GTM Container Audit: what is inside a Google Tag Manager container

Give it Google Tag Manager container IDs (GTM-XXXX) or websites, and it reads each container's public gtm.js as data and returns an inventory: how many live and paused tags, which tag types, which tracking IDs (GA4, Google Ads, Meta Pixel, TikTok, LinkedIn, Bing UET and more) are configured, which Google Ads accounts are linked, which child containers are nested, and which third-party script hosts the container loads. Plain HTTP, no browser, no proxy, no login, nothing to install in the container. It reads only what Google serves to every visitor of the site.

Who uses it

• Agencies and consultants auditing a client's tag setup before a migration or a privacy review: how many Custom HTML tags, how many paused tags are left behind, which vendors fire.
• Analysts and marketers checking which ad platforms and accounts a competitor's container is wired to.
• Developers who want a container's contents as JSON.

Input

{"containers": ["GTM-N5LT88", "GTM-5KGDZGG"], "urls": ["salesforce.com"]}

containers: GTM IDs. urls: websites; every container on the start page is audited. concurrency, maxInputs limit the run.

Output (one row per container)

{"container": "GTM-N5LT88", "version": "717", "liveTags": 385, "pausedTags": 6,
 "tagTypes": [{"type": "GA4 event", "count": 73}, {"type": "Custom HTML", "count": 71}],
 "customHtmlTags": 71, "customJsVariables": 31, "variables": 190, "triggersAndRules": 214,
 "ids": [{"tool": "Google Ads", "id": "AW-1059368811", "via": "__awct"}],
 "linkedGoogleAdsAccounts": ["AW-1059368811", "AW-864956254", "AW-984961564"],
 "childContainers": [], "scriptHosts": ["analytics.tiktok.com", "connect.facebook.net", "snap.licdn.com"]}

liveTags counts every entry GTM stores as a tag, including click listeners and trigger groups. ids come from live tags only (paused tags are skipped); linkedGoogleAdsAccounts are Ads accounts connected in the container's settings. Container tag types the actor does not know keep GTM's internal name (for example __qpx).

What the tests showed

Run on 36 real containers (found on company sites) plus 5 other inputs (hubspot.com, whose container repeats one already listed, and 4 bad ones): 37 containers audited; with child containers 44 were read. The 4 bad inputs (missing container, not an ID, a site without GTM, not a URL) return a row with a note and are not charged. Of the 44 containers: tag types listed in 44, IDs listed in 43, script hosts in 40, linked Ads accounts in 30, child containers in 4. Every one of the 494 IDs and linked accounts returned exists as text in its container, and the live and paused tag counts match an independent recount, in all 44.

Price

$0.01 per container audited. Missing or private containers, invalid input and sites without GTM are free. The run uses 512 MB of memory; 20 containers took 2.3 s in our test.

Limits

• Only the published version of a container is visible; drafts and workspaces are not.
• Triggers are not evaluated: an ID in a live tag may fire only on some pages or after consent.
• IDs that a container builds from a runtime variable cannot be read.
• Third-party script hosts come from the URLs written in the container; a host built in code is not listed.