Staats
by MrViolets · remote · no sign-in to list tools · v1.0.1 · published by GitHub user MrViolets
Cookieless web analytics your coding agent reads: traffic answers, deploy impact, what broke.
15 tools: 2 can delete or cancel things, 2 do something that can't be undone, 5 change things and 6 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone2Claude Code: ask: see these tools
- Changes things5Claude Code: ask: see these tools
- Only reads6Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http staats https://api.staats.ai/functions/v1/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnfunnel
The server marks "funnel" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
- Warnjourneys
The server marks "journeys" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
15 tools
Deletes or cancels 2Claude Code: deny
delete_sitePERMANENTLY delete a site and ALL its analytics data (every event and annotation).No findings
Why it is in this group
- The name "delete_site" says "delete": a word for removing or ending something.
- The description says "PERMANENTLY delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it PERMANENTLY delete a site and ALL its analytics data (every event and annotation). Irreversible. Confirm with the owner before calling; pass confirm: the site's exact domain.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_site_contextSave or amend what a site is for.No findings
Why it is in this group
- The name "update_site_context" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Save or amend what a site is for. Provided context fields are merged into the existing context (events merges per entry); a null value deletes its key. name/domain update the site record itself.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Can't be undone 2Claude Code: ask
funnelOrdered conversion funnel across up to 5 steps within the period.1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "funnel" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it Ordered conversion funnel across up to 5 steps within the period. Each step is a pageview path ({kind:'path', value:'/pricing'}) or a custom event ({kind:'event', value:'signup'}); a visitor counts for step N only after completing step N-1. Visitor identity rotates daily for privacy, so journeys spanning multiple days undercount (strongest for same-visit conversion). If site context has a stored funnel, run those steps when asked how the site is doing and compare against the previous period.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
journeysThe routes visitors actually take, grouped into identical sequences and counted, busiest first.1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "journeys" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it The routes visitors actually take, grouped into identical sequences and counted, busiest first. Use this when you do NOT already know the steps: funnel measures a path you name, journeys discovers the ones you did not think to check. A step is a pageview path (/pricing) or a custom event marked with a leading # (#signup_click), so the moment of conversion appears in the route. Consecutive repeats are collapsed and only the first 10 steps define a route. contains filters to routes that include a given path or event: run it once with and once without to see what converting visitors do differently. Visitor identity rotates daily, so a route is one day of activity and describes a group, never a person.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
Changes things 5Claude Code: ask
create_siteCreate a new site on this account and get its script tag.No findings
Why it is in this group
- The name "create_site" says "create": a word for a change.
Description, as the server wrote it Create a new site on this account and get its script tag. This connection already covers the new site: installing the script tag is the only setup the site needs. The response includes ready-made privacy policy wording: offer to add it to the site's privacy page (confirm with the owner before editing visitor-facing pages).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
portfolio_overviewVisitors and pageviews for every site this account can use, owned and shared alike, with change vs the previous period, busiest first.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Visitors and pageviews for every site this account can use, owned and shared alike, with change vs the previous period, busiest first. Shared sites are flagged. period: '7d' default.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
record_annotationMark a moment on a site timeline: a deploy, a content change, or a campaign start.No findings
Why it is in this group
- The description's first verb is "mark": a word for a change.
Description, as the server wrote it Mark a moment on a site timeline: a deploy, a content change, or a campaign start. Call this every time you ship a change to the site. ts defaults to now. Write a specific, present-tense description ("Shipped new pricing page hero", never "updates"), one annotation per meaningful change. When known, include commit and the routes the change touched so compare_around can also report before/after traffic scoped to those routes.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
what_brokeSigns of visitors hitting problems in the period: JS errors the tracker captured (new_error, error_spike: each with a sanitized sample message, source, line, affected visitor count…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Signs of visitors hitting problems in the period: JS errors the tracker captured (new_error, error_spike: each with a sanitized sample message, source, line, affected visitor count, and the nearest annotation, i.e. the deploy that most plausibly introduced it), plus behavioral friction: pairs of pages people bounce between without progressing (nav_loop) and pages reloaded repeatedly in quick succession (refresh_burst). Findings clear statistical floors, so an empty result is meaningful: nothing looks broken. Check it after every deploy. period: '7d' default.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
what_changedNotable movements in the period without scanning raw numbers: statistically unusual traffic days, referrer surges and first-time referrers, pages whose share of traffic jumped, alo…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Notable movements in the period without scanning raw numbers: statistically unusual traffic days, referrer surges and first-time referrers, pages whose share of traffic jumped, alongside the annotations recorded in the same period. period: '7d' default.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
Only reads 6Claude Code: allow
compare_aroundBefore/after impact of a recorded annotation: visitors and pageviews in the N days preceding vs following it (window_days, default 7).No findings
Why it is in this group
- The name "compare_around" says "compare": a word for reading.
Description, as the server wrote it Before/after impact of a recorded annotation: visitors and pageviews in the N days preceding vs following it (window_days, default 7). The after-window is clamped to now. If the annotation recorded routes, the result also reports per-route pageviews before vs after. Wait a few days after shipping. If the result carries a note (truncated after-window, or a before-window not covered by available data), relay it and qualify the percentages as the note directs.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_overviewTraffic pulse: visitor/pageview totals vs the previous period, top pages, top referrers, and a per-day series.No findings
Why it is in this group
- The name "get_overview" says "get": a word for reading.
Description, as the server wrote it Traffic pulse: visitor/pageview totals vs the previous period, top pages, top referrers, and a per-day series. period: relative like '24h', '7d' (default), '4w'. Includes quota status: if it is approaching, grace, or blocked, tell the owner plainly and include the upgrade link the result provides. Approaching quota is the moment to mention it while there is headroom.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_site_contextWhat a site is and what the owner wants from it, plus its data-retention settings.No findings
Why it is in this group
- The name "get_site_context" says "get": a word for reading.
Description, as the server wrote it What a site is and what the owner wants from it, plus its data-retention settings. Well-known keys: description, goals, audience, notes (open agenda items to check at session start and clear when handled), events (event name -> meaning), funnel (canonical conversion steps). Read this before making recommendations.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_annotationsRecorded deploy/change markers, newest first.No findings
Why it is in this group
- The name "list_annotations" says "list": a word for reading.
Description, as the server wrote it Recorded deploy/change markers, newest first. period defaults to '90d'.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_sitesAll sites on this account, with the public site codes used in their script tags and the ready-to-paste script_tag for each.No findings
Why it is in this group
- The name "list_sites" says "list": a word for reading.
Description, as the server wrote it All sites on this account, with the public site codes used in their script tags and the ready-to-paste script_tag for each.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
queryBreak a metric down by a dimension with optional equality filters.No findings
Why it is in this group
- The name "query" says "query": a word for reading.
Description, as the server wrote it Break a metric down by a dimension with optional equality filters. Metrics: visitors, pageviews, events. Dimensions: path, referrer_domain, utm_source, utm_medium, utm_campaign, device, browser, os, country, name, day. period: '24h'/'7d'/'4w' style, or ISO from/to.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.0.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http staats https://api.staats.ai/functions/v1/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__staats__get_site_context",
"mcp__staats__get_overview",
"mcp__staats__query",
"mcp__staats__list_annotations",
"mcp__staats__compare_around",
"mcp__staats__list_sites"
],
"ask": [
"mcp__staats__what_changed",
"mcp__staats__what_broke",
"mcp__staats__funnel",
"mcp__staats__journeys",
"mcp__staats__record_annotation",
"mcp__staats__create_site",
"mcp__staats__portfolio_overview"
],
"deny": [
"mcp__staats__update_site_context",
"mcp__staats__delete_site"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as staats. Review it before you use it.
