Connect Tealium to Claude: Enrich Visitor Profiles & GDPR Compliance

If your team needs to connect Tealium to Claude to orchestrate customer data flows, audit GDPR deletion requests, or manage iQ Tag revisions, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's LLM function calls and Tealium's REST APIs. You can either build and maintain this translation layer yourself, or use a managed platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on connecting Tealium to ChatGPT or explore our broader architectural overview on connecting Tealium to AI Agents.

Giving an AI agent read and write access to an enterprise Customer Data Platform (CDP) like Tealium is fundamentally difficult. You have to handle fragmented authentication mechanisms, map deeply nested JSON schemas to MCP tool definitions, and deal with Tealium's strict rate limits. Every time Tealium updates an endpoint or changes a data model, you have to update your custom integration code, redeploy, and test.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Tealium, connect it to Claude Desktop, and execute complex CDP workflows using natural language.

The Engineering Reality of the Tealium API

A custom MCP server is a self-hosted integration proxy. While the open MCP standard provides a predictable JSON-RPC 2.0 interface for models to discover tools, the reality of implementing it against a massive B2B application like Tealium is painful. Tealium is not a single API; it is a collection of distinct microservices - EventStream, AudienceStream, iQ Tag Management, and SCIM Identity - each with its own quirks.

If you decide to build a custom Tealium MCP server, you own the entire lifecycle of these API realities:

Fragmented Authentication Models Tealium does not use a single, unified auth token across all its APIs. The SCIM API requires a long-lived bearer token that expires after 90 days. Conversely, the EventStream and iQ APIs require exchanging a username and API key for a short-lived JWT that expires in 30 minutes. If you build this in-house, your MCP server must handle credential exchange, token caching, and proactive renewal in the background so the LLM is not constantly interrupted by 401 Unauthorized errors.

Asynchronous GDPR Deletion Lifecycles Handling privacy requests in Tealium is not a synchronous CRUD operation. When you trigger a GDPR or CCPA erasure via the Privacy API, Tealium queues the deletion across all stitched visitor profiles. This process can take up to 30 days. Your MCP server must expose an initial deletion tool that captures the transactionId, and a secondary polling tool that the agent can use to check if the status is PENDING, SUCCESS, or FAILED.

Complex JSON Patch Requirements Updating iQ Tag profiles or SCIM user groups in Tealium requires exact application/json-patch+json syntax. The payload must strictly define arrays of operations with op, path, and value keys. LLMs are notorious for hallucinating JSON schema structures when generating Patch requests. Your MCP tools must be built with strict JSON Schema validation and explicitly typed descriptions to prevent Claude from sending malformed patch operations that corrupt tag configurations.

How to Generate a Managed MCP Server for Tealium

Instead of building a Node.js or Python application to handle Tealium's auth and schemas, you can use Truto to generate a managed MCP server. Truto's architecture is dynamic and documentation-driven. It takes your connected Tealium account, reads the underlying API documentation schemas, and instantly compiles them into an MCP JSON-RPC endpoint.

Truto does not store your Tealium visitor data. It acts as a stateless proxy, validating the MCP token and passing the execution down to Tealium in real-time.

You can create this server in two ways: via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For administrators setting up internal tools, the dashboard is the fastest route:

1. Navigate to the Integrated Accounts page in your Truto dashboard and select your connected Tealium instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Define your configuration parameters. You can filter the tools by method (e.g., read-only) or apply specific tags (e.g., privacy, iq_profiles) to restrict what Claude can access.
5. Click Generate and copy the resulting URL (e.g., https://api.truto.one/mcp/a1b2c3d4...).

Method 2: Via the Truto API

For developers building autonomous platforms, you can provision Tealium MCP servers dynamically using the Truto REST API. This is ideal for generating short-lived, scoped access tokens for specific agent sessions.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Tealium Privacy and iQ Operations",
    "config": {
      "methods": ["read", "write"],
      "tags": ["privacy", "iq"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API returns a secure url backed by a cryptographic token stored in Cloudflare KV. The token URL alone is sufficient to serve the MCP tools to Claude.

How to Connect the Tealium MCP Server to Claude

Once you have your Truto MCP URL, you must connect it to your Claude environment. Claude communicates with the MCP server using Server-Sent Events (SSE) and JSON-RPC 2.0 over HTTP POST.

Method 1: Via the Claude UI

If you are using an Enterprise or Team plan with Claude, or utilizing ChatGPT's Custom Connectors interface, you can add the URL directly through the UI:

1. Open your Claude settings.
2. Navigate to Integrations - Add MCP Server.
3. Paste the Truto MCP URL.
4. Click Add. Claude will perform a handshake (initialize), request the tool list (tools/list), and instantly make the Tealium tools available in your chat context.

Method 2: Via Manual Configuration File

For local development using Claude Desktop, you can update your configuration JSON file. Truto's HTTP endpoints require a small bridge to translate Claude's stdio requirements into SSE HTTP requests. You can use the official @modelcontextprotocol/server-sse package to accomplish this.

Locate your claude_desktop_config.json file (typically in ~/Library/Application Support/Claude/ on macOS or %APPDATA%\Claude\ on Windows) and add the following:

{
  "mcpServers": {
    "tealium-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Restart Claude Desktop. The application will execute the npx command, establish the SSE connection, and populate your available tools.

Hero Tools for Tealium

Truto automatically generates highly descriptive snake_case tool names based on the Tealium integration schema. Here are the highest-leverage tools available for your AI agents.

tealium_visitors_search

This tool allows the agent to retrieve a comprehensive visitor profile by searching against a specific Visitor ID attribute (like an email address, user ID, or hashed phone number). The response includes badges, audiences, metrics, and current visit properties.

Contextual Usage: Essential for enriching leads or debugging customer journey issues. The LLM must supply the attributeId (the numerical ID of the attribute in Tealium) and the attributeValue.

"Look up the Tealium visitor profile for user ID 89432. Tell me which audiences they currently belong to and list any active badges."

create_a_tealium_event

Sends a single, real-time event payload to the Tealium Collect endpoint. This tool accepts arbitrary JSON key-value pairs alongside the required account and profile metadata.

Contextual Usage: Use this tool when orchestrating cross-system workflows, such as pushing an offline conversion event from your CRM directly into Tealium EventStream.

"Send a purchase_completed event to Tealium for profile 'main'. Include the visitor_id 'v_9921' and set the revenue attribute to 150.00."

tealium_privacy_visitors_bulk_delete

Queues the deletion of a Tealium visitor record for GDPR, CCPA, or other compliance erasure mandates. It searches by a known identifier and schedules the removal of all associated stitched data.

Contextual Usage: This operation is asynchronous. The tool returns a transactionId. You must instruct the LLM to save this ID or follow up later using the get_single_tealium_privacy_visitor_by_id tool to check if the deletion finished.

"Initiate a GDPR deletion request in Tealium for the visitor with email address privacy@example.com. Give me the transaction ID so we can track it."

tealium_iq_profiles_publish

Triggers a publish event for a saved Tealium iQ Tag Management profile version. It pushes the compiled JavaScript files to the specified targets (e.g., Dev, QA, Prod).

Contextual Usage: This is a high-stakes write operation. Ensure the agent has the correct versionId (formatted as YYYYMMDDhhmm) before calling this tool.

"Publish version 202604121430 of our main iQ profile to the QA environment. Confirm the publish ID once the request succeeds."

tealium_scim_users_partial_update

Executes a precise JSON Patch operation against a Tealium SCIM user profile to update permissions, active status, or display names.

Contextual Usage: The agent must construct a valid SCIM operations array. This is perfect for automated offboarding workflows where an employee needs their access revoked without deleting the historical audit trail.

"Update the SCIM user account for j.doe@example.com in Tealium. Set their 'active' status to false and remove them from the 'Account Admins' group."

tealium_context_api_visitors_search

Retrieves real-time visitor moments from the Tealium Context API. This endpoint is highly optimized for low-latency lookups during active sessions, returning current flags and metrics.

Contextual Usage: Use this when an AI agent acting as a support chatbot needs immediate context on what the user is currently doing on the website (e.g., what page they are on, or what items are in their cart).

"Query the Tealium Context API for the visitor ID currently in this chat session. Tell me their current cart value and if they have the 'High Value' badge active."

For the complete inventory of available Tealium tools and exact JSON Schema specifications, visit the Tealium integration page.

Workflows in Action

By chaining these tools together, Claude can act as an autonomous CDP administrator. Here are two real-world sequences.

Automating GDPR DSAR Deletions

When a customer submits a Data Subject Access Request (DSAR) for erasure, the LLM can handle the entire verification and deletion lifecycle.

"We received a GDPR deletion request for user ID 45992. Verify they exist in Tealium, queue the deletion, and check the status of the transaction."

1. list_all_tealium_privacy_visitors: The agent first calls this to look up the correct internal attribute ID for "User ID".
2. tealium_privacy_visitors_search: The agent verifies the user exists and reviews what data is currently held.
3. tealium_privacy_visitors_bulk_delete: The agent submits the erasure command, receiving transaction_id: "tx_99812" in response.
4. get_single_tealium_privacy_visitor_by_id: The agent immediately polls the transaction ID. It receives a PENDING state and informs the user that the background process has successfully started.

sequenceDiagram
    participant User as User
    participant Claude as Claude Desktop
    participant Truto as Truto MCP
    participant Tealium as Tealium API
    User->>Claude: Delete data for ID 45992
    Claude->>Truto: Call tealium_privacy_visitors_search
    Truto->>Tealium: GET /privacy/visitors?... 
    Tealium-->>Truto: Return visitor payload
    Truto-->>Claude: JSON Schema mapping
    Claude->>Truto: Call tealium_privacy_visitors_bulk_delete
    Truto->>Tealium: POST /privacy/visitors/delete
    Tealium-->>Truto: Return transactionId
    Truto-->>Claude: Return execution state
    Claude-->>User: Deletion queued. ID is tx_99812.

Real-Time Support Enrichment

When a high-tier customer opens a support chat, an AI agent can query their live CDP context before routing the ticket.

"A user just initiated a chat session. Their visitor ID is 'v_7811'. Pull their real-time profile from Tealium and summarize their current engagement state."

1. tealium_context_api_visitors_search: The agent queries the fast Context API using the visitor ID.
2. Analysis: The agent reads the returned badges (e.g., "VIP", "Cart Abandoner") and metrics (e.g., "LTV: $4,500").
3. Output: The agent generates a summary: "This visitor is a VIP with an LTV of $4,500. They currently have the 'Cart Abandoner' badge active. I recommend routing them directly to tier-1 retention support."

Security and Access Control

Exposing an enterprise system like Tealium to an LLM requires strict governance. Truto's MCP architecture provides multiple layers of security at the token level, ensuring agents only touch what they are authorized to touch.

• Method Filtering: You can strictly limit an MCP server to read-only operations. By setting methods: ["read"] during token generation, Truto will strip out all create, update, and delete tools. The LLM simply won't know those operations exist.
• Tag Filtering: Integration resources in Truto are tagged by domain. You can restrict an MCP server to specific functional areas, such as tags: ["privacy", "scim"], keeping the agent completely locked out of the EventStream or iQ tagging configurations.
• API Token Auth (require_api_token_auth): By default, the MCP URL is a secure bearer token. For zero-trust environments, you can enable this flag. It forces the caller to provide a valid Truto API token in the Authorization header on every request, verifying both the URL and the caller's identity.
• Auto-Expiring Servers (expires_at): You can assign a time-to-live timestamp when generating the server. Once the clock hits expires_at, a Cloudflare Durable Object alarm fires, automatically purging the token from the KV store and the database, instantly killing the agent's access.

Architecting for Scale and Rate Limits

When connecting AI agents to Tealium, you must architect defensively against rate limits. An overly eager LLM looping through a list of 1,000 SCIM users will quickly exhaust API quotas.

Truto does not absorb, retry, or apply backoff logic to rate limit errors. When the Tealium API returns an HTTP 429 Too Many Requests, Truto passes that error directly back to the caller. However, Truto does normalize the upstream rate limit information into standardized IETF headers: ratelimit-limit, ratelimit-remaining, and ratelimit-reset.

Your AI orchestration framework (like LangChain, LangGraph, or custom application logic) is fully responsible for reading these headers and managing its own retry and backoff behavior. This architectural choice ensures your system retains total visibility and control over its consumption behavior, preventing hidden latency loops inside the proxy layer.

Integrating Tealium with Claude doesn't have to require weeks of custom TypeScript, undocumented token refreshes, and brittle JSON patching logic. By leveraging a managed MCP server, you can give your AI agents secure, declarative access to your CDP infrastructure - reducing technical debt and accelerating your automation capabilities.