Ask Your Analytics From Claude: AI Traffic Over MCP

A dashboard answers the questions somebody anticipated when they built it. The question you actually have on a Tuesday afternoon is usually a join across three of them: which assistant drove the most revenue last month, what those buyers read before they paid, and whether that page is still being crawled. Answering it by hand means three tabs, two exports and a spreadsheet.

The Model Context Protocol lets an assistant such as Claude call your analytics directly and do that join in the conversation you are already having. Traceten runs a remote MCP server, so there is nothing to install. This post walks through what happens when you ask a question, how to connect, and the three things that stop an assistant with access to your analytics from doing something you did not intend.

Say you ask Claude which assistant sent the most revenue last month and what those visitors read first. Four things happen, and you can watch each one in the conversation.

Two details make the answers more trustworthy than a model improvising over a CSV. First, the server sends the assistant a short brief on every connection, and it names the two mistakes that most often produce wrong numbers: the assistant a visit came from and the category of traffic it belongs to are different things that must never be added together, and a session is one visit, not one person. Second, dates are UTC calendar days and money arrives either in whole cents or explicitly labelled as dollars, so the model is not left guessing at units.

There are two ways to connect, and they carry different permissions on purpose.

Sign in with your Traceten account. In Claude, you add a custom connector with the server's address, then sign in and pick your organization. This follows the MCP authorization spec, which builds on OAuth 2.1: the server tells the client where to sign in through a standard metadata document (RFC 9728), so the address is the only thing you type. A connection made this way acts as you, in the organization you chose, including any restriction to particular sites. It can read everything you can read and change configuration such as goals and funnels.

It can never mint a credential. Creating an API key, a crawler token or a webhook secret is refused over a signed-in connection. The reason is not distrust but asymmetry: a connection stops working when you remove the person from your organization, while a key minted through that connection would keep working indefinitely and would not appear anywhere the connection does. A credential with a short leash should not be able to leave behind one with no leash at all. Do those in the dashboard.

Paste an API key. Anything that speaks MCP can use a key instead, including tools without a sign-in flow and CI jobs. The key carries the permissions you ticked when you created it: read statistics, write configuration, and write credentials. Start with read-only. A read-only key still sees every tool, and a write tool fails with an error naming the permission it lacks. That is deliberate. If the write tools were hidden, the assistant would tell you Traceten cannot create a goal, which is false. Instead it tells you your key is not allowed to, which is true and fixable.

The MCP specification says that for trust and safety there should always be a human in the loop with the ability to deny tool invocations, and that clients should ask for confirmation on sensitive operations. Clients differ in how well they do that, so the server does not rely on it.

A preview before anything irreversible. Twelve tools delete something, issue a credential, or change how your numbers are measured: revoking an API key, deleting a funnel, registering a webhook, and changing the cookie scope of a site, among others. Called normally, each returns a description of what would happen and changes nothing. The assistant shows you the preview; only a second call that explicitly confirms makes the change. Registering a webhook is the one to read most carefully, because it starts a continuous flow of your data to the address in the call.

Typed text is marked as data. A chart note is free text any teammate can write, and an assistant that reads it could be steered by it. So people-authored text reaches the assistant wrapped and labelled as untrusted, beside a notice that it is data to report, never instructions to follow, whatever it says. This is a defence against prompt injection arriving through your own analytics.

One call per request. Batched requests are refused, so a single request cannot fan out into hundreds of calls.

Aggregate tools return counts and totals. Some tools return rows about individual visits and visitors, because joining an AI discovery visit to a purchase days later is the question this product exists to answer. Those rows carry an opaque handle rather than any identifier, and a handle is sealed to the site it was issued for, so it means nothing on another site. Every tool description states in plain words what data leaves your account when it runs, so the assistant can tell you before it calls.

The practical upshot is a working pattern rather than a feature. Ask the broad question in plain language, let the assistant pick the calls, and check its working when a number matters. When it proposes to change something, read the preview as carefully as you would read a pull request. The full tool list and the safety model are in the MCP documentation.