Ducto

Google Tag Manager

The full container lifecycle, with publish as a governed write

The largest mount in the gateway: 35 tools covering workspaces, tags, triggers, variables, environments, and versions. Your agent can fix tracking end to end — and publishing a container is a write your policy governs like any other.

35 tools18 read17 writemcp.getducto.com/gtm
Connect Google Tag ManagerAll platforms
connect the gtm mount

$ claude mcp add --transport http gtm \

https://mcp.getducto.com/gtm

✓ connected — 35 tools

read-only until you set a policy

What your agent does here

Real Google Tag Manager work, in conversation

Work in real workspaces

Create a workspace, make changes, sync against the live container, and resolve conflicts — the same flow a careful human uses.

gtm_create_workspacegtm_sync_workspacegtm_workspace_statusgtm_revert_item

Manage tags, triggers, and variables

Full create, read, update, and delete across container items, plus built-in variable management.

gtm_create_itemgtm_update_itemgtm_list_itemsgtm_enable_builtin_variables

Ship versions deliberately

Create versions from a workspace, preview them, and publish — with publish gated by preview-before-apply and your approval classes.

gtm_create_versiongtm_quick_previewgtm_publish_versiongtm_get_live_version

Apply proven setups as templates

Preview and apply GA4 + conversion-tracking templates instead of hand-building the same ten tags every time.

list_gtm_templatespreview_gtm_templateapply_gtm_template

Governed writes

How writes are enforced

Publishing to a live site is the highest-blast-radius write in this mount, so it participates fully in preview-before-apply and approval. Destructive tools like workspace deletion carry destructive annotations your policy can gate.

read-only default→caps ← policy row→preview before apply→approval on flagged classes→hash-chained audit

The full request path is on the security architecture page.

Tool reference

Every tool in the gtm mount

Generated from the running gateway's tool registry — this is the complete list, not a highlight reel.

apply_gtm_templatewriteInstall a GTM template into a workspace (DESTRUCTIVE: creates tags/triggers/variables). One guarded connector mutation per entity, in dependency order (built-in variable enables → variables → triggers → tags), each through the same Guard/policy path as every other GTM write. Does NOT create a version or publish — review, then use the version/publish tools. A mid-apply failure returns what was created plus the error (no rollback; the GTM workspace is the undo).
gtm_container_snippetreadGet the install snippet for a container. Cached per connection.
gtm_create_containerwriteCreate a container in an account.
gtm_create_environmentwriteCreate a container environment.
gtm_create_itemwriteCreate a GTM entity (tag/trigger/variable/template/...) in a workspace.
gtm_create_versionwriteCreate a container version from a workspace's changes.
gtm_create_workspacewriteCreate a workspace in a container.
gtm_delete_itemwriteDelete an entity by type + path.
gtm_delete_workspacewriteDelete a workspace.
gtm_disable_builtin_variableswriteDisable built-in variables by type.
gtm_enable_builtin_variableswriteEnable built-in variables by type.
gtm_find_containerreadFind a container by its public id (GTM-XXXX).
gtm_get_containerreadGet a container by path. Cached per connection.
gtm_get_itemreadGet one entity by type + path (returns its fingerprint for merge-safe updates).
gtm_get_live_versionreadGet the currently published (live) container version.
gtm_get_workspacereadGet a workspace by path. Cached per connection.
gtm_list_accountsreadList GTM accounts the connected credential can see.
gtm_list_builtin_variablesreadList enabled built-in variables in a workspace. Cached per connection.
gtm_list_containersreadList containers (optionally within one account path). Cached per connection.
gtm_list_environmentsreadList container environments.
gtm_list_itemsreadList entities (tag/trigger/variable/template/zone/...) in a workspace. Cached.
gtm_list_versionsreadList container versions.
gtm_list_workspacesreadList workspaces in a container. Cached per connection.
gtm_publish_versionwritePublish (go live with) a container version.
gtm_quick_previewreadCompile a workspace quick-preview (validation without publishing).
gtm_revert_itemwriteRevert a workspace entity to its live-container state.
gtm_statusreadReport this token's GTM policy (read-only, approval) and connection health.
gtm_sync_workspacewriteSync a workspace with the latest container version (resolves conflicts).
gtm_update_containerwriteUpdate container settings (merge-safe by default).
gtm_update_environmentwriteUpdate a container environment (merge-safe by default).
gtm_update_itemwriteUpdate an entity (merge-safe by default; pass a fingerprint to guard against races).
gtm_update_workspacewriteRename / re-describe a workspace.
gtm_workspace_statusreadShow a workspace's pending changes vs the live container.
list_gtm_templatesreadList the installable GTM templates (id, name, description, params).
preview_gtm_templatereadValidate params and render the exact tags/triggers/variables a template would create. Pure, offline preview: param patterns are checked and ``{{param:...}}`` placeholders substituted; ``{{trigger:...}}`` references stay symbolic (resolved to real ids only on apply). No network, no writes.
Connect Google Tag Manager