# Google Business Profile MCP (npm · mcp-google-business)

MCP server for Google Business Profile: locations, reviews, local posts and performance metrics.

- Trust score: 67/100 (medium)
- Change this week: +29
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-19

## Components

- npm · `mcp-google-business`: 67/100 (this document), [markdown](https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business.md), [page](https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business)

## Channel facts

- Registry: `npm`
- Package: `mcp-google-business`
- Version: `1.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-19.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 68/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4319 tokens (~215/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add a1-x-tech-mcp-google-business -- npx -y mcp-google-business
```

### Codex

```bash
codex mcp add a1-x-tech-mcp-google-business -- npx -y mcp-google-business
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "a1-x-tech-mcp-google-business": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-google-business"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add a1-x-tech-mcp-google-business --command npx --arg -y --arg mcp-google-business
```

### Hermes

```yaml
mcp_servers:
  a1-x-tech-mcp-google-business:
    command: "npx"
    args: ["-y", "mcp-google-business"]
```

### Other

```json
{
  "mcpServers": {
    "a1-x-tech-mcp-google-business": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-google-business"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 67, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-18 (score 52, +14)

- [security regression] Malware scan: pass → unverified
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100
- [functional] Package version: 1.0.0 → 1.1.0

### 2026-08-15 (score 38, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-08-14 (score 38, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-08-11 (score 38, 0)

- [functional] Package version: 0.1.0 → 1.0.0
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-09 (score 38)

First indexed and scored.

## MCP tools (20)

### `list_accounts` (~183 tokens)

List Business Profile accounts

Lists all Google Business Profile accounts the authenticated user can access (the personal account first). Each account has name (accounts/{id} — the id feeds the accountId of other tools), accountName, type (PERSONAL / LOCATION_GROUP / USER_GROUP / ORGANIZATION), role, and verificationState. The API caps pageSize at 20 (unusually small), so follow nextPageToken to see every account.

Input parameters:

- `filter` (string): Filter expression, e.g. "type=USER_GROUP". Omit to list every account.
- `pageSize` (integer): Accounts per page (1..20 — the API's hard cap; default 20).
- `pageToken` (string): nextPageToken from the previous page.
- `parentAccount` (string): Account id or accounts/{id}: list this account's sub-accounts instead of top-level ones.

### `list_locations` (~261 tokens)

List locations of an account

Lists the business locations under an account (Business Information API). Each location's name is locations/{id} — that id feeds locationId everywhere else (including the Performance API and, together with the account id, the v4 reviews/posts tools). totalSize is only present when filter is set. Fields are limited by readMask; ask for metadata to get mapsUri/placeId/newReviewUri.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123" (get it from list_accounts).
- `filter` (string): Filter expression, e.g. 'title="Coffee Corner"'. Also enables totalSize in the response.
- `orderBy` (string): Sort order, e.g. "title" or "title, storeCode desc".
- `pageSize` (integer): Locations per page (1..100; default 10).
- `pageToken` (string): nextPageToken from the previous page.
- `readMask` (string): Comma-separated FieldMask of Location fields to return, e.g. "name,title,storefrontAddress,regularHours,metadata". The API requires it; omit to use the default "name,title,storefrontAddress,phoneNumb…

### `get_location` (~180 tokens)

Get a location

Returns one location by id (Business Information API; v1 uses the bare locations/{id} name, no account prefix). The readMask picks which fields come back: title, categories, storefrontAddress, phoneNumbers, websiteUri, regularHours, specialHours, openInfo, profile (description), storeCode, latlng, metadata (mapsUri, newReviewUri, placeId).

Input parameters:

- `locationId` (string, required): Location id — bare "123", "locations/123" or "accounts/1/locations/123" all work.
- `readMask` (string): Comma-separated FieldMask of Location fields to return, e.g. "name,title,storefrontAddress,regularHours,metadata". The API requires it; omit to use the default "name,title,storefrontAddress,phoneNumb…

### `update_location` (~196 tokens)

Update a location

Updates fields of a location (PATCH with a required updateMask — only masked fields change). Pass the new values in `location`, e.g. {"title": "New name"} with updateMask "title". Set validateOnly to check the change without applying it. Note: every profile has a hard cap of 10 edits per minute (not raisable) — batch your changes into one call where possible. Returns the updated Location.

Input parameters:

- `location` (object, required): Location object with the new field values (only fields named in updateMask are applied).
- `locationId` (string, required): Location id — bare "123", "locations/123" or "accounts/1/locations/123" all work.
- `updateMask` (string, required): Comma-separated FieldMask of the fields to overwrite, e.g. "title,phoneNumbers.primaryPhone".
- `validateOnly` (boolean): If true, validate the update without applying it.

### `list_categories` (~207 tokens)

Search business categories

Lists/searches the reference taxonomy of business categories (e.g. gcid:restaurant). Category names (categories/gcid:...) feed location.categories on update_location and categoryName on list_attribute_metadata. view=FULL also returns serviceTypes and moreHoursTypes per category; filter narrows by display name, e.g. "displayName=coffee".

Input parameters:

- `filter` (string): Filter, e.g. "displayName=coffee".
- `languageCode` (string, required): BCP 47 language for display names, e.g. "en".
- `pageSize` (integer): Categories per page (1..100; default 100).
- `pageToken` (string): nextPageToken from the previous page.
- `regionCode` (string, required): ISO 3166-1 alpha-2 country code the categories should be valid in, e.g. "US".
- `view` (string): BASIC (default) returns name + displayName; FULL adds serviceTypes and moreHoursTypes.

### `list_attribute_metadata` (~230 tokens)

List available attributes

Lists which attributes (e.g. wheelchair accessibility, wi-fi, payment options) are legal for a location or for a category+region. Pass locationId for a concrete location, OR categoryName+regionCode to explore. Each entry has parent (the attribute id for update_location_attributes), valueType (BOOL / ENUM / REPEATED_ENUM / URL), displayName, repeatable and valueMetadata (legal values).

Input parameters:

- `categoryName` (string): Category, e.g. "gcid:restaurant" or "categories/gcid:restaurant".
- `languageCode` (string): BCP 47 language for display names.
- `locationId` (string): Location id to list attributes for (alternative to categoryName+regionCode).
- `pageSize` (integer): Attributes per page (default 200).
- `pageToken` (string): nextPageToken from the previous page.
- `regionCode` (string): ISO 3166-1 alpha-2 country code (with categoryName).
- `showAll` (boolean): Return the whole attribute catalog (requires regionCode + languageCode).

### `update_location_attributes` (~193 tokens)

Update location attributes

Updates attributes of a location (PATCH). Each attribute needs its name (attributes/{attribute_id} from list_attribute_metadata's parent field) plus values (BOOL/ENUM), uriValues (URL) or repeatedEnumValue ({setValues, unsetValues}). attributeMask defaults to the names of the attributes you pass; name an attribute in the mask with no values to clear it. Counts against the 10 edits/min per-profile cap.

Input parameters:

- `attributeMask` (string): Comma-separated attribute names to update. Defaults to the names of `attributes`.
- `attributes` (array, required): Attribute objects to set, e.g. [{"name": "attributes/wi_fi", "repeatedEnumValue": {"setValues": ["free_wi_fi"]}}].
- `locationId` (string, required): Location id — bare "123", "locations/123" or "accounts/1/locations/123" all work.

### `search_chains` (~98 tokens)

Search chains

Searches business chains by name (exact/partial/fuzzy), ranked by relevance. Each chain has name (chains/{chain_id}), chainNames, websites and locationCount. Use the chain name when relating a location to its brand (location.relationshipData).

Input parameters:

- `chainName` (string, required): Chain name to search for, e.g. "walmart".
- `pageSize` (integer): Matches to return (1..500; default 10).

### `get_daily_metrics` (~206 tokens)

Daily metric time series

Returns a daily time series for ONE performance metric of a location: impressions by surface (Maps/Search × desktop/mobile), direction requests, call clicks, website clicks, conversations, bookings, food orders or menu clicks. Response: timeSeries.datedValues[] of {date{year,month,day}, value} — value is int64 serialized as a string; a missing value means no data for that day. Metrics for the most recent days are not available immediately (multi-day lag, typically a few days) — empty values near today are normal, not an error.

Input parameters:

- `dailyMetric` (string, required): The metric to fetch.
- `endDate` (string, required): Range end (inclusive), e.g. 2026-07-31.
- `locationId` (string, required): Location id from list_locations (the unobfuscated listing id; locations/123 also works).
- `startDate` (string, required): Range start (inclusive), e.g. 2026-07-01.

### `fetch_multi_daily_metrics` (~200 tokens)

Multiple daily metrics at once

Returns daily time series for SEVERAL performance metrics of a location in one call — same data as get_daily_metrics, but batched. Response: multiDailyMetricTimeSeries[].dailyMetricTimeSeries[] of {dailyMetric, timeSeries.datedValues[]}; values are int64 strings. Prefer this over several get_daily_metrics calls to save quota. Metrics for the most recent days are not available immediately (multi-day lag, typically a few days) — empty values near today are normal, not an error.

Input parameters:

- `dailyMetrics` (array, required): The metrics to fetch (one or more).
- `endDate` (string, required): Range end (inclusive), e.g. 2026-07-31.
- `locationId` (string, required): Location id from list_locations (the unobfuscated listing id; locations/123 also works).
- `startDate` (string, required): Range start (inclusive), e.g. 2026-07-01.

### `list_search_keyword_impressions` (~193 tokens)

Monthly search keywords

Returns the search keywords that surfaced the business on Google, month by month. Response: searchKeywordsCounts[] of {searchKeyword, insightsValue} — insightsValue is a UNION: either an exact {value} or a {threshold} for low-volume keywords (the true count is below it; never sum thresholds as exact counts). Months are calendar months; data for the current month appears with a lag.

Input parameters:

- `endMonth` (string, required): Last month (inclusive), e.g. 2026-06.
- `locationId` (string, required): Location id from list_locations (the unobfuscated listing id; locations/123 also works).
- `pageSize` (integer): Keywords per page (1..100; default 100).
- `pageToken` (string): nextPageToken from the previous page.
- `startMonth` (string, required): First month (inclusive), e.g. 2026-01.

### `list_reviews` (~218 tokens)

List reviews

Lists reviews of a location, newest-updated first by default. Response: reviews[] of {name, reviewId, reviewer{displayName, isAnonymous}, starRating (ONE..FIVE enum, not a number), comment, createTime, updateTime, reviewReply{comment, updateTime} if answered}, plus averageRating (1–5) and totalReviewCount. pageSize caps at 50. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `orderBy` (string): Sort order; default "updateTime desc".
- `pageSize` (integer): Reviews per page (1..50 — API cap; default 50).
- `pageToken` (string): nextPageToken from the previous page.

### `get_review` (~137 tokens)

Get a review

Returns one review by id — same shape as a list_reviews entry (starRating is an enum ONE..FIVE, reviewReply present only if the business already answered). Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `reviewId` (string, required): Review id (from list_reviews `reviewId` or `name`).

### `reply_to_review` (~188 tokens)

Reply to a review

Creates OR replaces the business's public reply to a review (PUT upsert — there is no separate create, and calling it again overwrites the previous reply). Only works on verified locations. Returns the ReviewReply {comment, updateTime}. Counts against the 10 edits/min per-profile cap. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `comment` (string, required): The public reply text (plain text; keep it concise — very long replies may be rejected).
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `reviewId` (string, required): Review id (from list_reviews `reviewId` or `name`).

### `delete_review_reply` (~129 tokens)

Delete a review reply

Deletes the business's reply to a review (the review itself is the customer's and cannot be deleted). Empty response on success. Reviews live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `reviewId` (string, required): Review id (from list_reviews `reviewId` or `name`).

### `list_local_posts` (~177 tokens)

List local posts

Lists the local posts (What's New / Event / Offer updates shown on the Business Profile) of a location. Each post has name (accounts/*/locations/*/localPosts/{post_id}), summary, topicType, state (LIVE / PROCESSING / REJECTED), searchUrl, createTime and updateTime. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `pageSize` (integer): Posts per page (default 20).
- `pageToken` (string): nextPageToken from the previous page.

### `create_local_post` (~320 tokens)

Create a local post

Publishes a new local post on the Business Profile. Pass the LocalPost as `post`. LocalPost fields: languageCode; summary (the post text); topicType (STANDARD | EVENT | OFFER | ALERT); callToAction {actionType: BOOK | ORDER | SHOP | LEARN_MORE | SIGN_UP | CALL, url}; event {title, schedule{startDate{year,month,day}, startTime{hours,minutes}, endDate, endTime}} — required for EVENT and OFFER; offer {couponCode, redeemOnlineUrl, termsConditions}; media [{mediaFormat: "PHOTO", sourceUrl}]. ALERT posts are restricted to Google-initiated campaigns and are typically rejected. Returns the created post with its name and state (a fresh post is usually PROCESSING before it goes LIVE). Counts against the 10 edits/min per-profile cap. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `post` (object, required): The LocalPost to create, e.g. {"languageCode": "en", "topicType": "STANDARD", "summary": "Fresh croissants every morning!", "callToAction": {"actionType": "LEARN_MORE", "url": "https://example.com"}}.

### `update_local_post` (~323 tokens)

Update a local post

Updates fields of an existing local post (PATCH with a required updateMask — only masked fields change, e.g. updateMask "summary" with post {"summary": "New text"}). LocalPost fields: languageCode; summary (the post text); topicType (STANDARD | EVENT | OFFER | ALERT); callToAction {actionType: BOOK | ORDER | SHOP | LEARN_MORE | SIGN_UP | CALL, url}; event {title, schedule{startDate{year,month,day}, startTime{hours,minutes}, endDate, endTime}} — required for EVENT and OFFER; offer {couponCode, redeemOnlineUrl, termsConditions}; media [{mediaFormat: "PHOTO", sourceUrl}]. ALERT posts are restricted to Google-initiated campaigns and are typically rejected. Returns the updated post. Counts against the 10 edits/min per-profile cap. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `post` (object, required): Partial LocalPost with the new field values.
- `postId` (string, required): Local post id (last segment of the post's `name`).
- `updateMask` (string, required): Comma-separated FieldMask of post fields to overwrite, e.g. "summary,callToAction".

### `delete_local_post` (~118 tokens)

Delete a local post

Deletes a local post from the Business Profile. Empty response on success. Local posts live only on the legacy v4 API (mybusiness.googleapis.com) — they were never migrated to v1.

Input parameters:

- `accountId` (string, required): Account id — bare "123" or "accounts/123".
- `locationId` (string, required): Location id — bare "456", "locations/456" or "accounts/1/locations/456".
- `postId` (string, required): Local post id (last segment of the post's `name`).

### `raw_request` (~218 tokens)

Raw Google Business Profile API call

Escape hatch to call any Google Business Profile endpoint directly, for endpoints without a dedicated tool. `service` picks the host: accounts (mybusinessaccountmanagement, v1), businessinfo (mybusinessbusinessinformation, v1), performance (businessprofileperformance, v1) or v4 (legacy mybusiness.googleapis.com — reviews, posts, media). `path` is relative to the host, e.g. "v1/accounts" or "v4/accounts/1/locations/2/media". Remember v1 quirks: readMask/updateMask go in `query`. The Bearer token is attached automatically; a path resolving to a foreign origin is rejected.

Input parameters:

- `body` (object): JSON request body (POST/PUT/PATCH).
- `method` (string): HTTP method; defaults to GET.
- `path` (string, required): API path relative to the host, e.g. "v1/accounts".
- `query` (object): Query parameters (arrays become repeated params).
- `service` (string, required): Which API host to call.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business#diagnostics

## Score history

- 2026-08-19: 67
- 2026-08-18: 52
- 2026-08-17: 38
- 2026-08-16: 38
- 2026-08-15: 38
- 2026-08-14: 38
- 2026-08-13: 38
- 2026-08-12: 38
- 2026-08-11: 38
- 2026-08-10: 38
- 2026-08-09: 38

## Links

- npm package: https://www.npmjs.com/package/mcp-google-business
- Socket report: https://socket.dev/npm/package/mcp-google-business
- Repository: https://github.com/A1-x-Tech/mcp-google-business
- Changelog RSS feed: https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business.xml
- Changelog JSON feed: https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business.json
- HTML version of this page: https://verifymcp.io/servers/a1-x-tech-mcp-google-business/mcp-google-business