# Choosing the route for each tool How to pick between a vendor server, an export, a reporting bridge and a community server, and how to review a publisher before production data reaches it. Facts checked on 2026-11-01 unless a line says otherwise. ## The route ladder Take the first rung that covers the job. Move down only when the rung above cannot do the job or cannot be made read-only for it. 1. Vendor-hosted remote server. Per-user OAuth, works in web, mobile and cloud-hosted clients, patched by the vendor. Wins whenever it exists and a read-only layer from step 6 applies. Watch for write tools on by default, regional endpoints and vendor IP allowlists. 2. Vendor-published local server. GA4 (Google's only GA4 server), Google Ads (local, or self-hosted by your team), Klaviyo's local server (the strongest Klaviyo read-only layer with a read-scoped key and `READ_ONLY=true`). Costs: credentials on laptops, invisible to web and cloud clients, versions to pin and patch. 3. Export or warehouse path. A governed copy read with a read-only tool: the GTM container export, the Search Console bulk export to BigQuery, the GA4 BigQuery export, ad data already landed by a connector. Wins when no vendor server exists, when the vendor server cannot be made read-only for the job, or when the job needs history, joins or a stable dataset for several people. 4. A reporting bridge the team already licenses, with its write tools off. Wins when the job is cross-channel reporting and the bridge already holds the definitions. 5. A community server that passes the publisher review below. Last, because tokens and tool results pass through code nobody at the vendor reviewed. ## What counts as official - Official: published and operated by the vendor, on the vendor's domain or in the vendor's GitHub organization. - A de facto third-party server is not official, however popular. Stape's GTM server is the common example: Google publishes no Tag Manager server. - Hosted directories that run their own server under a vendor's name are community servers. The listing title proves nothing; the endpoint host does. - Local execution changes where the server runs, not where data goes: tool results still reach the AI provider as part of the conversation. ## Publisher review Run it before a community or third-party server sees production credentials. Every line must pass; any failure means no production connection. Use the export or warehouse route instead, or hand the server to mcp-security-review if it is installed. - Not archived, and at least one commit or release in the last 90 days. - An OSI licence (MIT, Apache-2.0, BSD). - The install command pinned to an exact version or a reviewed commit: no `@latest`, no unpinned `npx -y `, no `git+https` URL without a commit. - Requested scopes documented, with a read-only option: a scope choice, or a flag that removes write tools. - Token storage location documented, with owner-only file permissions. - For a hosted community endpoint: a privacy policy and a retention statement that cover tool results. Without them, reject it for customer data. Record the review in the inventory's Route line and in `decisions.md`: - Repository URL and the pinned version or commit. - Licence and the date of the last commit or release. - Scopes requested, the read-only option used and where tokens are stored. - Reviewer role and date. The review expires with the pin: a new version needs a new review. A publisher review is a gate, not a security audit. Code-level review, data handling and the AI provider's data terms belong to mcp-security-review and the security or privacy owner. When mcp-security-review is installed: - Run it before step 7 for rungs 4 and 5 and for any server that failed a line above. It also reads the tool definitions, the data path and outsider text, which this gate does not. - NO-GO stops the connection. GO WITH CONDITIONS connects once its before-connecting conditions have evidence; record the rest under Open risks. - The 90-day line is this gate's own shortcut, stricter than the 12 months in mcp-security-review's C12, because this gate reads no code. A GO on a server that missed the line stands. - Rungs 1 and 2 need no publisher review here. Review them there too when `decisions.md` asks, or when a write tool stays reachable (its Tier 3). ## Lookalike rule If the endpoint host or package name carries a vendor's name and the vendor publishes its own server, the endpoint must be on that vendor's list in [../assets/server-registry.json](../assets/server-registry.json). Anything else is a community server, whatever its listing says. Scanner rule S01 applies this: - FAIL when a host, path or package carries the vendor's name but is not the vendor's endpoint (for example a bridge host serving `/hubspot/mcp`). - WARN when only the server's label carries the name, or when the vendor publishes no server at all (Search Console, GTM). - WARN for a package inside a vendor's own npm scope or GitHub organisation (the registry's `vendor_scopes`, such as `@hubspot/`) that no rule lists: verify it on the vendor's MCP page, then add it. - WARN for a host or package the registry does not know. Check it against the vendor's MCP page; if it is your team's own deployment of a vendor server (Google Ads on Cloud Run), record the repository and commit. Add verified vendors to the registry with the date checked. ## Remote or local - Remote is required for web, mobile and cloud-hosted clients. Local stdio servers configured in Claude Desktop are not available in claude.ai web, mobile or Cowork, and the ChatGPT web client needs a public HTTPS endpoint or a Secure MCP Tunnel. - Local servers keep credential files on laptops: store them outside repositories with owner-only permissions, and add their removal to offboarding. - Remote chat-app connectors call the vendor from the client provider's cloud, not from the user's device. Private servers must allowlist the provider's IP ranges, and vendor IP allowlisting (Braze) blocks the remote server entirely. - Self-hosting a local server as remote (Google documents Cloud Run for Google Ads and GA4) makes your team the operator: an owner, an OAuth client, patching and logs. Justified only when two or more remote-only users need it, and only with the OAuth client variables set (failure F20). - GA4 has no Google-hosted server. For web or ChatGPT users, use the GA4 BigQuery export with BigQuery MCP, a licensed bridge, a Secure MCP Tunnel with a named owner, or your own HTTP deployment of Google's server. ## Export and warehouse routes - GTM: the container export JSON (Admin > Export Container), read by gtm-container-audit. No credentials reach the agent. - Search Console bulk export to BigQuery. Default dataset `searchconsole`; tables `searchdata_site_impression` (property aggregation), `searchdata_url_impression` (URL aggregation) and `ExportLog`. Export starts from the setup day with no backfill, so earlier history stays in the API or UI; the first export lands within 48 hours. The export runs as a Google-managed service account shown on the setup page, which needs BigQuery Job User and BigQuery Data Editor on the project. Storage and query costs apply. Read it through BigQuery MCP with `execute_sql_readonly`. - GA4 BigQuery export for event-level questions and for clients that cannot run Google's local GA4 server. - Ad platform data already landed by a connector: read the modelled tables, not the raw platform. - In every case the trusted answer for T3 comes from the warehouse model the team already reconciles. ## Reporting bridges Keep write tools out of any reporting connection. - Funnel: read-only MCP tools, OAuth, global endpoint `https://mcp.ai.funnel.io/mcp` and EU endpoint `https://mcp.eu.ai.funnel.io/mcp`; query responses return up to 500 rows by default, so a table can be partial (article research, 2026-10-19; verify). - Supermetrics: can create and change campaigns, with account-specific write grants and configurable approval levels that include no approval at all. For reporting, keep campaign writes outside the permitted tools. A paused new campaign is still a created object. - Windsor.ai: exposes platform actions, custom-field creation and export tasks besides queries. Hiding actions from discovery is not a documented revocation of write authority: use a client allowlist and restricted source permissions, then run T4. ## Docs servers as a safe first connection Mixpanel and Amplitude publish unauthenticated, read-only docs MCP servers for their documentation (research notes 2026-10-17; verify). They prove the client setup works without touching account data, and give the agent live docs for the steps that follow. ## Retired and deprecated servers Scanner rule S02 flags these. Migrate, retest, remove the old entry and revoke its credential. - Braze local beta server (`braze-mcp-server`): deprecated, no updates. Use the remote server with OAuth. - Salesforce DX local server (`@salesforce/mcp`): reached end of life on 2026-11-02; its repository is archived. Developer work moves to `forcedotcom/sf-skills`; CRM data to the hosted servers. - HubSpot's beta local server (`@hubspot/mcp-server`, private app token): no release since 2025-06-18 and not mentioned on HubSpot's remote MCP page; scanner S02 reports it as legacy (WARN). Use the remote server with OAuth. `@hubspot/cli mcp start` is HubSpot's developer server, current but not a CRM data route. - Salesforce hosted beta URLs containing `v1-beta`: beta tokens do not work with GA. Replace the URL and reauthorise. - Intercom `/sse` endpoints: deprecated. Use the `/mcp` Streamable HTTP endpoint. - Intercom standalone Fin Operator MCP connections stopped on 2026-10-26 (article research): Fin Operator tools now come through the main server. - `Snowflake-Labs/mcp` (package `snowflake-labs-mcp`): deprecated in favour of the Snowflake-managed MCP server. - `jinchliu/tagmanager-mcp`: archived in September 2026. ## No vendor server as of 2026-11-01 - Google Tag Manager: Stape's server is third party. Prefer the container export. - Google Search Console: prefer the bulk export; community servers only after review. - LinkedIn Ads: community servers only (October 2026 research). - TikTok Ads: none found (October 2026 research). - Google Analytics, Google Ads, Tag Manager and Search Console are absent from Google Cloud's remote MCP supported-products page (updated 2026-10-30). Google's own MCP catalog lists only the GA4 local server among them.