Five MCP servers, one encrypted token vault

The agency uses Google Ads, GA4, Search Console, time-tracking and telephony systems. I wanted agents to work directly with that data. The hosted MCP setup kept losing OAuth tokens on redeploy, forcing people to log in again. Streaming sessions also dropped mid-analysis. Writes were a separate concern: a bad change to an ad account can affect live spend and historical reporting.

I built five MCP servers on Cloud Run with FastMCP streaming. Instance pinning, session affinity and a one-hour timeout addressed the dropped sessions. OAuth tokens now live in Firestore, encrypted with Fernet; each server has its own key in Secret Manager. Only the organization's Google Workspace accounts can sign in. The Google Ads connector has no mutate tools. Writes happen in separate workspaces where a person reviews them.

The five servers expose 84 tools: 54 for time-tracking and invoicing, 11 for telephony and messaging, 9 for analytics, 7 for Search Console and 3 for ads. They're part of an eleven-connector stack the team uses daily. Tokens survive redeployment. Claude connects through dynamic client registration, people sign in with their Workspace accounts, and API calls use a governed service identity. Each server has a documented connectivity check.