@rampstack/umami-mcp
This server lets you query Umami Cloud website analytics data from MCP clients (like Claude) in a read-only fashion.
Capabilities:
List Websites (
list_websites): Retrieve all websites on your Umami account (id, name, domain), optionally including team-owned sites — use this first to discover validwebsite_idvalues.Get Summary Stats (
get_stats): Fetch aggregate metrics (visitors, visits, pageviews, bounces, total time) for a website over a custom time window, including previous-period comparisons and computed deltas. Supports optional filters by URL, country, and referrer.Get Pageviews Timeseries (
get_pageviews): Retrieve pageviews and sessions as a time series bucketed by day or hour over a specified window, with optional country and referrer filters.Get Top Metrics by Dimension (
get_metrics): Query the top values for a specific dimension — URLs, referrers, browsers, operating systems, devices, countries, or events — returning ranked results with visitor counts.Get Custom Event Data (
get_event_data): Access custom event-data properties collected over a time window (optionally filtered to a specific event name); availability depends on your Umami plan.Cohort Report (
cohort_report): Run a single combined query returning stats with deltas + top 10 URLs + top 10 referrers + top 10 events for a website, using convenient shorthand ranges (24h,7d,30d,90d) or a custom ISO date range.
Read-only integration with Umami Cloud analytics, providing tools to list websites, retrieve statistics, pageviews, metrics, event data, and cohort reports.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@rampstack/umami-mcpShow me the stats for my website"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@rampstack/umami-mcp
A read-only Model Context Protocol server for Umami Cloud analytics. It exposes your Umami website data to MCP clients (Claude Code, Claude Desktop, and others) as a small set of GET-only tools.
Read-only by construction: the server makes exactly one kind of network call, an authenticated HTTP GET against the Umami Cloud API. There is no write path in the code, so no tool can create, edit, or delete anything in your Umami account.
Install
One line for Claude Code (user scope):
claude mcp add umami --scope user \
--env UMAMI_API_KEY=your_key_here \
-- npx -y @rampstack/umami-mcpClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"umami": {
"command": "npx",
"args": ["-y", "@rampstack/umami-mcp"],
"env": {
"UMAMI_API_KEY": "your_key_here"
}
}
}
}Environment
Variable | Required | Default | Notes |
| yes | none | Umami Cloud API key. The server exits if missing. |
| no |
| Override for a regional base, e.g. |
Get a key from the Umami Cloud dashboard under Settings -> API keys. The key
is passed to Umami in the x-umami-api-key header
(docs).
Related MCP server: umami-mcp-server
Tools
All tools take dates as ISO 8601 or epoch milliseconds. Naive datetimes (no
timezone) are treated as UTC. Every time-scoped response echoes the resolved
{ startAt, endAt } epoch window so you can verify the exact window queried.
Tool | Purpose |
| id, name, domain for every site on the account. Call first to get |
| visitors, visits, pageviews, bounces, totaltime + previous period + computed deltas. |
| pageviews/sessions timeseries, bucketed by |
| top values for one dimension ( |
| custom event-data properties (plan-gated; see below). |
| one call: stats + top 10 urls + top 10 referrers + top 10 events over a range. |
cohort_report accepts a range of 24h, 7d, 30d, 90d, or an ISO
start/end pair like 2026-01-01/2026-02-01.
Note on metric types
Umami's current docs label the URL dimension path. This server exposes it as
url, the long-standing alias the API still accepts, matching the Umami web UI
vocabulary. Other dimensions (referrer, browser, os, device, country,
event) map directly.
Note on event-data
The get_event_data tool calls the Umami event-data endpoints, which are gated
by account plan. On tiers where they are not exposed, the tool returns a clear
note (not fabricated data) and points you to get_metrics with type=event for
event counts, which is available everywhere.
Troubleshooting
Every call fails with "Network error reaching Umami" / fetch failed. The
server never reached the Umami API — this is a transport error, not an API
response. Check the unwrapped cause code in the message:
UNABLE_TO_VERIFY_LEAF_SIGNATURE(or another certificate error) means a TLS interceptor — antivirus (e.g. AVG, Kaspersky) or a corporate proxy (Zscaler, Netskope) — is re-signing HTTPS with a root CA that lives in the OS trust store. Node ships its own CA bundle and ignores the OS store by default, so it rejects the chain. Fix it by telling Node to trust the OS store:claude mcp add umami --scope user -- node --use-system-ca /path/to/dist/index.js--use-system-ca(Node 20.6+/22+) trusts the Windows/macOS certificate store where the interceptor's root CA is installed. Prefer this over exporting the CA by hand, and never disable verification withNODE_TLS_REJECT_UNAUTHORIZED=0— that would send your API key over an unverified connection.ENOTFOUND/ECONNREFUSED/ETIMEDOUTpoint at DNS or connectivity to the configuredUMAMI_API_BASE, not a certificate problem.
Security
Read-only by construction. The client exposes a single
get()method; there is no POST/PUT/DELETE anywhere in the source.GET-only. Every tool maps to a documented Umami GET endpoint.
Key stays local.
UMAMI_API_KEYis read from your environment and sent only in thex-umami-api-keyrequest header. It is never logged, never written to disk, and never included in error messages.No telemetry. The server makes no calls other than to the Umami API base you configure.
MIT licensed.
The Umami Cloud API key has account-wide read scope. If you manage analytics for multiple clients, use a separate Umami team or account per client rather than one key that can read them all.
Development
Requires Node 20+.
npm install
npm run build # tsc -> dist/
npm test # compiles and runs the node:test suite (mocked fetch, no live API)Tests never make live API calls and never reference a real key.
Publishing
This package is not yet published. To publish (maintainer action):
npm run build
npm publish --access publicLicense
MIT. See LICENSE.
Available Tools
6 toolscohort_reportC
One-call snapshot for a website: stats (with deltas) plus top 10 URLs, top 10 referrers, and top 10 events, over a range.
| Name | Required | Description | Default |
|---|---|---|---|
| range | Yes | Time range: 24h | 7d | 30d | 90d, or an ISO 8601 "start/end" pair. | |
| country | No | Optional filter: ISO country code. | |
| website_id | Yes | Umami website id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It does not disclose any behavioral traits such as whether the tool is read-only, authentication requirements, rate limits, or error behavior. The description only outlines the output, leaving the agent uninformed about side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, informative sentence that front-loads the key purpose and output components. It is concise with no wasted words. However, breaking it into bullet points could improve scannability, which prevents a score of 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should compensate by detailing return values or behavioral nuances. It lists what is returned (stats, deltas, top lists) but lacks format, limits (e.g., always top 10?), or error handling. For a tool with 3 parameters, the description is incomplete for confident usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all three parameters (range, country, website_id) with 100% coverage. The description adds minimal value by mentioning 'over a range', which loosely corresponds to the range parameter. It does not enrich parameter meanings beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides a 'one-call snapshot' with stats, deltas, and top lists for URLs, referrers, and events over a range. It distinguishes this consolidated report from sibling tools that focus on individual metrics (e.g., get_stats, get_event_data). However, it does not explicitly contrast with siblings, preventing a score of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives like get_stats or get_event_data. It does not mention prerequisites, limitations, or scenarios where this tool is preferred. This omission makes it harder for an agent to select the correct tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_event_dataA
Custom event-data properties collected over a window, optionally for one event name. Requires an Umami plan that exposes the event-data endpoints; returns a clear note if unavailable. For simple event counts use get_metrics with type=event.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | Window end: ISO 8601 or epoch ms. | |
| start | Yes | Window start: ISO 8601 or epoch ms. | |
| event_name | No | Optional: restrict to one event name. | |
| website_id | Yes | Umami website id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions returning a clear note if the plan doesn't support the endpoint, but lacks details on read-only, destructive, or other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage guidance, prerequisite, and alternative. No output schema, but return value could be hinted. Mostly complete for a moderately complex tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds minimal extra context beyond the schema (e.g., optionality of event_name). No significant enhancement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves custom event-data properties over a time window, optionally filtered by event name. It distinguishes from sibling get_metrics by mentioning that get_metrics is for simple event counts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (for event-data properties) and when not to (for simple counts, use get_metrics). Also mentions the prerequisite of an Umami plan that exposes event-data endpoints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metricsA
Top values for one dimension over a window (e.g. top URLs, referrers, browsers). Returns [{ x: value, y: visitors }].
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | Window end: ISO 8601 or epoch ms. | |
| type | Yes | Dimension to break down by. | |
| limit | No | Max rows. Default 25. | |
| start | Yes | Window start: ISO 8601 or epoch ms. | |
| country | No | Optional filter: ISO country code. | |
| referrer | No | Optional filter: referrer domain. | |
| website_id | Yes | Umami website id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes return format [{x, y}] but no side effects, auth needs, or limits. With no annotations, description should disclose more behavioral traits (e.g., what happens with empty results or invalid types).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: one for purpose, one for format. No fluff, front-loaded with key action and examples.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 7 parameters (4 required), description omits optional filter behavior, default limit, and edge cases. No output schema or annotations to compensate. Incomplete for autonomous agent reasoning.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters. Description adds context ('top values over a window') but doesn't elaborate beyond schema (e.g., meaning of limit, optional filters). Baseline 3 for high coverage with marginal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool returns top values for one dimension over a window, with examples. It distinguishes from siblings like get_stats (aggregate metrics) and get_pageviews (specific event).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicitly suggests use for dimension breakdowns, but no explicit when-to-use vs alternatives (e.g., cohort_report, get_stats) or when-not-to-use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pageviewsA
Pageviews and sessions as a timeseries over a window, bucketed by day or hour.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | Window end: ISO 8601 or epoch ms. | |
| unit | No | Bucket size. Default day. | |
| start | Yes | Window start: ISO 8601 or epoch ms. | |
| country | No | Optional filter: ISO country code. | |
| referrer | No | Optional filter: referrer domain. | |
| website_id | Yes | Umami website id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full burden. It describes the output (pageviews and sessions as a timeseries) but does not disclose side effects, authentication needs, rate limits, or behavior for large windows. It assumes read-only behavior, which is typical but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 12 words, efficiently conveying the core purpose without unnecessary detail. It is front-loaded with the key action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should hint at the return structure. It mentions 'pageviews and sessions' but does not specify the data format (e.g., array of objects with date and counts). It also lacks details on pagination or limits. For a tool with 6 parameters (3 required), this is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. The description adds meaning by linking parameters to the overall purpose: 'window' explains start/end, 'bucketed by day or hour' explains the unit parameter, and 'pageviews and sessions' clarifies the metrics returned. This adds context beyond the schema's individual descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves 'pageviews and sessions as a timeseries over a window, bucketed by day or hour.' It specifies the resource (pageviews and sessions) and format (timeseries, bucketed), which distinguishes it from sibling tools like get_metrics or get_event_data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for time-series analysis over a window, but does not explicitly state when to use this tool versus alternatives like get_metrics or get_stats. No exclusion criteria or alternative tool references are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statsA
Summary stats for a website over a window: visitors, visits, pageviews, bounces, totaltime, plus the previous period's values and computed deltas.
| Name | Required | Description | Default |
|---|---|---|---|
| end | Yes | Window end: ISO 8601 or epoch ms. | |
| url | No | Optional filter: page URL/path. | |
| start | Yes | Window start: ISO 8601 or epoch ms. Naive datetimes are UTC. | |
| country | No | Optional filter: ISO country code, e.g. US. | |
| referrer | No | Optional filter: referrer domain. | |
| website_id | Yes | Umami website id (from list_websites). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It describes the output content (visitors, visits, etc.) and mentions previous period and deltas, but does not disclose side effects, read-only nature, rate limits, or authentication requirements. It is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the purpose and output fields with zero waste. It is front-loaded and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description partially explains the return format by listing metrics, but does not specify types or exactly how previous period and deltas are structured. For a tool with 6 parameters, more completeness would be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description does not add meaning beyond the schema for parameters; it only mentions the window concept (start/end) implicitly. The schema itself already documents each parameter clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool returns summary stats (visitors, visits, pageviews, bounces, totaltime) for a website over a window, including previous period values and deltas. It is specific and distinguishes from sibling tools like list_websites or get_event_data, though not explicitly comparing to get_metrics or get_pageviews.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for obtaining high-level stats over a time window, but does not explicitly state when to use this tool versus siblings like get_metrics or cohort_report. No alternatives or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_websitesA
List every website on the Umami account: id, name, and domain. Call this first to discover valid website_id values for the other tools.
| Name | Required | Description | Default |
|---|---|---|---|
| include_teams | No | Include websites owned by teams you belong to. Default true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It clearly states the tool lists websites (read-only), but does not mention authentication requirements or rate limits. However, the behavior is transparent enough for a simple listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It front-loads the core purpose and includes critical usage guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains the return fields (id, name, domain). It provides clear context for use and distinguishes from siblings. All necessary information for an agent to invoke the tool is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter already described. The description adds value by mentioning the output fields (id, name, domain) which are not in the schema, helping the agent understand what the tool returns.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('list') and specifies the resource ('every website on the Umami account') along with the returned fields (id, name, domain). It also explicitly distinguishes itself from sibling tools by stating it should be called first to discover valid website_id values.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs when to use the tool: 'Call this first to discover valid website_id values for the other tools.' This provides clear context and prerequisite information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.1.0- First observed
cohort_report - First observed
get_event_data - First observed
get_metrics - First observed
get_pageviews - First observed
get_stats - First observed
list_websites
TDQS
Each tool has a clearly distinct purpose: listing websites, summary stats, pageview timeseries, top dimension values, custom event data, and a combined cohort report. Overlap is minimal and descriptions clarify boundaries.
Most tools follow the 'verb_noun' pattern (list_websites, get_stats, get_pageviews, get_metrics, get_event_data), but 'cohort_report' breaks the pattern with a noun_noun format, causing a minor inconsistency.
With 6 tools, the server is well-scoped for an analytics API. Each tool serves a distinct analysis need without redundancy or bloat.
The tool set covers all core analytics queries: listing websites, aggregate stats, timeseries pageviews, top metrics, event data, and a combined snapshot. No obvious gaps for read-only analytics.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for querying and analyzing data from ad platforms, analytics tools, and spreadsheets
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Read-only MCP server for turva.dev, an agent-readiness audit and advisory service.
- AgentCatOAuthcom.agentcat
Analytics and debugging for your MCP server — explore usage and sessions, then root-cause errors.
Related MCP Servers
- AlicenseAqualityDmaintenanceRead-only MCP server for Umami analytics. It talks to the Umami REST API directly over HTTP, supporting self-hosted and cloud setups.817MIT
- AlicenseAqualityCmaintenanceAn MCP server that gives Claude read access to Umami web analytics, allowing natural language queries for stats, breakdowns, pageview trends, live visitors, and user journeys.101MIT
- AlicenseNot gradedqualityBmaintenanceMCP server for Umami Analytics that provides read-only tools to query website stats, events, sessions, reports, and more, enabling natural language analytics queries.303MIT
- AlicenseAqualityBmaintenanceA security-first MCP server for Umami analytics (Cloud and self-hosted v3) enabling analytics, reporting, and administration with least privilege and credential-safe design.3217MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rampstackco/umami-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server