Letting Claude manage Google Business Profiles without letting it publish anything
Agencies that manage Google Business Profiles do a lot of repetitive work: replying to reviews, scheduling posts, fixing hours before holidays, pulling monthly numbers for clients. It is exactly the kind of work you would like an AI agent to draft. It is also work where one bad reply or a wrong holiday hour goes live in front of customers. We run an SEO agency, and this is the pattern we ended up…
Managing Google Business Profiles requires repetitive tasks like responding to reviews, scheduling posts, updating hours during holidays, and generating monthly reports for clients. An AI agent can handle most of these tasks, but it should not have the capability to publish changes directly due to the risk of errors that could negatively impact customers.
Our SEO agency devised a system where the AI agent can perform almost all actions, but a human must approve every reply, post, and profile edit before Google sees them. This idea was turned into an open-source tool called OpenGMB.
OpenGMB functions as a Google Business Profile manager that handles various tasks such as reviews, replies, posts, edits, performance tracking, and Maps rank optimization. It also runs an MCP (Multi-Command Protocol) server. Every action in the application is an MCP tool, allowing Claude, Cursor, or any MCP client to execute the same actions a human would perform.
All components, including the web app, MCP server, REST API, and background worker, follow the same permission checks, guardrails, and audit logs, regardless of who or what triggers the changes.
To set up the AI agent, you create a token in the app under Settings → API tokens. This token can be either read-only or read-and-write, granting the agent the ability to draft content but not publish it. Once the server is added to the client, Claude Code can be used to generate replies for low and medium-starred reviews, schedule holiday hours posts for approval, and perform other tasks as needed.
Before any draft is sent to Google, it undergoes several checks. Guardrail rules filter out links, emails, phone numbers, offers, incorrect hours, and banned words. These rules are non-negotiable and must be acknowledged if blocked. Additionally, extra rule packs are available for specific industries like healthcare and law firms, which apply extra checks such as HIPAA compliance for names, clinical terms, and dates, as well as legal ethics guidelines.
After passing the guardrails, the draft is subject to approval rules, which require human approval for replies to 1-3 star reviews and for posts and profile edits. Replies to 4-5 star reviews are only required for approval if the client has enabled auto-approval for that particular client. Finally, the rules are checked again before the draft is published to Google, ensuring that even minor edits are reviewed again before going live.
This approach ensures that every change is thoroughly vetted and approved, providing a safety net against potential mistakes that could harm the client's reputation. Unlike relying solely on prompt instructions, this setup guarantees that all customer-facing content is carefully reviewed and approved, making it more reliable for industries where accuracy is critical, such as healthcare and legal services.
The OpenGMB tool is available under the MIT license, allowing developers to self-host it using Docker Compose. It communicates with Google's Business Profile API through official channels, ensuring compliance and security. The full setup, including all tools, permissions, and rules, is documented in the OpenGMB MCP (Multi-Command Protocol) documentation on GitHub.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
