token file.

Account and location identifiers are used to connect related operations. `list_accounts` returns account names such as `accounts/{id}`, while location tools use `locations/{id}`. The server can list or update location fields and attributes, inspect category metadata, search business chains, and retrieve daily metrics or monthly search-keyword impressions.

Review and post operations use the legacy v4 API. Review tools can list, retrieve, reply to, and remove replies from reviews. Local-post tools can list, create, update, and delete posts, including standard, event, and offer content.

## Setup and configuration

Run the npm stdio package with Node.js 20 or newer. It can be added to Codex, Claude Code, Claude Desktop, Cursor, or VS Code using the `mcp-google-business@latest` package and the three `GOOGLE_BUSINESS_*` environment variables.

Google Cloud setup requires enabling the Account Management, Business Information, Performance, and legacy Google My Business APIs. The Cloud project also needs Basic API Access approval. Before approval, the API quota is zero; approved projects receive quota for each API. The OAuth client should be a Desktop application, and the consent screen must be published because testing-mode refresh tokens expire after seven days.

The server also supports `setup_instructions` and `set_client` for configuring a downloaded OAuth client JSON file. The client is stored in an owner-only shared configuration path, while tokens remain specific to each server.

## Tools and capabilities

- Discover accessible Google Business Profile accounts and locations.
- Read or update location fields with an explicit update mask, including validation-only checks.
- Query categories, category-specific attributes, and business-chain information.
- Retrieve daily performance metrics in single-metric or batched requests.
- Inspect search-keyword impressions, including low-volume threshold values.
- List reviews and publish, replace, or delete owner replies.
- List, create, modify, and delete local posts with calls to action, events, offers, or media.
- Send authenticated requests to supported Google Business Profile API hosts through `raw_request`.

## Limitations and notes

Google applies a hard limit of 10 edits per minute for each profile. Recent performance data can have a delay of several days, and current-day values may be empty. Review and local-post functionality depends on the legacy v4 API. Review replies require a verified location, and local posts may remain in `PROCESSING` before becoming live; alert posts are restricted and are typically rejected.

The API limits account pages to 20 results and review pages to 50. Search-keyword counts below Google's reporting threshold are returned as thresholds rather than exact values. The `raw_request` tool can reach write or delete endpoints, so clients should treat it as potentially destructive. OAuth credentials and refresh tokens should be handled as passwords.

_Full upstream README: https://allmcps.com/mcp/google-business-profile-mcp/readme_