[yuriassuncx]

Two Google fixes, kept together on request.

1. google-analytics: run-funnel-report uses v1alpha

runFunnelReport only exists on the GA4 Data API v1alpha; the tool called v1beta and every call failed with Google Analytics API error: 404 (verified 2026-10-21 via a Studio connection, property 355495152; the same steps on v1alpha return the funnel table). decocms/reports already does this in api/connectors/data/ga4.ts. Insights MCP's INTERACTIONS_DASHBOARD needs it for "did X, then purchased".

2. google-workspace: ready for Google's is_agentic OAuth clients

Google's notice: from 2026-11-11 its Workspace MCP servers only accept OAuth clients marked agentic; from 2026-11-12 the flag is permanent (changing it = new client ID, everyone reconnects).

Which MCPs here are affected (checked in code):

• google-workspace — affected. It proxies to gmailmcp / drivemcp / calendarmcp / chatmcp / people.googleapis.com/mcp/v1. Without the flag it stops working on 11/11.
• REST-based ones (google-gmail, google-drive, google-calendar, google-analytics, google-search-console, ...) — not affected on 11/11; Google still asks to mark agent clients.
• Nothing here uses the Data Analytics API with Gemini (Conversational Analytics), so the 2027-01-01 billing change does not apply.

Code changes:

• mcp-proxy.ts: a "not marked as an AI agent" rejection now says exactly that and that re-auth will not help (today every 403 says "missing scope, re-authenticate").
• main.ts: optional GOOGLE_WORKSPACE_CLIENT_ID / GOOGLE_WORKSPACE_CLIENT_SECRET for a dedicated agentic client; falls back to the shared GOOGLE_CLIENT_ID.
• README section with the dates and the decision.
• mcp-proxy.test.ts (2 tests, pass).

Still a console action (not code)

Mark the OAuth client(s) used by these MCPs as agentic in Google Cloud (projects decocms, deco-chat-460601) before 2026-11-11. If the shared GOOGLE_CLIENT_ID is also used for non-agent traffic (e.g. human sign-in), create a separate agentic client and set the two new env vars instead.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes GA4 funnel reports (the v1beta path for runFunnelReport always 404s) and gets google-workspace ready for Google's 2026-11-11 requirement that Workspace MCP OAuth clients be marked agentic.

google-analytics

• run-funnel-report now calls the Data API's v1alpha endpoint, where runFunnelReport exists.

google-workspace

• 403s and backend errors that mention "agentic" or "AI agent" now explain the client isn't marked agentic and that re-authenticating won't help, instead of the generic missing-scope hint.
• Optional GOOGLE_WORKSPACE_CLIENT_ID/GOOGLE_WORKSPACE_CLIENT_SECRET allow a dedicated agentic client, falling back to the shared GOOGLE_CLIENT_ID; switching clients invalidates existing refresh tokens, so users reconnect once.
• README documents the deadline and the Google Cloud Console action required.

^{Written for commit f582a1e. Summary will update on new commits.}

[JonasJesus42]

Reviewed. GA: runFunnelReport now on the Data API v1alpha (the v1beta path 404s); every other Data API call stays on v1beta. Workspace: notAgenticError only replaces the error message when Google's body mentions agentic/AI agent; the optional GOOGLE_WORKSPACE_CLIENT_ID/SECRET fall back to the shared client (createGoogleOAuth config.clientId ?? env.GOOGLE_CLIENT_ID). LGTM.