DataStated Documentation Add my site
Add my site

MCP server

DataStated speaks MCP, the protocol AI agents use to reach tools. Connect Claude Code, Cursor or any MCP client with an API key and the agent gets one tool per API endpoint, with exactly the permissions the key holds and nothing the REST API cannot do.

Takes about two minutes

1. Get your API key

Sign in and create a key on your account page or a site's Settings → API tab; it starts with dsk_ and is shown once. Pick the permissions it carries (Read analytics is enough to ask questions) and, if you like, pin it to some of your sites. The API reference lists every permission.

2. Connect your client

Claude Code, one command:

claude mcp add --transport http datastated https://app.datastated.com/api/mcp \
  --header "Authorization: Bearer dsk_YOUR_KEY"

Cursor, in .cursor/mcp.json:

{
  "mcpServers": {
    "datastated": {
      "url": "https://app.datastated.com/api/mcp",
      "headers": { "Authorization": "Bearer dsk_YOUR_KEY" }
    }
  }
}

Any other client: point it at https://app.datastated.com/api/mcp over Streamable HTTP with your key as a Bearer header. The server is stateless: every request is authenticated by its own header, and there is no server-initiated stream (a GET answers 405).

3. Ask

  • "How is my site doing this week compared to last?"
  • "Did Meta actually earn its spend in August?"
  • "Which AI assistants read the docs last week, and were they really who they said?"
  • "What did people search for to land on the pricing page?"
  • "Add a funnel from /pricing to the signup goal, then show me its drop-off."

The separate Shopify backfill endpoint is not yet a catalogued MCP tool. Call it over HTTP.

Tool naming

One tool per catalogued REST route, named datastated_<resource>_<action>: tools across sites, analytics, breakdowns, timeseries, visitors, segments, funnels, alerts, annotations, digest, public_dashboard, settings, integrations, team, keys, events, crawls, identify, sync and billing. Each tool's description says what it does, what it returns, the REST route behind it and the permission it needs. Path and query parameters and body fields become the tool's arguments; routes that take dashboard filters get one filters object keyed like the URL grammar without the f_ prefix, for example {"channel": "google-ads", "page.contains": "pricing"}.

The six names from the first release still work as aliases: list_sites, site_window, site_claims, site_crawls, site_search and site_live, each pointing at the tool it meant. datastated_help hands an agent the whole catalogue as data, one row per tool with tool, rest, summary, scope, role, destructive and aliasOf; pass resource to narrow it. Start there.

Destructive tools ask first

Anything that deletes, revokes, disconnects or rotates needs confirm: true; without it the tool answers a dry run and nothing happens. That is decided before any handler runs. The tools it applies to: datastated_segments_delete, datastated_funnels_delete, datastated_alerts_delete, datastated_annotations_delete, datastated_public_dashboard_regenerate, datastated_integrations_disconnect, datastated_team_cancel_invite, datastated_team_remove and datastated_keys_revoke.

{ "dryRun": true,
  "wouldCall": "DELETE /api/sites/acme.com/funnels/fun_123",
  "summary": "Delete a funnel.",
  "howToProceed": "Call datastated_funnels_delete again with confirm: true to do it." }

What a tool answers

The route's own JSON, as text and, when it parses, as structuredContent so an agent need not read prose. isError follows the HTTP status. The shape is the REST API's: the envelope on the newer routes, the bare payload on the older ones, as the API reference describes. Errors come back structured, never as prose alone.

Security

  • Every tool call builds a request and runs the REST route in-process, so authentication, permissions, site scoping and response shapes are exactly the REST API's. A capability the REST API does not have cannot exist here.
  • No secrets in list tools. datastated_keys_list never returns key values and datastated_integrations_list never returns a credential. datastated_keys_create answers with the new key once, so grant Manage API keys only to an agent you would hand a key to.
  • Connecting an integration happens in the dashboard. An agent can list what is connected, run a sync, and disconnect with confirm: true; it cannot connect one, and disconnecting Shopify is refused (uninstall the app from the Shopify admin instead).
  • A tool call is one request against the key's limit of 600 a minute, never two.
  • Revoke any key on the site's Settings → API tab or your account page and it stops working on its next request.
  • Included on every plan, with no separate charge.

Questions? Email us at hello@datastated.com.