DataStated Documentation Add my site
Add my site

MCP server

DataStated speaks MCP, the protocol AI agents use to reach tools. Connect Claude Code, Cursor or any MCP client with an API key and the agent gets one tool per API endpoint, with exactly the permissions the key holds and nothing the REST API cannot do.

Takes about two minutes

Ad platform data

The API and MCP server answer from DataStated’s own reports: the numbers already pulled into your account and DataStated’s comparisons with your orders. They never forward a request to Google Ads, Meta or TikTok, and they cannot create, change or pause a campaign, budget, bid or ad. Ad platform data is read-only everywhere in DataStated.

To call the Google Ads API from your own code, use your own Google Cloud project and your own Google Ads API access. A DataStated key grants neither.

Claude desktop and claude.ai: sign in, no key

In Claude, open Settings, then Connectors, choose Add custom connector and paste https://app.datastated.com/api/mcp. Select Connect, sign in to DataStated and approve. There is no key to copy. The connection can read your analytics and manage goals and chart notes. It appears under your API keys as “Claude (connected app)”, and revoking that key disconnects it. Any client that supports MCP sign-in (OAuth) connects the same way; the steps below are for clients that take a key.

Connect from the app

The quickest way to connect Cursor, VS Code or Claude Code is the Connect your AI tools card at the top of a site’s Settings → API tab, or of the API keys tab on your account page. Select Create a key for AI tools. It makes a key named “AI tools (MCP)” with analytics:read, goals:* and annotations:*, never Everything, so it can read analytics and manage goals and chart notes but cannot change settings, people, billing or other keys. From Settings → API the key works on that site only; from the account page it works on all your sites.

The key is shown once and is already filled in below it. Choose your tool: Add to Cursor and Add to VS Code open the editor and ask you to confirm adding the DataStated server (VS Code uses GitHub Copilot in agent mode). For Claude Code, copy the command and run it in your terminal. Other apps gives a JSON config, and Terminal (CLI) shows how to sign in to the CLI. To set up a key by hand instead, follow the steps below.

1. Get your API key

Sign in and create a key on your account page or a site's Settings → API tab; it starts with dsk_ and is shown once. Pick the permissions it carries (Read analytics is enough to ask questions) and, if you like, pin it to some of your sites. The API reference lists every permission.

2. Connect your client

Claude Code, one command:

claude mcp add --scope user --transport http datastated https://app.datastated.com/api/mcp \
  --header "Authorization: Bearer dsk_YOUR_KEY"

--scope user makes the server available in every folder and in the Claude desktop app’s Code tab, not only in the folder where you ran the command.

Cursor, in .cursor/mcp.json:

{
  "mcpServers": {
    "datastated": {
      "url": "https://app.datastated.com/api/mcp",
      "headers": { "Authorization": "Bearer dsk_YOUR_KEY" }
    }
  }
}

Any other client: point it at https://app.datastated.com/api/mcp over Streamable HTTP with your key as a Bearer header. The server is stateless: every request is authenticated by its own header, and there is no server-initiated stream (a GET answers 405).

3. Ask

  • "How is my site doing this week compared to last?"
  • "Did Meta actually earn its spend in August?"
  • "Which AI assistants read the docs last week, and were they really who they said?"
  • "What did people search for to land on the pricing page?"
  • "Add a funnel from /pricing to the signup goal, then show me its drop-off."

The Shopify backfill is the datastated_shopify_backfill tool.

Tool naming

One tool per catalogued REST route, named datastated_<resource>_<action>: tools across sites, analytics, breakdowns, timeseries, visitors, segments, funnels, goals, alerts, annotations, digest, public_dashboard, settings, integrations, team, keys, events, crawls, identify, sync, billing and shopify. Each tool's description says what it does, what it returns, the REST route behind it and the permission it needs. Path and query parameters and body fields become the tool's arguments; routes that take dashboard filters get one filters object keyed like the URL grammar without the f_ prefix, for example {"channel": "google-ads", "page.contains": "pricing"}.

The six names from the first release still work as aliases: list_sites, site_window, site_claims, site_crawls, site_search and site_live, each pointing at the tool it meant. datastated_help hands an agent the whole catalogue as data, one row per tool with tool, rest, summary, scope, role, destructive and aliasOf; pass resource to narrow it. Start there.

Destructive tools ask first

Anything that deletes, revokes, disconnects or rotates needs confirm: true; without it the tool answers a dry run and nothing happens. That is decided before any handler runs. The tools it applies to: datastated_segments_delete, datastated_funnels_delete, datastated_goals_delete, datastated_alerts_delete, datastated_annotations_delete, datastated_public_dashboard_regenerate, datastated_integrations_disconnect, datastated_team_cancel_invite, datastated_team_remove and datastated_keys_revoke.

{ "dryRun": true,
  "wouldCall": "DELETE /api/sites/acme.com/funnels/fun_123",
  "summary": "Delete a funnel.",
  "howToProceed": "Call datastated_funnels_delete again with confirm: true to do it." }

What a tool answers

The route's own JSON, as text and, when it parses, as structuredContent so an agent need not read prose. isError follows the HTTP status. The shape is the REST API's: the envelope on the newer routes, the bare payload on the older ones, as the API reference describes. Errors come back structured, never as prose alone.

Security

  • Every tool call builds a request and runs the REST route in-process, so authentication, permissions, site scoping and response shapes are exactly the REST API's. A capability the REST API does not have cannot exist here.
  • No secrets in list tools. datastated_keys_list never returns key values and datastated_integrations_list never returns a credential. datastated_keys_create answers with the new key once, so grant Manage API keys only to an agent you would hand a key to.
  • Connecting an integration happens in the dashboard. An agent can list what is connected, run a sync, and disconnect with confirm: true; it cannot connect one, and disconnecting Shopify is refused (uninstall the app from the Shopify admin instead).
  • Tools that change who can reach your account or where its data goes (inviting people, changing roles, removing people, creating keys, alert and digest recipients, publishing the public dashboard, rotating its public link, billing and settings) need a key created with that permission itself. A key with every permission is not enough over MCP, so text planted in your analytics cannot talk an agent into them.
  • Analytics values such as page paths, referrers and campaign names are data sent by your visitors. The server tells agents not to act on text inside them.
  • A tool call is one request against the key's limit of 600 a minute, never two.
  • Revoke any key on the site's Settings → API tab or your account page and it stops working on its next request.
  • Included on every plan, with no separate charge.

Questions? Email us at hello@datastated.com.