Add Podman Streamable HTTP interoperability

[mrbrazzi]

Summary

This change adds an explicitly enabled Streamable HTTP transport for the Google Analytics MCP server while preserving the existing stdio behavior.

It also provides a reproducible, non-root Podman deployment for WSL and documents configurations for clients such as Codex and Antigravity.

Changes

• Replace the ADK/low-level MCP coordination layer with directly registered FastMCP tools.
• Preserve stdio as the default transport.
• Add an explicit stateful Streamable HTTP transport on /mcp.
• Add a guarded subscriptions/listen compatibility handler.
• Pin the validated fastmcp==4.0.3 and mcp==2.0.0 compatibility pair.
• Add a non-root container image and a hardened Podman/Quadlet example.
• Document read-only credential mounting and cross-client configuration.
• Add coordinator and transport regression tests.
• Restrict Setuptools package discovery to analytics_mcp* so deployment assets are not treated as Python packages.

Motivation

The current server is primarily designed for clients that launch it over stdio. This makes it difficult to operate one isolated server in WSL/rootless Podman and share it with multiple MCP clients.

The new transport is opt-in and keeps existing stdio configurations unchanged.

A related interoperability approach was previously validated in googleads/google-ads-mcp#108. This contribution applies the relevant transport and Podman patterns to Google Analytics, without introducing the Google Ads-specific OAuth storage or compatibility patches.

The open googleanalytics/google-analytics-mcp#160 targets Cloud Run and per-user OAuth. This PR instead focuses on a local WSL/rootless Podman deployment using read-only mounted Application Default Credentials, so the two scopes are complementary.

Validation

Automated

The repository was mounted read-only into separate ephemeral containers reproducing the presubmit matrix:

• nox -s lint
• nox -s tests-3.10
• nox -s tests-3.11
• nox -s tests-3.12
• nox -s tests-3.13

All formatting checks passed, and all 8 tests passed on every Python version.

git diff --check main...HEAD also passes.

Manual interoperability

• Built and ran the image with rootless Podman under WSL with FastMCP 4.0.3.
• Confirmed that the container runs as a non-root user with a read-only credential mount.
• Confirmed that two simultaneous Streamable HTTP clients can list the same nine tools.
• Successfully exercised both the Google Analytics Admin API and Data API using a real accessible GA4 property.
• Confirmed Streamable HTTP discovery from Codex.

No credentials, property identifiers, or private Analytics response data are included in this contribution.

Contributor checklist

• Automated tests cover the changes.
• Documentation has been updated.
• Python 3.10–3.13 presubmit matrix reproduced locally.
• Existing stdio behavior is preserved.
• No credentials or private account data are included.
• Google CLA confirmed.

[mrbrazzi]

Update: Upgraded to stable FastMCP 4.0.3 and re-validated

We have updated the dependency pin from fastmcp==4.0.0b3 to the official release fastmcp==4.0.3 (commit 0dbc7e9) and confirmed full compatibility across the automated test matrix and live runtime.

1. Automated Verification (Presubmit Matrix)

Executed against ephemeral rootless containers matching the presubmit workflow:

• nox -s lint: Clean pass (Black formatting at 80 columns across all 19 files).
• nox -s tests-3.10: 8/8 passed.
• nox -s tests-3.11: 8/8 passed.
• nox -s tests-3.12: 8/8 passed.
• nox -s tests-3.13: 8/8 passed.
• git diff --check: Clean pass with no whitespace or layout issues.

2. Container Build & Live Streamable HTTP Validation

• Rebuilt the container image (localhost/google-analytics-mcp:local) using the updated pyproject.toml.
• Executed under hardened rootless Podman (non-root UID 65532:65532, --read-only, --cap-drop all, --security-opt no-new-privileges, read-only credential mount).
• Server initialized cleanly over stateful Streamable HTTP (/mcp) reporting FastMCP version 4.0.3.
• Tool discovery verified: all 9 Google Analytics tools registered and returned with valid schemas.
• End-to-end API execution verified against an active GA4 property using Application Default Credentials:
  • Admin API: get_property_details and get_account_summaries succeeded with valid payload structures.
  • Metadata API: get_custom_dimensions_and_metrics succeeded.
  • Data API: run_report and run_realtime_report executed and returned valid reporting rows/headers.
• Concurrent client verification: tested multiple simultaneous Streamable HTTP client connections listing and calling tools without errors.

The PR is fully tested, up to date with main, and ready for review and merge.