Upbuild
Upbuild / MCP connector / Gemini Enterprise
Gemini Enterprise MCP server
Add one MCP server to your team's connected apps, sign in with the Google account that already reaches your Google Ads, GA4, DV360, CM360, GTM, BigQuery and Sheets, and ask. Read-only, every platform, no new credentials to issue.
Every platform on one subscription
One identity
If you run Gemini Enterprise you are already a Google Cloud and Google Workspace organisation, and your media and analytics already sit behind Google accounts your admins govern: Google Ads manager accounts, GA4 properties, DV360 partners, CM360 profiles, GTM containers, BigQuery projects, Sheets. Upbuild does not put a second identity system on top of that. Each person authorises with their own Google account and sees exactly the accounts that account could already open.
Take someone off a Google Ads manager account or a GA4 property and their answers change with it. There is no separate Upbuild membership list to keep in step, and no shared service account quietly holding everything.
An admin adds the MCP server once for the team. After that each person opens Connectors, selects Connect and signs in. An agency holding several client logins can add /mcp2 and /mcp3 as separate servers, one identity each.
You are an admin, so you reach every account in the organization: 859 of them, across 3 connections.
| Platform | Account | Streams | Connection |
|---|---|---|---|
| Google Ads | Northwind Retail | Brand742-118-9063 | 6 | Google workspace |
| Google Analytics | Northwind Retail | Webproperties/318204471 | 4 | Google workspace |
| Display & Video 360 | Harbour Group | Programmaticadvertisers/8841207 | 2 | Google workspace |
| BigQuery | northwind-mktmarketing.campaign_daily | 3 | Google workspace |
| Meta Ads | Harbour Group | Retailact_41190236 | not used | Meta business |
Setup
It works on any paid Gemini Enterprise edition: Business, Standard, Plus or Frontline. You need to be a team admin, and you need access to the Google Cloud console for the one step Gemini's own admin panel does not expose. The whole thing is done once, by one person.
Click the settings gear at the bottom of the left sidebar, choose your team name, then Manage team. Open Connected apps and select Add MCP Server. The server URL is https://connector.upbuild.app/mcp and the name is Upbuild. Write the description carefully: Gemini reads it to decide when to reach for these tools, so the setup page gives you one listing every platform to copy.
On the Auth screen the authorisation and token URLs are /authorize and /token on the same host. The client id and secret are published on the setup page: they identify the Gemini Enterprise app to Upbuild and grant no access to any data on their own. Leave Auth URL Parameter empty. Scopes is required and will not take a blank, and mcp is the correct value.
This is the step Gemini's admin panel does not offer, and until you do it Upbuild looks connected but nothing runs. In the Google Cloud console, open Gemini Enterprise, pick the project Gemini created for your tenant, go to Data stores, open Upbuild, then Actions: Reload custom actions, tick all 80, Enable actions. Back in Gemini, open Connectors, select Connect on Upbuild and sign in with Google.
Almost always the actions are not enabled. Open the Upbuild data store in the Google Cloud console and check that the Actions tab shows every row as Enabled. Gemini sometimes claims the connector does not exist at all when its actions are off, which sends people back to the server URL for no reason.
The Actions list paginates at 50 and the header checkbox only covers the visible page. Set rows per page to 200, or repeat on page two, until the footer reads 1 to 80 of 80. One more thing worth knowing: the transport is Streamable HTTP on /mcp, and Gemini rejects /sse.
Coverage
Google Ads, GA4, DV360, CM360, GTM, BigQuery and Sheets, read through the same connection you signed in with. The other five (Meta Ads, TikTok Ads, Snapchat Ads, Adobe Analytics and Adobe Launch) link from the same connect hub, now or later, which is what makes a first question like "summarise last month across Google Ads and Meta: spend, conversions, ROAS, top five campaigns" answerable at all.
The full account hierarchy, campaigns, ad groups, search terms and assets, queried the way the API is queried rather than exported first. A manager account with two hundred children is one question, not two hundred. There is a worked example of a full account review in auditing Google Ads with Gemini Enterprise.
"Show Google Ads search terms with spend but zero conversions last month."
Any GA4 property, any report, realtime included, plus your own BigQuery projects, datasets and tables read next to it. One question can cross both, which is how a platform number and a modelled number get compared without a ticket.
"Query my BigQuery marketing dataset for the top 20 campaigns by conversions last quarter and compare them to what Google Ads reports."
Partners, advertisers, campaigns and line items on the DV360 side. Advertisers, campaigns, Floodlight configuration, saved reports and change logs on the CM360 side, which is the pair most reporting tools skip.
"List every active DV360 line item under my main advertiser with its flight dates, and flag which ones end this month."
Accounts, containers, workspaces, tags, triggers, variables and the live version, across hundreds of containers, plus the spreadsheets the planning still lives in. Tracking questions and budget questions stop being separate jobs.
"List my GTM containers and what tags are live in my main container."
Who this is for
Both already bought Gemini Enterprise for the rest of the company. Neither wants a second reporting login to administer.
Central analytics governs the Google Ads managers, the GA4 properties and the BigQuery projects. Every market lead already has a Workspace account with exactly the access they should have. Adding the server once puts the same eighteen markets of data in the assistant they already open, with no per-market rollout and no access matrix to rebuild. What a market lead can answer is what a market lead could already see.
Client access lives in manager accounts, and the people who need answers are account directors, not analysts. One server, one Google sign-in per person, and the question goes to the accounts that person is staffed on. Where client logins are genuinely separate, /mcp2 and /mcp3 hold a second and third identity, kept fully apart.
Get in touch