# MCP stack inventory: Acme Co (production)

Fictional example of a filled `assets/stack-inventory-template.md`. It passes `python3 -I scripts/mcp_inventory_check.py assets/example-acme-inventory.md --as-of 2026-11-01`.

- Prepared: 2026-11-01 by the marketing ops lead with an agent run
- Review by: 2026-12-01
- Jobs: weekly wholesale pipeline review (HubSpot, deal 1001); weekly paid media review (Google Ads and Meta Ads, closed week spend); monthly flow review (Klaviyo, Welcome flow delivered count); trial-to-first-order funnel (Mixpanel, saved report); weekly traffic check (GA4, sessions for one closed day); weekly SEO review (Search Console bulk export in BigQuery, weekly web clicks)
- Clients: Claude Code signed in with the company subscription; Claude Desktop and claude.ai (Team workspace); ChatGPT Business workspace; Cursor; Codex
- Scanner: 2026-11-01 on the six collected configs, 11 FAIL, 9 WARN, 3 INFO, 9 PASS; after the changes, 0 FAIL, 0 WARN, 2 INFO, 6 PASS
- Status: draft until each tool owner approves

## Summary

- Connected and tested: 8 (7 servers; HubSpot in two clients)
- Read-only by vendor switch: 3 (Klaviyo, GA4, Google Ads); by source permission: 4 (HubSpot in Claude Code and in the Team workspace, Mixpanel, Meta Ads); by IAM or role: 1 (BigQuery); client only: 0
- Failed or blocked: none
- Open risks: GA4 identity reaches two extra properties (T1 WARN, removal requested 2026-10-28); the Google Ads credential carries the full adwords scope and is recorded as write-capable

## Servers

### HubSpot (portal 1234567, production, Claude Code)

- Status: connected
- Job: weekly wholesale pipeline review; known answer is deal 1001 (owner, stage Negotiation, amount 12,000 USD, close date 2026-11-20)
- Route: official remote; reason: HubSpot publishes https://mcp.hubspot.com, so the contractor's third-party bridge failed the lookalike rule and was removed
- Endpoint or package: https://mcp.hubspot.com through the HubSpot connector in the Team workspace, inherited by Claude Code
- Clients and config: Claude Code signed in with the company subscription inherits the Team workspace connector (tools named mcp__claude_ai_HubSpot__*, read from /mcp); deny rules in ~/.claude/settings.json; approved for customer data in decisions.md on 2026-09-15
- Identity: the wholesale ops lead's own HubSpot user; role at the source: View-only CRM permissions with Create off
- Reachable accounts: 1 portal (1234567)
- Granted scopes or permissions: get_user_details on 2026-10-29 showed CRM read for contacts, companies and deals, no Super Admin; data permissions set by the Super Admin at install
- Read-only layer: source permission: View-only user with Create off, plus the deny rules mcp__claude_ai_HubSpot__manage_* and mcp__claude_ai_HubSpot__submit_feedback; proof: T2 tool list compared and the write tools not available to the agent in T4
- Write tools and how they are blocked: manage_crm_objects, manage_segment, manage_custom_properties, manage_custom_pipelines, manage_campaign_objects, manage_marketing_email, manage_landing_page, manage_website_page, manage_blog_post, manage_aeo_prompts, manage_aeo_recommendations, submit_feedback; one glob deny rule covers every manage_* tool, replacing the per-tool list that missed the two manage_aeo_* tools on 2026-11-01 (drift D01)
- Untrusted-content and send-out tools: U: search_conversations and CRM notes returned by search_crm_objects; S: none enabled in this profile
- Limits and meters: search_crm_objects returns 200 results per page with 5 filter groups of 6 filters; get_crm_objects takes 100 IDs per call
- Tests:
  - T1 identity: PASS 2026-10-29, get_user_details then get_organization_details returned portal 1234567 and the wholesale ops lead's user
  - T2 tool surface: PASS 2026-11-01, 24 tools in /mcp after the glob deny rule; every write tool blocked; snapshot mcp-tools/hubspot-acme-prod-ro-claude-code-2026-11-01.json
  - T3 known answer: PASS 2026-10-28, deal 1001 owner, stage Negotiation, amount 12,000 USD, close date and record link match the record in HubSpot
  - T4 denied operation: PASS 2026-10-29, a deal owned by the retail team returned nothing and no substitute; manage_crm_objects not available to the agent (deny rule), so no write was attempted; the rule checked in /permissions
  - T5 completeness: PASS 2026-10-29, a search over 340 open deals stated 2 pages read and none remaining
  - T6 revocation: the wholesale ops lead disconnects the connector and the HubSpot Super Admin uninstalls the connected app; disconnected and reconnected on 2026-10-30
- Owner: wholesale ops lead
- Revoke by: disconnect the connector in Customize > Connectors, then the Super Admin uninstalls the HubSpot connected app (confirm the menu path in HubSpot at the time)
- Next review: 2026-11-28
- Agent access line for stack.md: HubSpot remote MCP in Claude Code through the Team workspace connector; View-only user plus glob deny rules; tested 2026-11-01

### HubSpot (portal 1234567, production, Claude Desktop and claude.ai Team workspace)

- Status: connected
- Job: weekly wholesale pipeline review; known answer is deal 1001 (owner, stage Negotiation, amount 12,000 USD, close date 2026-11-20)
- Route: official remote; reason: the HubSpot directory connector in the Team workspace, tested on its own because tools and validation differ per client
- Endpoint or package: https://mcp.hubspot.com, the HubSpot directory connector
- Clients and config: Claude Desktop and claude.ai, Team workspace connector added by the workspace owner; tool permissions enforced for the organization; approved for customer data in decisions.md on 2026-09-15
- Identity: the wholesale ops lead's own HubSpot user; role at the source: View-only CRM permissions with Create off
- Reachable accounts: 1 portal (1234567)
- Granted scopes or permissions: the same OAuth grant as the Claude Code block; get_user_details on 2026-10-30 showed CRM read for contacts, companies and deals
- Read-only layer: source permission: View-only user with Create off, plus the write and delete category Blocked for the organization; proof: T2 tool list compared and the write tools not available to the agent in T4
- Write tools and how they are blocked: every manage_* tool and submit_feedback, in the Blocked write and delete category; manage_aeo_prompts and manage_aeo_recommendations fell into the Blocked category when they appeared
- Untrusted-content and send-out tools: U: search_conversations and CRM notes; S: none enabled in this workspace
- Limits and meters: 200 results per page; bulk create or update capped at 10 records (writes are blocked anyway)
- Tests:
  - T1 identity: PASS 2026-10-30, get_user_details then get_organization_details returned portal 1234567 and the wholesale ops lead's user
  - T2 tool surface: PASS 2026-11-01, 25 tools, including render_asset, which Claude Code does not list; every write tool in the Blocked category; snapshot mcp-tools/hubspot-acme-prod-ro-team-workspace-2026-11-01.json
  - T3 known answer: PASS 2026-10-30, deal 1001 owner, stage Negotiation, amount 12,000 USD, close date and record link match the record in HubSpot
  - T4 denied operation: PASS 2026-10-29, manage_crm_objects not available to the agent (Blocked category), so no write was attempted; a deal owned by the retail team returned nothing
  - T5 completeness: PASS 2026-10-30, a search over 340 open deals stated 2 pages read and none remaining
  - T6 revocation: the wholesale ops lead disconnects in Customize > Connectors; the workspace owner can remove the connector for the organization; the Super Admin uninstalls the connected app; disconnected and reconnected on 2026-10-30
- Owner: wholesale ops lead
- Revoke by: disconnect the connector, then the workspace owner removes it in Organization settings > Connectors if no one else needs it; the Super Admin uninstalls the HubSpot connected app (confirm the paths at the time)
- Next review: 2026-11-29
- Agent access line for stack.md: HubSpot remote MCP in the Team workspace; View-only user plus the Blocked write and delete category; tested 2026-10-30

### Klaviyo (account Acme Co, production, ChatGPT Business workspace)

- Status: connected
- Job: monthly flow review; known answer is the Welcome flow's delivered count for September 2026 (8,000)
- Route: official remote; reason: a custom MCP server in the ChatGPT Business workspace accepts the read-only URL parameters, which the listed app ignores
- Endpoint or package: https://mcp.klaviyo.com/mcp?read-only=true&disable-tools-with-user-generated-content=true
- Clients and config: ChatGPT Business workspace, custom MCP server klaviyo-acme-prod-ro created as a plugin by the workspace admin; approved for customer data in decisions.md on 2026-09-15; the shared project entry without read-only and the personal Claude Code entry were removed, so one definition serves the job
- Identity: the lifecycle manager's own Klaviyo login; role at the source: Manager, the lowest role Klaviyo lets connect
- Reachable accounts: 1 account (Acme Co)
- Granted scopes or permissions: the scopes on the OAuth consent screen on 2026-10-27, saved with the change ticket; write tools removed by read-only=true
- Read-only layer: vendor switch: read-only=true and disable-tools-with-user-generated-content=true on a custom connection; proof: the T2 tool list shows no write tools
- Write tools and how they are blocked: none listed; the workspace setting for tools added later stays off until reviewed
- Untrusted-content and send-out tools: U: none (user-generated-content tools disabled); S: none
- Limits and meters: paginate-lists left off, because it pages the tool list, not results; list answers must state their coverage
- Tests:
  - T1 identity: PASS 2026-10-27, get_account_details returned account Acme Co
  - T2 tool surface: PASS 2026-10-27, no write tools listed; snapshot mcp-tools/klaviyo-acme-prod-ro-chatgpt-2026-10-27.json
  - T3 known answer: PASS 2026-10-27, get_flow_report for the Welcome flow in September 2026 returned 8,000 delivered, matching the flow report in Klaviyo
  - T4 denied operation: PASS 2026-10-27, write tools are absent from the T2 tool list, so no write was attempted; a request for a test profile's details found no profile tool (user-generated-content tools disabled) and the answer said so instead of substituting
  - T5 completeness: PASS 2026-10-28, a list of all flows returned 46 flows, the count on the Flows page, and said it covered every flow
  - T6 revocation: the workspace admin disables the plugin and the lifecycle manager disconnects; disconnected and reconnected on 2026-10-28
- Owner: lifecycle manager
- Revoke by: the workspace admin disables the plugin in the Admin console; the Klaviyo owner removes the app authorisation (confirm the path in Klaviyo at the time)
- Next review: 2026-11-26
- Agent access line for stack.md: Klaviyo remote MCP in ChatGPT, custom connection with read-only=true; tested 2026-10-27

### Mixpanel (project 7654321, EU, production, Cursor)

- Status: connected
- Job: trial-to-first-order funnel; known answer is the saved report Trial to first order for 2026-10-01 to 2026-10-25 (1,240 users entered)
- Route: official remote; reason: Mixpanel's EU endpoint matches the project's data residency, replacing the US endpoint behind a proxy wrapper
- Endpoint or package: https://mcp-eu.mixpanel.com/mcp
- Clients and config: Cursor, global ~/.cursor/mcp.json, native url entry mixpanel-acme-prod-ro
- Identity: the product analyst's own Mixpanel login; role at the source: a project role without write access, read from the project's user list on 2026-10-29
- Reachable accounts: 1 organization with 2 projects (production and the test project)
- Granted scopes or permissions: Get-Projects returned the production project (EU) and the test project; existing project permissions apply
- Read-only layer: source permission: project role without write access, plus Cursor's approval prompt with no MCP tool allowlisted; proof: the T4 write denied in the test project
- Write tools and how they are blocked: the dashboard create, update, duplicate and delete tools, Edit-Event, Edit-Property, the bulk edit and tag tools, Dismiss-Issues and the other create and update tools; denied by the role (marked denied_by role in the snapshot) and never allowlisted
- Untrusted-content and send-out tools: U: none expected; S: none
- Limits and meters: 600 MCP requests per hour per user; Run-Query cannot filter or break down by cohort
- Tests:
  - T1 identity: PASS 2026-10-29, Get-Projects returned project 7654321 with EU residency
  - T2 tool surface: PASS 2026-10-29, write tools listed and denied by the role; snapshot mcp-tools/mixpanel-acme-prod-ro-cursor-2026-10-29.json
  - T3 known answer: PASS 2026-10-29, Get-Report on Trial to first order for 2026-10-01 to 2026-10-25 returned 1,240 users entered, matching the saved report
  - T4 denied operation: PASS 2026-10-29, Create-Dashboard in the test project was rejected for missing permission, with the same project role in production and in the test project; the audit log shows no entry with Origin MCP; a project outside the organization returned an error
  - T5 completeness: PASS 2026-10-30, a cohort breakdown request stated the Run-Query cohort limitation instead of substituting another breakdown
  - T6 revocation: the product analyst removes the entry and signs out; the Mixpanel org admin can switch MCP off for the organization; disconnected and reconnected on 2026-10-30
- Owner: product analyst
- Revoke by: remove mixpanel-acme-prod-ro from ~/.cursor/mcp.json and sign out; the org admin switches MCP off in the organization's AI settings (confirm the path in Mixpanel at the time)
- Next review: 2026-11-28
- Agent access line for stack.md: Mixpanel remote MCP in Cursor, EU endpoint; role without write access; tested 2026-10-29

### GA4 (property 123456789, production, Claude Code)

- Status: connected
- Job: weekly traffic check; known answer is sessions for 2026-10-25 (1,904)
- Route: official local; reason: Google publishes no remote GA4 server, and the ops lead works in Claude Code
- Endpoint or package: pipx run --spec analytics-mcp==1.0.0 analytics-mcp (fictional pin), started without --allow-write
- Clients and config: Claude Code, user scope, ga4-acme-prod-ro; the shared project entry with --allow-write and a credential file inside the repository was removed
- Identity: the ops lead's Google account through application default credentials at the default location; role at the source: Viewer on the property
- Reachable accounts: property 123456789 plus two other properties (an old staging property and a partner property)
- Granted scopes or permissions: analytics.readonly and cloud-platform, as listed on the Google consent screen at login on 2026-10-28; recorded as sensitive because cloud-platform is broad
- Read-only layer: vendor switch: the server started without --allow-write, with an analytics.readonly credential; proof: create_property_annotation is absent from the T2 tool list
- Write tools and how they are blocked: create_property_annotation, absent because the server runs without --allow-write
- Untrusted-content and send-out tools: U: none; S: none
- Limits and meters: on a standard property, 200,000 core tokens per property per day, 40,000 per hour, 14,000 per project per property per hour and 10 concurrent requests; property quotas count every project and credential that reads the property
- Tests:
  - T1 identity: WARN 2026-10-28, get_account_summaries listed property 123456789 and two more, because the ops lead's Google account also reaches an old staging property and a partner property; removal requested from the GA4 admin
  - T2 tool surface: PASS 2026-10-28, 8 tools, create_property_annotation absent; snapshot mcp-tools/ga4-acme-prod-ro-claude-code-2026-10-28.json
  - T3 known answer: PASS 2026-10-29, sessions for 2026-10-25 with no breakdown returned 1,904 in run_report and in the GA4 report
  - T4 denied operation: PASS 2026-10-29, a property the account is not shared on returned a permission error; no write tool exists to test
  - T5 completeness: PASS 2026-10-29, a landing page report with a 100-row limit stated that it showed the top 100 rows
  - T6 revocation: the ops lead revokes the application default credentials and removes the server; done and redone on 2026-10-30
- Owner: web analytics lead
- Revoke by: gcloud auth application-default revoke, remove ga4-acme-prod-ro, and delete the credential file from the laptop at offboarding
- Next review: 2026-11-27
- Agent access line for stack.md: GA4 local MCP in Claude Code without --allow-write, analytics.readonly credential; tested 2026-10-29

### Google Ads (customer 123-456-7890, production, Codex)

- Status: connected
- Job: weekly paid media review; known answer is cost, clicks and impressions for 2026-10-19 to 2026-10-25
- Route: official local; reason: Google's server with its write tools off, and the paid media lead works in Codex
- Endpoint or package: pipx run --spec git+https://github.com/googleads/google-ads-mcp.git@1a2b3c4 google-ads-mcp (fictional commit)
- Clients and config: Codex, user ~/.codex/config.toml, google-ads-acme-prod-ro with GOOGLE_ADS_MCP_TOOLS_CONFIG, an enabled_tools allowlist of the 3 read tools and default_tools_approval_mode writes
- Identity: the paid media lead's Google account with an OAuth client owned by the Cloud project acme-ads-mcp, consent screen set to Internal; role at the source: Standard access through manager 000-000-0000, kept because this is the paid media lead's own login for daily work; a dedicated identity would get Read-only access
- Reachable accounts: customer 1234567890 through login customer 0000000000
- Granted scopes or permissions: https://www.googleapis.com/auth/adwords, the full scope, recorded as write-capable
- Read-only layer: vendor switch: a tools config with labels: false and assets: false leaves customers_list_accessible_customers, search_search and metadata_get_resource_metadata; proof: the T2 tool list
- Write tools and how they are blocked: assets_create_asset, assets_upload_video_asset, labels_manage_labels and labels_manage_label_associations are absent with that config; the credential is never reused in scripts
- Untrusted-content and send-out tools: U: search can return search terms and ad copy written by others; S: none
- Limits and meters: money arrives as cost_micros; GAQL results with LIMIT are a top N, not a total
- Tests:
  - T1 identity: PASS 2026-10-28, customers_list_accessible_customers returned 1234567890 under login customer 0000000000
  - T2 tool surface: PASS 2026-10-28, 3 read tools; snapshot mcp-tools/google-ads-acme-prod-ro-codex-2026-10-28.json
  - T3 known answer: PASS 2026-10-29, GAQL for 2026-10-19 to 2026-10-25 returned cost_micros 2345670000 (2,345.67 USD), 1,850 clicks and 64,200 impressions, matching the Google Ads UI in America/New_York and USD
  - T4 denied operation: PASS 2026-10-29, a customer ID outside the manager returned a permission error; the four write tools are absent from the list
  - T5 completeness: PASS 2026-10-29, a search term query with LIMIT 50 stated it was the top 50 by cost, not a total
  - T6 revocation: the paid media lead removes the server and revokes the OAuth grant in the Google account; done on 2026-10-30
- Owner: paid media lead
- Revoke by: remove google-ads-acme-prod-ro from config.toml, revoke the app's access in the Google account settings (confirm the path at the time) and delete local tokens
- Next review: 2026-11-27
- Agent access line for stack.md: Google Ads local MCP in Codex (labels and assets off); adwords credential recorded as write-capable; tested 2026-10-29

### Meta Ads (ad account act_XXXXXXXXX, production, Claude Code)

- Status: connected
- Job: weekly paid social review; known answer is spend, impressions and clicks for 2026-10-19 to 2026-10-25
- Route: official remote; reason: Meta publishes https://mcp.facebook.com/ads, so the community package at @latest with an inline token was removed and its token rotated
- Endpoint or package: https://mcp.facebook.com/ads
- Clients and config: Claude Code, local scope, meta-ads-acme-prod-ro, added with the company's Meta app ID as the OAuth client ID
- Identity: the paid social lead's own Meta login; role at the source: advertiser on the ad account, kept because this is the lead's own login for daily work; the grant without ads_management is the layer
- Reachable accounts: ad account act_XXXXXXXXX and the test ad account
- Granted scopes or permissions: ads_mcp_management and ads_read, read from the app's permission screen; ads_management not granted
- Read-only layer: source permission: a grant without ads_management, plus deny rules for the create, update and activate tools; proof: the T4 rename rejected
- Write tools and how they are blocked: ads_update_entity, ads_activate_entity and the other create and update tools in the client's list; denied by the grant and by deny rules
- Untrusted-content and send-out tools: U: ad copy in entity reads; S: none
- Limits and meters: answers across many ad sets must state paging
- Tests:
  - T1 identity: PASS 2026-10-30, the account tool listed act_XXXXXXXXX and the test ad account; USD and America/New_York confirmed in Ads Manager
  - T2 tool surface: PASS 2026-10-30, write tools listed and denied; snapshot mcp-tools/meta-ads-acme-prod-ro-claude-code-2026-10-30.json
  - T3 known answer: PASS 2026-10-30, spend 3,450.00 USD with impressions and clicks for 2026-10-19 to 2026-10-25 under the account's attribution setting, matching Ads Manager
  - T4 denied operation: PASS 2026-10-30, an ad account outside the grant returned a permission error and no substitute; renaming a paused test ad set in the test ad account was rejected for missing permission, under the same advertiser role and grant as production
  - T5 completeness: PASS 2026-10-31, a request across 60 ad sets stated 3 pages read
  - T6 revocation: the paid social lead logs out of the server and removes it; the business admin removes the app's business integration; done on 2026-10-31
- Owner: paid social lead
- Revoke by: log out of meta-ads-acme-prod-ro, remove it, and the business admin removes the app's business integration (confirm the path in Meta at the time)
- Next review: 2026-11-29
- Agent access line for stack.md: Meta Ads remote MCP in Claude Code with an ads_read grant; tested 2026-10-30

### BigQuery (data project acme-analytics, job project acme-agents, production, Claude Code)

- Status: connected
- Job: weekly SEO review from the Search Console bulk export; known answer is web clicks for 2026-10-19 to 2026-10-25 (4,210)
- Route: export or warehouse; reason: Google publishes no Search Console server, so the bulk export in dataset searchconsole is read through Google's BigQuery server
- Endpoint or package: https://bigquery.googleapis.com/mcp through a custom connector in the Team workspace, inherited by Claude Code
- Clients and config: Claude Code signed in with the company subscription inherits the custom connector bigquery-acme-ro (tools named mcp__claude_ai_bigquery-acme-ro__*, read from /mcp); it uses a Web application OAuth client with the redirect https://claude.ai/api/mcp/auth_callback, because Google accepts no custom redirect; the direct user-scope entry that could not sign in and the VS Code workspace entry that never loaded were removed
- Identity: the SEO lead's Google account; roles at the source: MCP Tool User and BigQuery Job User on acme-agents, BigQuery Data Viewer on datasets searchconsole and marketing_reporting only
- Reachable accounts: data project acme-analytics (2 datasets) and job project acme-agents
- Granted scopes or permissions: https://www.googleapis.com/auth/bigquery
- Read-only layer: IAM or role: a deny policy on MCP tools not marked read-only, applied by the cloud admin on 2026-10-29, plus Data Viewer on approved datasets; proof: execute_sql and cancel_job denied in T4
- Write tools and how they are blocked: execute_sql and cancel_job, denied by the IAM deny policy; both still appear in the tool list and are marked denied_by iam in the snapshot
- Untrusted-content and send-out tools: U: query text in searchdata_url_impression was written by searchers; S: none
- Limits and meters: 3,000 rows per result and three minutes of processing by default; aggregate in SQL
- Tests:
  - T1 identity: PASS 2026-10-29, list_dataset_ids returned searchconsole and marketing_reporting only
  - T2 tool surface: PASS 2026-10-29, 7 tools with execute_sql and cancel_job listed and denied by IAM; snapshot mcp-tools/bigquery-acme-ro-claude-code-2026-10-29.json
  - T3 known answer: PASS 2026-10-30, the sum of clicks from searchdata_site_impression where search_type is web, for data_date 2026-10-19 to 2026-10-25 (Pacific Time), was 4,210, matching the Performance report for sc-domain:example.com with Search type: Web for the same dates
  - T4 denied operation: PASS 2026-10-30, execute_sql with an insert into a disposable table and cancel_job on a made-up job ID were denied by the deny policy, and INFORMATION_SCHEMA.JOBS for the identity lists SELECT jobs only; dataset raw_events was not readable
  - T5 completeness: PASS 2026-10-30, a query-level request aggregated in SQL and stated the 3,000-row cap
  - T6 revocation: the SEO lead disconnects the connector and the cloud admin removes the roles; done on 2026-10-31
- Owner: data lead
- Revoke by: the Team workspace owner removes the bigquery-acme-ro connector, then the cloud admin removes the IAM roles; the deny policy stays in place
- Next review: 2026-11-28
- Agent access line for stack.md: BigQuery remote MCP in Claude Code through the Team workspace connector, with an IAM deny on tools not marked read-only; tested 2026-10-30

## Not connected, by decision

- Search Console community server (open-gsc-mcp at @latest with writes on): replaced by the bulk export read through BigQuery; its login was revoked with auth logout on 2026-10-29
- HubSpot third-party bridge (crm-bridge.example): lookalike host for a vendor with its own server; removed, and the Super Admin revoked its token
- Klaviyo personal Claude Code entry: read-only, but it duplicated the ChatGPT connection for the same job and shadowed the shared entry; removed
- BigQuery direct entry in Claude Code: Google's OAuth accepts only the registered claude.ai callback, so it could not sign in; removed and replaced by the Team workspace connector
- VS Code BigQuery workspace entry: never loaded because the file used mcpServers; removed

## Admin drafts

- BigQuery deny policy on MCP tools not marked read-only: cloud admin, applied 2026-10-29
- BigQuery custom connector with a Web application OAuth client: cloud admin and Team workspace owner, applied 2026-10-29
- Remove the ops lead's access to the two extra GA4 properties: GA4 admin, sent 2026-10-28
- Confirm the HubSpot connector's data permissions, block the write and delete category for the organization and uninstall the bridge app: HubSpot Super Admin and Team workspace owner, applied 2026-10-27
- Create the Klaviyo custom MCP plugin with the read-only URL and keep tools added later off: ChatGPT workspace admin, applied 2026-10-27
- Check that no app authorisation remains from the removed shared Klaviyo entry: Klaviyo owner, sent 2026-10-28

## Proposed updates to martech-context

- stack.md: replace the HubSpot line "via a bridge a contractor set up" with the two HubSpot Agent access lines above, and add the six other Agent access lines
- decisions.md: one dated entry per approved connection naming its client, read-only layer and owner
- mcp-tools/: the eight tool snapshots named in the T2 lines
- README.md: a line under Optional files present naming mcp-inventory.md and mcp-tools/