Umami MCP Server
This server provides read-only access to Umami analytics (Cloud and self-hosted 3.x) with tools to:
Get Websites: List tracked websites with search, pagination, and team filtering.
Get Stats: Retrieve summary statistics (pageviews, visitors, visits, bounces, total time) with comparison options.
Get Pageviews: Fetch time series data for pageviews and sessions, with granularity (hour, day, month, year) and comparisons.
Get Metrics: Query detailed metrics by dimensions (e.g., browser, country, referrer, UTMs) with pagination and filters.
Get Active: See current active visitors.
All tools support extensive filters (path, referrer, browser, country, OS, etc.), flexible time ranges, and optional comparisons. Authentication supports API key (Cloud) or username/password (self-hosted). The server includes caching, retries, rate limiting, and error handling for reliability.
Provides tools to interact with Umami Cloud and self-hosted analytics, allowing for listing websites, retrieving visitor statistics, tracking page traffic over time, analyzing device and geographic metrics, and monitoring real-time active visitors.
Umami MCP Server
MCP server exposing read-only analytics from the current Umami Cloud API and self-hosted Umami 3.x.
Support matrix
Deployment | Support | API root | Authentication |
Umami Cloud (current) | Supported |
| API key |
Self-hosted Umami 3.x | Supported |
| Username/password |
Self-hosted Umami 2.x | Not supported; any future integration will be separate | — | — |
Umami 1.x | Not supported | — | — |
The /v1 suffix belongs to the current Cloud API URL. It does not mean that this
server supports version 1 of the self-hosted Umami application.
Related MCP server: Umami MCP Server
Requirements and run command
Python 3.11+
Run the published package directly:
uvx umami-mcp-serverConfiguration
Environment variables:
UMAMI_API_KEY: Umami Cloud API key.UMAMI_USERNAME: self-hosted Umami 3.x username.UMAMI_PASSWORD: self-hosted Umami 3.x password.UMAMI_API_BASE: optional; defaults tohttps://api.umami.is/v1. For self-hosted deployments, set the API root including/api.
Choose exactly one authentication mode: a Cloud API key or self-hosted username and
password. Cloud API keys use the documented Authorization: Bearer scheme; standard
self-hosted Umami 3.x does not support API keys.
Example MCP configuration for Cloud:
{
"mcp": {
"umami": {
"type": "local",
"command": ["uvx", "umami-mcp-server"],
"environment": {
"UMAMI_API_KEY": "YOUR_UMAMI_CLOUD_API_KEY",
"UMAMI_API_BASE": "https://api.umami.is/v1"
},
"enabled": true
}
}
}Self-hosted Umami 3.x:
{
"mcp": {
"umami": {
"type": "local",
"command": ["uvx", "umami-mcp-server"],
"environment": {
"UMAMI_USERNAME": "YOUR_USERNAME",
"UMAMI_PASSWORD": "YOUR_PASSWORD",
"UMAMI_API_BASE": "https://your-umami.example/api"
},
"enabled": true
}
}
}Tools
get_websites: return one page of websites.page >= 1and1 <= page_size <= 100.get_stats: summary pageviews, visitors, visits, bounces, total time, and comparison.get_pageviews: pageview and session time series.get_metrics: compact or expanded metrics.1 <= limit <= 500and0 <= offset <= 10000.get_active: current active visitors.
Every website_id, segment, and cohort identifier is validated as a UUID before an HTTP
request is sent.
Time ranges
Datetime parameters accept ISO datetimes. Naive values are interpreted as UTC. The four range rules are:
Inputs | Range |
neither | now minus seven days → now |
only | seven days before |
only |
|
both | explicit range |
The end must be later than the start. Pageview units are minute, hour, day, month,
and year. Timezones must be valid IANA names such as UTC or Europe/Rome. Comparisons
are prev or yoy.
Metrics and filters
Metric types:
path, fullPath, entry, exit, referrer, domain, title, query,
event, tag, hostname, utmSource, utmMedium, utmCampaign,
utmContent, utmTerm, browser, os, device, screen, language,
country, city, region, distinctId, channelDocumented Umami 3 filters:
path, referrer, title, query, browser, os, device, country,
region, city, language, hostname, tag, event, distinctId,
utmSource, utmMedium, utmCampaign, utmContent, utmTerm,
segment, cohortTool input uses snake_case for distinct_id and the UTM filters; the server serializes the
upstream camelCase names automatically.
Reliability and safe errors
One HTTP client and connection pool is shared for the MCP server lifespan. Login-mode tokens
are shared, concurrent login/refresh is synchronized, and a request can perform at most three
analytics sends and one token refresh. GET requests retry only network failures, timeouts,
rate limits, and transient 500, 502, 503, and 504 responses. Retry-After is honored
up to 60 seconds.
Errors are exposed as controlled categories: authentication, rate limit, timeout, network, upstream failure, and invalid response. Public messages and logs exclude response bodies, credentials, headers, complete query URLs, and raw HTTP/Pydantic exception values.
Cache and observability
On the current MCP revision, the static tools/list catalog has a public five-minute cache
hint. Tool order and schema content are deterministic, and the catalog contains no Umami
data, website IDs, or credentials. Legacy protocol serialization remains unchanged and does
not include cache fields.
MCP SDK already traces incoming MCP operations. Umami MCP Server adds a child span for each logical Umami analytics request, a child login span when needed, and metrics for duration, errors, retries, rate limits, and token refreshes. Only W3C Trace Context is propagated to Umami; MCP baggage is not forwarded.
The base package uses only the OpenTelemetry API, so instrumentation remains no-op without an
SDK and exporter. Install the optional stack with umami-mcp-server[otel], configure it
externally, or disable it explicitly with OTEL_SDK_DISABLED=true. See
the observability guide for setup, exported names, redaction policy,
and OTLP examples.
Development
uv sync --dev
uv run ruff format . --check
uv run ruff check .
uv run pyright
uv run pytestThe optional live Cloud contract test requires UMAMI_LIVE_CLOUD_API_KEY and
UMAMI_LIVE_CLOUD_WEBSITE_ID; UMAMI_LIVE_CLOUD_API_BASE may override the default Cloud
root.
Available Tools
5 toolsget_activeD
Current active visitors.
| Name | Required | Description | Default |
|---|---|---|---|
| website_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The description 'Current active visitors' gives no insight into behavioral traits such as whether this is a read-only operation, what permissions might be required, how data is returned (e.g., format, pagination), or any rate limits. It fails to provide any meaningful context beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with just three words, making it front-loaded and free of unnecessary details. However, this brevity borders on under-specification, as it sacrifices clarity and completeness for conciseness. Every word earns its place, but more content is needed to be helpful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a data retrieval tool with one parameter) and the presence of an output schema (which might cover return values), the description is incomplete. It lacks purpose clarity, usage guidelines, parameter semantics, and behavioral transparency. While the output schema could mitigate some gaps, the description fails to provide enough context for the agent to understand when and how to use this tool effectively compared to siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter (website_id) with 0% description coverage in the schema itself. The tool description 'Current active visitors' adds no information about this parameter—it doesn't explain what website_id represents, how to obtain it, or its role in filtering results. With low schema coverage and no compensation in the description, this leaves the parameter's meaning entirely undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Current active visitors' restates the tool name 'get_active' in different words, making it tautological. It doesn't specify what action the tool performs (e.g., 'retrieve', 'fetch', 'list') or what resource it operates on beyond the vague 'visitors'. While it implies reading visitor data, it lacks the specific verb+resource clarity needed to distinguish it from sibling tools like get_metrics or get_pageviews.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like get_metrics, get_pageviews, get_stats, or get_websites. It doesn't mention any context, prerequisites, or exclusions for usage. This leaves the agent with no information to make an informed choice among the available sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metricsD
See browsers, countries, devices, and more.
| Name | Required | Description | Default |
|---|---|---|---|
| website_id | Yes | ||
| type | Yes | ||
| start_at | No | ||
| end_at | No | ||
| limit | No | ||
| offset | No | ||
| expanded | No | ||
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure but provides none. It doesn't indicate whether this is a read or write operation, what permissions might be required, whether there are rate limits, what the return format looks like, or any other behavioral characteristics. The phrase 'See browsers, countries, devices, and more' gives no insight into how the tool actually behaves when invoked.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While the description is technically concise (one short phrase), it's under-specified rather than appropriately concise. The single sentence 'See browsers, countries, devices, and more' fails to convey essential information about the tool's purpose or usage. This isn't effective conciseness - it's inadequate specification that leaves the agent guessing about fundamental aspects of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters including a nested filters object with 14 sub-properties), zero annotation coverage, and the fact that this appears to be a data retrieval/analytics tool, the description is completely inadequate. While an output schema exists, the description doesn't even establish basic context about what kind of metrics are being retrieved, for what purpose, or how this differs from sibling tools. This leaves the agent with insufficient information to use the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, meaning none of the 8 parameters have descriptions in the schema. The tool description provides absolutely no information about any parameters - not even mentioning the required 'website_id' and 'type' parameters, let alone explaining what they mean or how they should be used. For a tool with 8 parameters including complex nested filters, this is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'See browsers, countries, devices, and more' is vague and tautological - it essentially restates the tool name 'get_metrics' without specifying what action is performed or what resource is accessed. It mentions some example metric categories but doesn't state whether this retrieves, analyzes, or aggregates metrics data. The description fails to distinguish this tool from its siblings like 'get_stats' or 'get_pageviews'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides absolutely no guidance on when to use this tool versus alternatives. There's no mention of what makes this tool different from 'get_stats', 'get_pageviews', or other sibling tools. No context about appropriate use cases, prerequisites, or limitations is provided. The agent would have no basis for choosing this tool over similar-sounding alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pageviewsC
View page traffic over time.
| Name | Required | Description | Default |
|---|---|---|---|
| website_id | Yes | ||
| start_at | No | ||
| end_at | No | ||
| unit | No | day | |
| timezone | No | UTC | |
| compare | No | ||
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. 'View page traffic over time' implies a read-only operation but doesn't specify whether this requires authentication, has rate limits, returns paginated data, or what the output format looks like. The description is too minimal for a tool with 7 parameters and complex filtering capabilities.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is maximally concise at 5 words with zero waste. Every word contributes meaning, and it's front-loaded with the core purpose. While more detail would be helpful, what's present is perfectly structured for its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, 14 filter options, time comparisons, and an output schema), the description is severely inadequate. While the output schema may document return values, the description doesn't prepare the agent for the tool's full capabilities or help navigate the extensive parameter set. This is a data retrieval tool with analytics functionality that deserves more explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate but fails to do so. 'View page traffic over time' only hints at time-related parameters (start_at, end_at, unit) but ignores the 14 filter options, compare functionality, timezone handling, and required website_id. The description adds minimal value beyond what's obvious from the tool name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'View page traffic over time' clearly states the verb ('view') and resource ('page traffic'), but it's somewhat vague about scope and doesn't distinguish from sibling tools like 'get_metrics' or 'get_stats' which might also provide traffic-related data. It's functional but lacks specificity about what makes this tool unique.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_metrics' or 'get_stats'. There's no mention of prerequisites, appropriate contexts, or exclusions. The agent must infer usage purely from the tool name and parameters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statsD
Get visitor statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| website_id | Yes | ||
| start_at | No | ||
| end_at | No | ||
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure but offers nothing beyond the basic action. It doesn't indicate whether this is a read-only operation, what permissions might be required, whether it has rate limits, what format the statistics are returned in, or any other behavioral characteristics. This leaves the agent with significant uncertainty about how the tool behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at just three words, with no wasted language. It's front-loaded with the core action and resource. While this conciseness comes at the cost of completeness, structurally it's efficient with every word serving a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (4 parameters including a nested filters object with 14 properties), 0% schema description coverage, and no annotations, the description is completely inadequate. While an output schema exists (which might help with understanding returns), the description fails to provide any context about what statistics are retrieved, how parameters affect results, or behavioral characteristics. For a tool with this level of parameter complexity, the description should do much more to help the agent understand when and how to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, meaning none of the 4 parameters have descriptions in the schema. The tool description provides no information about parameters whatsoever—it doesn't mention 'website_id', date ranges, or filtering options. With 4 parameters (including a complex nested 'filters' object with 14 sub-properties) completely undocumented, this represents a major gap in understanding what inputs are needed and how they affect the results.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get visitor statistics' states a basic action and resource but is vague about what specific statistics are retrieved. It doesn't distinguish this tool from sibling tools like 'get_metrics' or 'get_pageviews', leaving ambiguity about what differentiates these tools. While it avoids tautology with the tool name 'get_stats', it lacks specificity about the type of statistics returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_metrics', 'get_pageviews', or 'get_active'. There's no mention of prerequisites, appropriate contexts, or exclusions. The agent must infer usage purely from the tool name and parameters without any descriptive help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_websitesC
List all your websites.
| Name | Required | Description | Default |
|---|---|---|---|
| include_teams | No | ||
| search | No | ||
| page | No | ||
| page_size | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states 'List all your websites', which implies a read-only operation, but doesn't cover critical behaviors like pagination (implied by 'page' and 'page_size' parameters), search functionality, or whether it includes teams by default. The description misses key operational details needed for effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at four words, front-loading the core action and resource without any wasted text. It's appropriately sized for a simple listing tool, though this brevity contributes to gaps in other dimensions. Every word earns its place by directly stating the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (4 parameters, no annotations, but with an output schema), the description is incomplete. It covers the basic purpose but lacks details on parameter usage, behavioral traits, and differentiation from siblings. The presence of an output schema means return values are documented elsewhere, but the description should still address input handling and context to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters are undocumented in the schema. The description 'List all your websites' doesn't mention any parameters, failing to compensate for this gap. It doesn't explain what 'include_teams', 'search', 'page', or 'page_size' do, leaving their semantics unclear. With 4 parameters and no schema descriptions, this is a significant shortfall.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all your websites' clearly states the verb ('List') and resource ('websites'), making the basic purpose understandable. However, it doesn't differentiate this tool from sibling tools like 'get_active' or 'get_pageviews', leaving ambiguity about what specific aspect of websites it retrieves. The description is functional but lacks specificity about scope or content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_active' or 'get_metrics'. It doesn't mention prerequisites, context, or exclusions, leaving the agent to infer usage based solely on the name. This lack of comparative or contextual advice reduces its effectiveness for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v0.1.1- First observed
get_active - First observed
get_metrics - First observed
get_pageviews - First observed
get_stats - First observed
get_websites
TDQS
The tools have some overlap in purpose, particularly 'get_metrics' and 'get_stats', which both seem to cover visitor statistics, and 'get_active' could be confused as part of metrics or stats. However, descriptions help differentiate 'get_pageviews' and 'get_websites' as more specific functions, reducing ambiguity.
All tool names follow a consistent 'get_' verb_noun pattern, such as 'get_active', 'get_metrics', 'get_pageviews', 'get_stats', and 'get_websites'. This predictable naming convention makes the set easy to understand and navigate.
With 5 tools, the count is reasonable for a web analytics server, covering core functions like active visitors, metrics, pageviews, stats, and websites. It's slightly thin but well-scoped, as each tool appears to serve a distinct aspect of the domain without being overwhelming.
The toolset covers key read operations for web analytics, such as retrieving active visitors, metrics, pageviews, stats, and websites. However, there are notable gaps in CRUD coverage, such as missing create, update, or delete operations for websites or other entities, which could limit agent workflows for managing analytics data.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Cloud-hosted MCP server for URnetwork VPN and Proxy
Hosted MCP server for Google Ads and LinkedIn Ads analysis.
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
Cloudflare Workers MCP server: api-flow-analyzer
Related MCP Servers
- AlicenseAqualityCmaintenanceFull-coverage MCP server for Umami Analytics API v2 — 66 tools for website analytics, stats, events, and team management661696MIT
- AlicenseAqualityDmaintenanceRead-only MCP server for Umami analytics. It talks to the Umami REST API directly over HTTP, supporting self-hosted and cloud setups.817MIT
- AlicenseAqualityCmaintenanceAn MCP server that gives Claude read access to Umami web analytics, allowing natural language queries for stats, breakdowns, pageview trends, live visitors, and user journeys.101MIT
- AlicenseAqualityBmaintenanceA security-first MCP server for Umami analytics (Cloud and self-hosted v3) enabling analytics, reporting, and administration with least privilege and credential-safe design.3217MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Alurith/umami-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server