How the TaggingDocs MCP Server uses each Google OAuth scope — last updated 2026-04-16.
The Server exposes 35 tools to a connected AI client (4 documentation tools + 31 Google Tag Manager tools). Each tool is tied to one specific Tag Manager OAuth scope. The table below lists which scope each tool uses, so a user or reviewer can verify the Server never requests broader access than a registered tool actually needs.
Scopes are requested together during the initial OAuth consent so the user isn't prompted repeatedly; at runtime, each tool only exercises the single scope listed for it.
These tools search and read taggingdocs.com content. They do not touch any Google API and are available without authentication.
| Tool | Purpose |
|---|---|
search_taggingdocs | Full-text search across TaggingDocs articles. |
read_taggingdocs_page | Fetch a single article by slug. |
list_taggingdocs_sections | Browse the library by section. |
lookup_event | Look up a GA4 event spec (e.g. purchase). |
https://www.googleapis.com/auth/tagmanager.readonlyRead-only access. List and fetch GTM resources without modifying them. Needed for audits, reporting, and any "show me" request from the AI.
| Tool | Purpose |
|---|---|
list_accounts | List GTM accounts the user has access to. |
list_containers, get_container | List / read container metadata. |
list_workspaces, get_workspace, get_workspace_status | List / read workspaces and pending changes. |
list_tags, get_tag | List / read tag configurations. |
list_triggers, get_trigger | List / read trigger configurations. |
list_variables, get_variable | List / read user-defined variables. |
list_folders | List folders in a workspace. |
list_versions | List container versions. |
list_built_in_variables | List enabled built-in variables. |
list_templates | List custom tag and variable templates. |
https://www.googleapis.com/auth/tagmanager.edit.containersCreate, update, and delete GTM resources within a container. Needed whenever the user asks the AI to make changes to a workspace.
| Tool | Purpose |
|---|---|
create_container | Create a new container in an account. |
create_workspace | Create a workspace to stage changes in. |
create_tag, update_tag, delete_tag | Create / update / delete a tag. |
create_trigger, update_trigger, delete_trigger | Create / update / delete a trigger. |
create_variable, update_variable, delete_variable | Create / update / delete a variable. |
create_folder | Create a folder for organization. |
https://www.googleapis.com/auth/tagmanager.edit.containerversionsFreeze a workspace's staged changes into a numbered container version that can be reviewed before publishing.
| Tool | Purpose |
|---|---|
create_version | Freeze the current workspace into a version. |
https://www.googleapis.com/auth/tagmanager.publishPublish a container version (go live). Only invoked when the user explicitly asks the AI to publish.
| Tool | Purpose |
|---|---|
publish_version | Publish the specified version so it goes live for site visitors. |
https://www.googleapis.com/auth/tagmanager.manage.usersRead account-level user permissions. Used by the container audit prompt to surface access / governance issues.
| Tool | Purpose |
|---|---|
list_user_permissions | List users with access to the account and their permission level. |
https://www.googleapis.com/auth/tagmanager.manage.accountsRead account-level settings. Requested alongside manage.users so audit prompts can see the full account context in a single grant. Not used to create or modify accounts.
openid and emailUsed only to identify the user's session via their Google email address after the initial OAuth flow. No profile data beyond the email is fetched or stored. Details in the Privacy Policy.
tagmanager.edit.containers.tagmanager.edit.containerversions) and, when the user explicitly approves, publishing (tagmanager.publish).