@cesteral/cm360-mcp

MCPattested

v1.3.0UnknownApache-2.0Updated 2mo agonpm GitHub

CM360 MCP Server - Campaign Manager 360 ad serving and trafficking management

Works in

ClaudeCursorCopilotChatGPTGemini

Inferred from the transports this listing declares (stdio, streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

239Downloads/wk

2mo agoLast update

Package

AuthorUnknown

LicenseApache-2.0

Version1.3.0

Sourcenpm+mcp-registry

npm@cesteral/cm360-mcp

GitHubcesteral/mcp-open-advertising

SBOMCycloneDX 1.6 ↓

Trust Status

A

85/100Trusted

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 2128234

Dependencies60 resolved · 2 with advisories

Tool surface18 tools · none privileged

Security scan⚠ Warnings (2)v1.3.0 · todayHow well does this scan work?

HIGH@opentelemetry/auto-instrumentations-node@0.67.3Prometheus exporter process crash via malformed HTTP request · transitive HIGH@opentelemetry/sdk-node@0.208.0Prometheus exporter process crash via malformed HTTP request · transitive

EvalsNone

IndexedAug 26, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

18 tools · none privileged

Statically extracted from the published packagev1.3.0 · 8h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

cm360_bulk_operations_workflowGuide for batch operations on CM360 entities

Guide for batch operations on CM360 entities

No input schema was published for this tool.

profileIdCM360 User Profile ID

CM360 User Profile ID

No input schema was published for this tool.

operationOperation type: create, update, status

Operation type: create, update, status

No input schema was published for this tool.

cm360_campaign_setup_workflowStep-by-step guide for creating a complete CM360 campaign structure

Step-by-step guide for creating a complete CM360 campaign structure

No input schema was published for this tool.

advertiserIdCM360 Advertiser ID

CM360 Advertiser ID

No input schema was published for this tool.

cross_platform_campaign_setupMulti-platform campaign setup guide with budget allocation and naming conventions

Multi-platform campaign setup guide with budget allocation and naming conventions

No input schema was published for this tool.

totalBudgetTotal campaign budget (e.g., 50000)

Total campaign budget (e.g., 50000)

No input schema was published for this tool.

objectiveCampaign objective: awareness, consideration, conversion

Campaign objective: awareness, consideration, conversion

No input schema was published for this tool.

cross_platform_performance_comparisonCross-platform performance comparison and budget reallocation guide

Cross-platform performance comparison and budget reallocation guide

No input schema was published for this tool.

dateRangeDate range (e.g., LAST_7_DAYS, LAST_30_DAYS, or custom dates)

Date range (e.g., LAST_7_DAYS, LAST_30_DAYS, or custom dates)

No input schema was published for this tool.

cm360_entity_update_workflowSafe entity update workflow for CM360 (PUT semantics — full object required)

Safe entity update workflow for CM360 (PUT semantics — full object required)

No input schema was published for this tool.

entityTypeEntity type (campaign, placement, ad, creative, site, advertiser, floodlightActivity, floodlightConfiguration)

Entity type (campaign, placement, ad, creative, site, advertiser, floodlightActivity, floodlightConfiguration)

No input schema was published for this tool.

entityIdEntity ID to update

Entity ID to update

No input schema was published for this tool.

cm360_floodlight_workflowGuide for setting up CM360 Floodlight conversion tracking

Guide for setting up CM360 Floodlight conversion tracking

No input schema was published for this tool.

cm360_reporting_workflowGuide for generating async CM360 reports

Guide for generating async CM360 reports

No input schema was published for this tool.

cm360_targeting_discovery_workflowGuide for browsing CM360 targeting options

Guide for browsing CM360 targeting options

No input schema was published for this tool.

cm360_tool_schema_explorationGuide for discovering and understanding CM360 MCP tools, resources, and schemas

Guide for discovering and understanding CM360 MCP tools, resources, and schemas

No input schema was published for this tool.

cm360_troubleshoot_entityDiagnostic workflow for troubleshooting CM360 entity issues

Diagnostic workflow for troubleshooting CM360 entity issues

No input schema was published for this tool.

18 of 18 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

CM360 MCP Server - Campaign Manager 360 ad serving and trafficking management

Keywords

mcpmodel-context-protocoladvertisingcm360campaign-manager-360

Alternatives

Comparing tool surfaces…

Tools exposed

18 tools · none privileged · observed 2026-08-29 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

cm360_bulk_operations_workflow
profileId
operation
cm360_campaign_setup_workflow
advertiserId
cross_platform_campaign_setup
totalBudget
objective
cross_platform_performance_comparison
dateRange
cm360_entity_update_workflow
entityType
entityId
cm360_floodlight_workflow
cm360_reporting_workflow
cm360_targeting_discovery_workflow
cm360_tool_schema_exploration
cm360_troubleshoot_entity

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-08-29 — observed resolution, not a publisher declaration.

60 packages resolved · 4 direct · 2 carrying advisories Resolution stops at depth 4 and 60 packages.

zod3.25.76
pino10.3.111 dependencies
- sonic-boom4.2.11 dependency
  - atomic-sleep1.0.0
- atomic-sleep1.0.0shown above
- real-require0.2.0
- thread-stream4.2.0+1 not drawn
- @pinojs/redact0.4.0
- process-warning5.1.0
- on-exit-leak-free2.1.2
- pino-std-serializers7.1.0
- safe-stable-stringify2.5.0
- quick-format-unescaped4.0.4
- pino-abstract-transport3.0.0+1 not drawn
@cesteral/shared1.2.0+10 not drawn11 dependencies
- @google-cloud/opentelemetry-cloud-monitoring-exporter0.20.0+4 not drawn
- @google-cloud/opentelemetry-cloud-trace-exporter2.4.1+4 not drawn
- @hono/mcp0.2.5+1 not drawn
- @hono/node-server1.19.17
- @opentelemetry/api1.9.1
- @opentelemetry/auto-instrumentations-node0.67.3incompleteHIGH GHSA-q7rr-3cgh-j5r3+11 not drawn1 dependency
  - @opentelemetry/sdk-node0.208.0incompleteHIGH GHSA-q7rr-3cgh-j5r3
- @opentelemetry/exporter-metrics-otlp-http0.208.0incomplete
- @opentelemetry/exporter-trace-otlp-http0.208.0incomplete
- @opentelemetry/sdk-node0.208.0incompleteshown aboveHIGH GHSA-q7rr-3cgh-j5r3
- pino10.3.1shown above
- zod3.25.76shown above
@modelcontextprotocol/sdk1.27.1+16 not drawn1 dependency
- @hono/node-server1.19.17shown above

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

167 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

package cap reached: 167

@opentelemetry/instrumentation-net ^0.53.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-grpc ^0.208.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-hapi ^0.55.1 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-http ^0.208.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-knex ^0.53.1 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-pino ^0.55.1 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-mysql ^0.55.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-redis ^0.57.2 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/resource-detector-aws ^2.9.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/resource-detector-gcp ^0.44.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-bunyan ^0.54.0 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached
@opentelemetry/instrumentation-mysql2 ^0.55.1 — required by @opentelemetry/auto-instrumentations-node@0.67.3package cap reached

+155 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.