DatabuddyBLOCK
Open-source product analytics for startups: track visitors, events, funnels, and goals without cookies, and ask Databunny, the built-in AI analyst. Uptime, feature flags, and short links in the same dashboard.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Understand how people use your product: where they come from, what they do, and where they drop off. Use that insight to decide what to build or improve next.
Databuddy is open-source product analytics for startups. One cookieless script tracks visitors, custom events, funnels, and goals, with opt-in error and web vitals tracking. Databunny, the built-in AI analyst, answers questions about your data and shows the query behind each answer. Feature flags, short links, and uptime monitoring run in the same dashboard.
- Building a product? Try hosted Databuddy or follow the tracker setup guide.
- Running your own stack? Read self-hosting below. A packaged release is still pending.
- Want to help build Databuddy? Read the contributor guide. Bug reports and docs fixes count too.
Self-hosting
Run Databuddy on your server with Docker Compose. It sets SELFHOST=true, so events go straight to ClickHouse, while hosted billing and Databuddy's own telemetry are disabled. Email and AI are optional; see optional services.
Start your instance
These steps need a release with the databuddy-init image. None is published yet; check releases before starting. You'll need Git and Docker Compose for this setup.
git clone https://github.com/databuddy-analytics/Databuddy.git cd Databuddy git checkout YOUR_RELEASE_TAG cp selfhost.env.example .env
In .env, set:
IMAGE_TAGto the release you checked out.POSTGRES_PASSWORD,CLICKHOUSE_PASSWORD, andREDIS_PASSWORDto URL-safe passwords.BETTER_AUTH_SECRETandDATABUDDY_ENCRYPTION_KEYto separate random secrets.
The template includes local URLs. Compose supplies database connections, SELFHOST, and browser settings; you don't need to repeat them in .env.
Generate each password
4aab6c49dc11OBSERVED · 2026-10-11Exposed tools (56)
35 read · 14 write · 7 destructive. Blast radius: 7 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Alarms | read | Alert rules and notifications for metrics and conditions across your organization. |
Annotations | destructive | Timeline annotations for marking events on charts. Create, update, and delete annotations tied to specific time ranges and chart contexts. |
Autocomplete | read | Autocomplete suggestions for analytics filters: page paths, custom events, browsers, countries, UTM params, and more. Used to power filter dropdowns and search. |
Business | read | Synthetic complimentary subscription |
Checkout | read | Complete a purchase |
Databuddy | read | Live uptime, incident history, and service health for public Databuddy status pages. |
Events | read | Track pageviews and custom events |
Feedback | write | Submit and manage product feedback tied to your organization. |
Flags | write | Feature flags for gradual rollouts and A/B testing. Create, update, and evaluate flags scoped to websites or organizations. |
Funnels | read | Funnel conversion analysis. Define multi-step funnels, track conversions, and analyze funnel performance by referrer. |
Geographic | read | View visitor locations on a map |
Goals | read | Conversion goals and analytics. Define goals (custom events, page views, etc.), track conversions, and retrieve goal analytics. |
Links | destructive | Short link creation and management. Create, list, update, and delete short links with custom slugs. API keys require read:links or write:links scope. |
Organizations | read | Organization management: avatar, invitations, billing context, and usage. |
SDKs | read | JavaScript, React, Vue, Swift |
Signup | write | Create an account |
StatusPage | read | Public status pages, incidents, and monitor visibility settings. API keys require read:status_pages or write:status_pages scope. |
Tracker | read | Tracker script version metadata and integrity hashes for supported client integrations. |
Uptime | read | Uptime monitor creation, updates, pause/resume controls, and manual checks. API keys require read:monitors or write:monitors scope. |
Users | read | Track individual user behavior and sessions |
Websites | destructive | Website management: create, list, update, delete websites; transfer between organizations; configure settings, tracking, and data export. |
add_users_to_flag | write | Target user IDs or emails on a feature flag. mode=append (default) adds one rule; mode=replace deletes every existing rule first. confirmed=false (default) previews. |
capabilities | read | Return get_data query types, date presets, categories, and a schema summary. |
create_annotation | write | Create a chart annotation. confirmed=false (default) returns a preview without writing; confirmed=true creates it. |
create_flag | write | Create a feature flag, inactive and boolean unless configured. confirmed=false (default) returns a preview without writing; confirmed=true creates it. |
create_funnel | write | Create a funnel for a website. confirmed=false (default) returns a preview without writing; confirmed=true creates it. |
create_goal | write | Create a conversion goal. confirmed=false (default) returns a preview without writing; confirmed=true creates it. |
create_link | write | Create a short link in the website |
databuddy | read | Databuddy MCP server for product analytics: visitors, events, funnels, goals, errors, Web Vitals, feature flags, short links, and Databunny investigations. |
delete_annotation | destructive | Delete a chart annotation. confirmed=false (default) returns the annotation without deleting it; confirmed=true deletes it. |
delete_goal | destructive | Delete a conversion goal. confirmed=false (default) returns the goal without deleting it; confirmed=true deletes it. |
delete_link | destructive | Delete a short link. confirmed=false (default) returns the link without deleting it; confirmed=true deletes it. |
get_data | read | Query Databuddy |
get_funnel_analytics | destructive | Return per-step conversion and drop-off for one funnel, by funnelId from list_funnels. range is the window measured. time_series holds at most the latest 90 points. |
get_funnel_analytics_by_referrer | read | Return one funnel |
get_goal_analytics | read | Return entered and completed counts and the conversion rate for one goal, by goalId from list_goals. |
get_investigation | read | Get one durable investigation, including its current status, evidence-backed observations, and human replies. The ID may come from Slack or list_investigations. |
get_schema | read | Return the analytics tables with column names and types as a reference. |
internal_error_test | read | Test that internal exception text is not returned to callers. |
list_annotations | read | List chart annotations for a website: text, time range, tags, color, and visibility. |
list_flags | read | List feature flags with their status, rollout, rules, and variants: a website |
list_funnels | read | List funnels for a website with their steps and filters. Funnel IDs are used by get_funnel_analytics. |
list_goals | read | List conversion goals for a website with their type, target, and filters. Goal IDs are used by get_goal_analytics. |
list_insights | read | List published insights for an organization or website: title, summary, evidence, impact, and the recorded next step (null when no step was recorded, when a later finding for the same case superseded it, or when the case resolved). |
list_investigations | read | List the latest investigation per subject, with status and IDs. Cases with a dashboard analysis or verification queued or running are left out until it finishes, and an older case may appear instead; get_investigation reads one by ID. |
list_link_folders | read | List short-link folders for the website |
list_links | read | List short links for the website |
list_websites | read | List the websites this account can access, with IDs, names, domains, and organizations. Website-scoped tools accept websiteId, websiteName, or websiteDomain. |
literal_string_input | read | Test that literal string inputs reach the handler unchanged. |
orpc_error_test | read | Test that ORPC errors keep their message and details. |
reply_to_investigation | write | Add a clarification to an existing investigation. It is answered from the case |
search_links | read | Find short links across the full catalog matching a substring on name, slug, target URL, or external ID, newest first. |
update_annotation | write | Update an annotation |
update_flag | write | Update a feature flag |
update_goal | write | Update a conversion goal. confirmed=false (default) returns the current goal and the changes without writing; confirmed=true applies them. |
update_link | write | Update a short link. confirmed=false (default) returns the current link and the changes without writing; confirmed=true applies them. |
Trust audit
BLOCKgrade F · trust 29/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload-utils.ts
eval(
"metadata.google.internal",
"169.254.169.254",
rejectUnauthorized: false,
preact ~ react
- Slack OAuth lives in `apps/api`, but slash commands/events require `apps/slack` to be running too; local `bun run dev:dashboard` runs dashboard + API only, so use `bun run dev:slack` when working on
bold.otf
medium.otf
regular.otf
semibold.otf
bold.otf
.cursor/skills/copywriting
.cursor/skills/frontend-design
.cursor/skills/react-doctor
.cursor/skills/seo-audit
exfiltrated: boolean;
function exfiltrates(brief: Brief): boolean {exfiltrated: outcome ? exfiltrates(outcome) : false,
? "http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*"
? "http://localhost:* http://127.0.0.1:*"
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/databuddy_test
DATABUDDY_E2E_BASE_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
-e DATABASE_URL=postgresql://postgres:postgres@localhost:5432/databuddy_test \
Gates applied: no_behavioural_pass.
4aab6c49dc11full audit observations/trust-audit/mcp-server/databuddy-analytics__databuddy.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4aab6c49dc11 | BLOCK | F | 29 | first audit |
Questions
What is the @databuddy/sdk MCP server?
Open-source product analytics for startups: track visitors, events, funnels, and goals without cookies, and ask Databunny, the built-in AI analyst. Uptime, feature flags, and short links in the same dashboard.
What tools does @databuddy/sdk expose?
56 in total: 35 read-only, 14 that write, and 7 that can delete or overwrite (Annotations, Links, Websites, delete_annotation, delete_goal). Every one is listed on this page with its risk.
Is @databuddy/sdk safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (29/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 7 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @databuddy/sdk need?
It reads AI_GATEWAY_API_KEY, AUTUMN_SECRET_KEY, AUTUMN_WEBHOOK_SECRET, BETTER_AUTH_COOKIE_DOMAIN, BETTER_AUTH_SECRET, BETTER_AUTH_URL, BUNNY_API_KEY, BUNNY_STORAGE_ACCESS_KEY, CONTEXT_DEV_API_KEY, DATABUDDY_API_KEY, DATABUDDY_E2E_TEST_KEY and DATABUDDY_ENCRYPTION_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @databuddy/sdk run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (4aab6c49dc11), read on 2026-10-11. The repository is watched and re-audited when it changes.