# How to connect Google Analytics to Hermes Agent (no API keys)

> Connect Google Analytics to Hermes Agent with no Google Cloud project, no OAuth client, and no service account JSON. Hosted OAuth, 67 GA4 tools, and fixes for the GA4 errors agents actually hit.

Web version: https://claw-link.dev/hermes/google-analytics

Most guides for giving Hermes Agent Google Analytics access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Google Analytics setup: pair once in the browser and your always-on Hermes agent can act on Google Analytics for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself.

**Start here — paste this into Hermes to set up ClawLink:**

> Set up ClawLink for Hermes and tell me when it's ready.
> 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable`
> 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait.
> 3. I'll approve it in my browser, then reply "approved".
> 4. When I say approved, finish setup: `hermes clawlink finish`
> 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready.

## Setup

It takes three steps to connect Hermes to Google Analytics.

1. **Install ClawLink** — add the plugin to Hermes Agent once.
2. **Connect Google Analytics** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask Hermes Agent in plain English.

**Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect google-analytics  # connect Google Analytics (browser OAuth)
npx -y @useclawlink/cli actions google-analytics  # list available actions
npx -y @useclawlink/cli run google-analytics <action> --input '<json>'  # execute (add --confirm for writes)
```

The whole pairing handshake, start to finish. Run these once, then connect Google Analytics in the dashboard:

```bash
hermes plugins install ClawLink-HQ/hermes-plugin --enable
hermes clawlink begin     # approve the link in your browser
hermes clawlink finish
hermes clawlink test
```

`hermes clawlink test` is the one that tells you pairing actually worked. If it fails, run `hermes clawlink begin` again for a fresh link: approval links expire. Start a new chat after connecting so Hermes reloads its tool catalog.

### Using a different agent?

The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once Google Analytics is connected in the dashboard, that agent calls the same 67 Google Analytics tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## Google Analytics MCP for Hermes

Looking for a Google Analytics MCP server for Hermes Agent? ClawLink connects Google Analytics to Hermes Agent and exposes 67 Google Analytics tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Google Analytics integration](https://claw-link.dev/openclaw/google-analytics) uses the same hosted Google provider and the same 67 tools, but OpenClaw installs and activates ClawLink through its own skill flow rather than the Hermes pairing commands.

Hermes Agent ships no Google Analytics integration of its own, so every documented route starts by making you a Google Cloud administrator. Google's own Analytics MCP server wants a Cloud project, the Analytics Data and Admin APIs enabled by hand, an OAuth client or a service account, a downloaded JSON key, the gcloud CLI, and then a Property Access Management step inside GA4 to give that robot account Viewer rights. It also runs locally over stdio, so an always-on Hermes agent on a server or a phone cannot reach it at all. Wiring Google up as a plain MCP server instead runs into a problem Hermes documents itself: some Google servers reject the dynamic client registration step that bare `auth: oauth` depends on. ClawLink avoids all of it by owning the verified Google OAuth app. You approve Google's own consent screen in the browser, and Hermes reads the properties your Google account can already see from the next message.

## What the Hermes Agent Google Analytics integration can do

67 Google Analytics tools are ready for Hermes Agent once the account is connected. The 30 below are the ones people reach for most; your agent can call all 67.

### 30 of 67 Google Analytics tools for Hermes

| Tool | What it does |
|---|---|
| **Batch run reports** `google_analytics_batch_run_reports` | Run multiple GA4 reports in a batch |
| **Check compatibility** `google_analytics_check_compatibility` | Check dimension and metric compatibility |
| **Get metadata** `google_analytics_get_metadata` | Get GA4 metadata (dimensions and metrics) |
| **Get property** `google_analytics_get_property` | Get a GA4 property |
| **List account summaries** `google_analytics_list_account_summaries` | List GA account summaries |
| **List audiences** `google_analytics_list_audiences` | List audiences in a GA4 property |
| **List data streams** `google_analytics_list_data_streams` | List data streams for a GA4 property |
| **List key events** `google_analytics_list_key_events` | List key events in a GA4 property |
| **List properties filtered** `google_analytics_list_properties_filtered` | List GA4 properties |
| **Run funnel report** `google_analytics_run_funnel_report` | Run a funnel exploration report |
| **Run pivot report** `google_analytics_run_pivot_report` | Run a pivot report in GA4 |
| **Run realtime report** `google_analytics_run_realtime_report` | Run a real-time GA4 report |
| **Run report** `google_analytics_run_report` | Run a GA4 report with dimensions and metrics |
| **Update property** `google_analytics_update_property` | Update a GA4 property |
| **Batch run pivot reports** `google_analytics_batch_run_pivot_reports` | Return multiple pivot reports in a batch for a GA4 property |
| **Get account** `google_analytics_get_account` | Retrieve a single Account by its resource name |
| **Get attribution settings** `google_analytics_get_attribution_settings` | Retrieve attribution configuration for a Google Analytics property |
| **Get audience** `google_analytics_get_audience` | Retrieve a single Audience configuration from a Google Analytics property |
| **Get audience export** `google_analytics_get_audience_export` | Get configuration metadata about a specific audience export |
| **Get audience list** `google_analytics_get_audience_list` | Get configuration metadata about a specific audience list |
| **Get custom dimension** `google_analytics_get_custom_dimension` | Retrieve a single CustomDimension by its resource name |
| **Get data retention settings** `google_analytics_get_data_retention_settings` | Retrieve data retention configuration for a Google Analytics property |
| **Get data sharing settings** `google_analytics_get_data_sharing_settings` | Retrieve data sharing configuration for a Google Analytics account |
| **Get google signals settings** `google_analytics_get_google_signals_settings` | Retrieve Google Signals configuration settings for a GA4 property |
| **Get key event** `google_analytics_get_key_event` | Retrieve a Key Event |
| **Get property quotas snapshot** `google_analytics_get_property_quotas_snapshot` | Retrieve all property quotas organized by category (corePropertyQuota, funnelPropertyQuota |
| **Get recurring audience list** `google_analytics_get_recurring_audience_list` | Get configuration metadata about a specific recurring audience list |
| **Get report task** `google_analytics_get_report_task` | Get report metadata about a specific report task |
| **List accounts v1 beta** `google_analytics_list_accounts_v1_beta` | List all Google Analytics accounts accessible by the caller using v1beta API |
| **List adsense links** `google_analytics_list_adsense_links` | List all AdSenseLinks on a property |

## Example prompts

**Traffic report**

> List my Google Analytics account summaries, then run a report on that property for the last 28 days with dimensions date and sessionDefaultChannelGroup and metrics sessions and activeUsers. Show it as a table.

**Look up the field names first**

> Before building the report, call google_analytics_get_metadata on properties/0/metadata and pick the exact apiName values for the fields I described. Do not guess API names from the labels shown in the GA4 interface.

**Realtime**

> Run a realtime Google Analytics report on my main property with the dimension country and the metric activeUsers, and tell me how many people are on the site right now.

**Diagnose a drop**

> Compare the last 7 days with the previous 7 days on my main property broken down by sessionSource, and call out any source whose sessions fell more than 20 percent. If Google rejects a dimension and metric pair, drop the exact field the error names and retry instead of asking me.

## What the Google Analytics tools actually expect

These are the argument-level rules the GA4 APIs enforce, read from the live tool schemas and confirmed by running the calls. They are the difference between a report that returns and a 400 your agent cannot explain. Two of them fail without erroring at all.

- **The property argument has four different names across the 67 tools, and the reporting tools use the odd one out.** The eight report tools, including `google_analytics_run_report`, want `property`. Thirty-three list and create tools want `parent`. Eighteen get tools want `name`. `google_analytics_get_audience` alone wants `propertyId`. All of them take the same `properties/123456789` shape, so an agent that carries one call's arguments into the next gets `arguments.property is required` or `arguments.parent is required` rather than a hint about the rename.
- **`property` must be the numeric property id with its prefix, never a measurement ID.** `properties/123456789` works. A bare `123456789` is rejected with `property must match pattern properties/\{property_id\} where property_id is a numeric ID (e.g., 'properties/123456789')`, and a `G-XXXXXXXXXX` measurement ID is a tagging identifier the Data API has never accepted. Have the agent call `google_analytics_list_account_summaries` and copy a `property` value from that response verbatim.
- **`dimensions` and `metrics` are arrays of objects, not arrays of strings.** `[\{"name": "country"\}]` works; `["country"]` fails with `Input should be a valid dictionary on parameter \`dimensions.0\``. This one catches models that have read Google's own MCP server, which takes a looser form, so it is worth stating in the prompt.
- **Ask for the field list instead of letting the agent guess it.** `google_analytics_get_metadata` accepts `properties/0/metadata`, which returns Google's universal dimension and metric list with both `apiName` and `uiName` without touching a real property. GA4 interface labels are not API names, and this is what stops an agent inventing `averageEngagementTime` when the field is `engagementRate`.
- **One report takes at most 9 dimensions and 10 metrics.** Exceed either and the Data API returns 400 before running anything, and batch reports count each nested request separately. Split the request and join the results on a dimension both halves share, usually `date`.
- **`dateRanges` is required for a standard report and must be omitted for a cohort report.** Dates accept `YYYY-MM-DD` or relative values like `7daysAgo` and `today`. Passing `dateRanges` alongside `cohortSpec` fails, so the rule runs in both directions.
- **Realtime reports accept only four metrics:** `activeUsers`, `eventCount`, `keyEvents` and `screenPageViews`, over a default window of the last 30 minutes. The realtime tool's own description points at a `list_properties` tool that is not in this toolkit; use `google_analytics_list_account_summaries` for property ids.
- **`list_account_summaries` returns 50 properties by default and 200 at most.** If you manage more than 50, an agent that does not page will quietly work from a partial list and tell you a property does not exist. Ask it to keep paging until the response carries no `pageToken`.
- **Quota is counted in tokens, not requests, and you can read the remaining balance in the same call.** Set `returnPropertyQuota: true` on a report and Google returns the live figures. On a standard property that block reads 200,000 Core tokens per day, 40,000 per hour, 14,000 per project per hour, 10 concurrent requests, and 10 server errors per hour before the property is blocked for that project. Most reports cost 10 tokens or fewer; wide date ranges and complex filters cost more.
- **Seven of the 67 tools cannot run on this connection at all.** `google_analytics_update_property`, `google_analytics_create_custom_dimension`, `google_analytics_create_custom_metric`, `google_analytics_archive_custom_dimension`, `google_analytics_create_expanded_data_set`, `google_analytics_create_rollup_property` and `google_analytics_provision_account_ticket` declare Google's `analytics.edit` scope, which ClawLink does not request. They return 403 every time. Everything else, including every report, works.
- **Two more tools do not use your Google connection at all.** `google_analytics_send_events` and `google_analytics_validate_events` are Measurement Protocol calls: they need a `measurement_id`, an `api_secret` you create yourself under Admin, Data Streams, Measurement Protocol API secrets, plus a `client_id` and an `events` array. Connecting Google Analytics in ClawLink does not supply those, so ask for them explicitly if you want an agent sending events.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google Analytics working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Connection flow** | Register a Google Analytics app, configure redirect URLs, manage consent details, and reconnect users when auth settings drift. | Users connect Google Analytics through the hosted browser flow and ClawLink keeps the token lifecycle out of your app code. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Google Analytics. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right Google Analytics actions to the runtime in a format your agent can reliably use. | 67 tools for Google Analytics are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes Google Analytics to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Google Analytics in the browser, and the 67 tools above work from chat. There is no SDK, no config file, and no API key handling. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### Hermes paired but still can't use Google Analytics
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

### Connection succeeds but no tools appear
Reconnect Google Analytics from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling Google Analytics tools
Google Analytics tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Google Analytics call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### Google Analytics returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### "The request's dimensions & metrics are incompatible" from Google Analytics
This is the single most common Google Analytics failure in ClawLink: 21 of the 51 real tool errors we have logged. GA4 stores some dimension and metric combinations separately and refuses to query them together, so the pairing is rejected rather than returned empty. The useful part is that Google names the exact field to drop. Asking for the dimension `campaignName` with the metric `screenPageViews` returns `Please remove screenPageViews to make the request compatible for example`, and swapping the metrics returns `Please remove campaignName` instead. Attribution dimensions such as `campaignName`, `campaignId` and `defaultChannelGroup` are the usual culprits against page and user metrics. Tell your agent to remove the single field the error names and retry, rather than rebuilding the request from scratch. Ignore the hint about demographic dimensions that arrives with this error; it is generic text and it is usually pointing at the wrong cause.

### "The dimensions and metrics are incompatible" from google_analytics_check_compatibility
The incompatibility error tells your agent to validate with `google_analytics_check_compatibility`, and then that tool fails with a 400 on the very combination you are trying to diagnose. It is not broken. Passing an already-incompatible pair makes it error instead of answering. Use it the other way round: send only the metrics you want plus `compatibilityFilter: "INCOMPATIBLE"`, and it returns the full list of dimensions that will not work with them, each with its `apiName` and description. That is the call that actually tells you what to avoid, and the one to put in the prompt.

### "Did you mean keyEvents? Field pageviews is not a valid metric" from Google Analytics
The agent used a Universal Analytics name or a GA4 interface label instead of an API name. The three differ, and the reporting interface never shows the API name. We have logged this with `averageEngagementTime`, `averageUserEngagementDuration`, `sessionCampaign`, `sessionGoogleAdsKeywordText` and `exits`, none of which exist in the Data API. Treat Google's suggestion with care, because it is often wrong: `pageviews` returns `Did you mean keyEvents?` when the field you actually want is `screenPageViews`, and `exits` returns `Did you mean sessions?` when GA4 simply has no exits metric. The reliable fix is to have the agent call `google_analytics_get_metadata` with `properties/0/metadata` first and choose `apiName` values from that response.

### Google Analytics returns no rows and Hermes reports that you have no traffic
This one has no error string, because the call succeeds. A report with a valid property and a valid field list comes back with `"rowCount": 0`, an empty `rows` array, and the note `Query returned no data for the specified parameters`, and an agent reading that will tell you the site had no visitors. Three things produce it. The property genuinely has no data for that window, which is common on a property created for testing or one whose data stream was only just tagged. The date range landed outside the data, so ask for `30daysAgo` to `today` before believing a quiet week. Or the report used a thresholded dimension: `userAgeBracket`, `userGender`, `brandingInterest`, `audienceId` and `audienceName` are withheld by Google when a report could identify individuals, and a low-traffic property returns nothing at all for them. Ask the agent to re-run with `country` or `date` before concluding the numbers are zero.

### "Request had insufficient authentication scopes" (ACCESS_TOKEN_SCOPE_INSUFFICIENT) from Google Analytics
Two distinct causes that need opposite responses. If the tool was an administrative write, it needs Google's `analytics.edit` scope, which ClawLink does not request; seven of the 67 tools are in that group and reconnecting will never change it. If a report or a list tool fails this way, the grant itself is incomplete. ClawLink requests three Google scopes, which is the condition under which Google shows its granular consent screen with a separate checkbox per permission, and clearing the Analytics box produces exactly this error. Note that Google's Admin API accepts only `analytics.readonly` or `analytics.edit`, so the broader `analytics` permission on its own will read reports but still fail on `google_analytics_list_account_summaries`. Reconnect from the dashboard and leave every box on Google's consent screen ticked.

### "User does not have sufficient permissions for this property" from Google Analytics
Despite the wording this is almost never a permissions problem, and reconnecting is the wrong first move. It is a property id the connected Google account cannot see, usually one the agent invented or copied out of documentation. Ask it to call `google_analytics_list_account_summaries` and reuse a `property` value from that response exactly as returned.

### "The Google Analytics Data API limits requests to 10 metrics per request" or "limited to 9 dimensions"
A hard Data API limit rather than a ClawLink one, and batch reports count each nested request on its own. Split the work into several calls of at most 9 dimensions and 10 metrics each, then join the results on a dimension they share, usually `date`. Asking one report to cover everything at once is the usual cause.

### "A dateRange is required for non-cohort reports" from Google Analytics
The report went out with no date range. Standard reports need at least one, for example `dateRanges: [\{"startDate": "30daysAgo", "endDate": "today"\}]`. The exception runs the other way: a cohort report carries its own window in `cohortSpec` and fails if you also pass `dateRanges`.

### "Connected account is in EXPIRED state" when Hermes calls Google Analytics
The Google grant behind the connection lapsed, usually because the Google password changed, the app was revoked under Third-party apps and services, or the account sat unused long enough for the refresh token to be invalidated. Nothing on the Hermes side fixes it. Reconnect Google Analytics from the ClawLink dashboard and approve the consent screen again, then start a fresh chat.

### OAuth finished in the browser but the account is still missing
Try reconnecting Google Analytics and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

### Is there a Hermes Agent Google Analytics integration?
Yes. ClawLink is the fastest way to connect Hermes to Google Analytics: link your Google Analytics account once in the browser and Hermes Agent can call the Google Analytics API through 67 ready-made tools — no custom code or token handling.

### How do I connect Google Analytics to Hermes with ClawLink?
Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Google Analytics in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

### How long does it take to connect Google Analytics to Hermes Agent?
About two minutes. Sign in, click Connect next to Google Analytics in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

### Why use ClawLink instead of wiring Google Analytics up myself?
The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Google Analytics working from chat.

### Do I need a Google Cloud project or a service account to connect Google Analytics to Hermes Agent?
No. That is the requirement every other route imposes, including Google's own Analytics MCP server, which asks you to create a Cloud project, enable the Analytics Data and Admin APIs by hand, create an OAuth client or an impersonable service account, run a gcloud login, add that service account's email to your GA4 property as a Viewer, and point a config file at a credentials JSON on disk. ClawLink owns the verified OAuth app instead. You pair Hermes once, click Connect, approve on Google's consent screen, and ClawLink holds and refreshes the token. There is no Cloud project, no OAuth client, no JSON key on the machine running Hermes, and no Property Access Management step for a robot account.

### Which Google Analytics permissions does ClawLink ask for?
Three scopes: `https://www.googleapis.com/auth/analytics.readonly`, `https://www.googleapis.com/auth/analytics` and `https://www.googleapis.com/auth/userinfo.profile`. Because that is more than one non-sign-in scope, Google shows its granular consent screen with a checkbox per permission, and the connection only works if you leave them ticked. ClawLink does not request `analytics.edit`, so it cannot create, rename or archive properties, custom dimensions or custom metrics. You can review or revoke the grant at any time under Third-party apps and services in your Google account.

### Can Hermes Agent change my Google Analytics configuration?
Not through ClawLink today. The 67 tools include GA4 Admin API endpoints that would edit a property, but they declare the `analytics.edit` scope ClawLink does not request, so they return 403. We confirmed this against a live connection rather than inferring it from the catalog. In practice this integration is reporting and inspection: standard, pivot, funnel and realtime reports, plus reads of property, audience, data stream, key event and link configuration, and field compatibility checks. If you need GA4 configuration writes, that is a real limit of this integration rather than something a reconnect will fix.

### How is this different from the official Google Analytics MCP server?
Google's server is open source, labelled experimental, described by Google as available for read requests only, and it runs locally over stdio, which means an always-on Hermes agent on a server or a phone cannot use it at all. Its README documents seven tools. Reaching a first query needs pipx, a Google Cloud project, two manually enabled APIs, an OAuth client or service account you create, and the gcloud CLI. ClawLink exposes 67 tools through a hosted connection with nothing to install or keep running, at the cost of routing calls through our infrastructure rather than your own machine. If you want a local, self-owned setup and are comfortable in the Google Cloud Console, the official server is a reasonable choice.

### Hermes paired but still can't use Google Analytics
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

## Related

- [Hermes Google Classroom integration](https://claw-link.dev/hermes/google-classroom) — Manage classes, coursework, and students
- [Connect Google Calendar](https://claw-link.dev/hermes/google-calendar) — Create and manage calendar events
- [Google Sheets](https://claw-link.dev/hermes/google-sheets) — Read and write spreadsheet data