agentlytics-mcpCAUTION
Self-hosted measuremy.site: cookieless web analytics your AI agent can read, over MCP. One site, runs on your Cloudflare account (Workers + D1).
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Cookieless web analytics your AI agent can read. A small analytics server for one website, with an MCP server built in, so Claude Code, Cursor or Codex can look at your traffic and help you decide what to do next.
You deploy it to your own Cloudflare account (Workers + D1, the free tier is enough for most small sites). Your data stays in your account.
This repo used to be called agentlytics-mcp. The worker, database, tracker (agentlytics.track) and MCP server keep that name so existing installs keep working.
Example questions and answers; the numbers are illustrative.
Don't want to run it yourself? [measuremy.site](https://measuremy.site/?utm_source=github&utm_medium=referral&utm_campaign=measuremysite-mcp) is the hosted version: same MCP tools, plus a dashboard, AI explanations of traffic spikes, tracking of posts that mention you (Hacker News, Bluesky, YouTube...), alerts and weekly summaries. 30-day free trial, no card; plans from $9 a month.
What your agent can do
Ask in plain words, for example:
- "Why did traffic jump yesterday?" It finds the spike and the source, page or event behind it.
- "Where do people drop off between the homepage and signup?" It builds a funnel and shows the biggest drop.
- "What's working, and what should I post next?" It ranks channels by conversions and turns that into steps.
- "Make a tracked link for my Reddit post, and check how it did next week."
Tools exposed over MCP:
d84945d252f6OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add agentlytics-mcp -- npx -y [email protected]
{
"mcpServers": {
"agentlytics-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (22)
16 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_annotation | write | Record something that may move traffic (deploy, launch, post, email, ad). Future spikes within 24h after it list it as a possible cause. Log what you ship or run. |
create_funnel | write | Save a funnel: an ordered list of 2-8 steps visitors move through, e.g. [\ |
create_tracked_link | write | Create a UTM-tagged link to a page on this site for one campaign, and log it so later traffic, spikes and conversions are credited to it. Use a new link for every post, email or ad you publish. After it is published, call add_annotation so a spike that follows lists it as a cause. |
delete_funnel | destructive | Delete a saved funnel by name or id. |
explain_spike | read | Ranked causes for one spike: which referrers/UTM sources, landing pages and custom events rose above baseline (with lift, % and share of the spike), plus annotations (deploys, posts, emails) in the preceding 24h. |
find_traffic_spikes | read | Detected traffic jumps (hourly pageviews far above the same hour in prior weeks), biggest first, each with its likely causes. |
get_campaign_results | read | Traffic and same-day conversions per tracked campaign (from create_tracked_link), newest first. Omit campaign for all. |
get_funnel | destructive | Where visitors drop off. Shows, for each step, how many visitors reached it, the share of the first step and of the previous step, how many were lost, and the biggest drop. Pass name or id for a saved funnel, steps to try an unsaved one, or nothing to get every saved funnel. |
get_growth_actions | read | Ranked, concrete growth actions derived from this site |
get_overview | read | Visitors and pageviews for the range, change vs the previous equal-length period, plus top sources, pages and events. Start here. |
get_timeseries | read | Pageviews and unique visitors over time, bucketed by hour or day. |
get_whats_working | read | Evidence for marketing planning: channels ranked by conversions with growth and conversion rate, growing pages, and spike causes that recur. Use this before proposing marketing ideas. |
goal | read | Optional goal, e.g. |
list_events | read | Custom events (from agentlytics.track) ranked by count. |
plan_marketing | write | Plan and execute marketing that builds on what already works for this site, then measure it. |
query_visits | read | Answer questions about this site |
recent_visits | read | The most recent individual visits (newest first) matching the same filters as query_visits: time, page, source, country, browser, OS and event properties. |
top_browsers | read | Browsers ranked by pageviews: Chrome, Firefox, Safari, Edge, Opera, Samsung Internet, Other. Visits recorded before browser tracking began are Unknown. |
top_countries | read | Visitor countries ranked by pageviews, with the country name (\ |
top_pages | read | Pages ranked by pageviews. |
top_sources | read | Traffic sources (UTM source, else referrer host, else direct) ranked by pageviews. |
top_systems | read | Operating systems ranked by pageviews: Windows, macOS, iOS, Android, Linux, ChromeOS, Other. Visits recorded before this tracking began are Unknown. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
delete_funnel, get_funnel
streamable-http
.dev.vars.example
@cloudflare/vitest-pool-workers, @cloudflare/workers-types, @types/node, typescript, vitest, wrangler
Gates applied: no_behavioural_pass.
d84945d252f6full audit observations/trust-audit/mcp-server/developeron29__agentlytics-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | d84945d252f6 | CAUTION | B | 89 | first audit |
Questions
What is the agentlytics-mcp MCP server?
Self-hosted measuremy.site: cookieless web analytics your AI agent can read, over MCP. One site, runs on your Cloudflare account (Workers + D1).
What tools does agentlytics-mcp expose?
22 in total: 16 read-only, 4 that write, and 2 that can delete or overwrite (delete_funnel, get_funnel). Every one is listed on this page with its risk.
Is agentlytics-mcp safe to connect to an agent?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agentlytics-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does agentlytics-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as agentlytics-mcp at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (d84945d252f6), read on 2026-10-11. The repository is watched and re-audited when it changes.