# Analytics servers: GA4, Mixpanel, Amplitude and PostHog Checked on 2026-11-01, GA4, Amplitude and PostHog again on 2026-11-06. Write-tool lists are partial and dated; the live tool list wins. ## Answer contract for every analytics server - Ask for the query before the conclusion: property or project, events or metrics, filters, date range and time zone, counting method, and the numerator and denominator of any rate. An answer that cannot show these has not been checked. - Compare like with like: a saved report or chart against the same definition in the UI, not a dashboard tile that carries its own filters (failure F16). - When an answer disagrees with the UI, find the definition difference first (thresholding, sampling, attribution, time zone, an unapplied filter). Never accept an unexplained gap. - Analysis contracts beyond the T3 known answer belong to ai-analytics-over-marketing-data when it is installed. ## Google Analytics 4 Server and status - Google Analytics MCP Server, version 1.0.0 (2026-11-03), Production/Stable on PyPI. Run with `pipx run analytics-mcp` over stdio, or as an HTTP service (`--transport http`, with a built-in OAuth server behind `--oauth`). Listed in Google's MCP catalog. Google hosts no endpoint for it and it is not on Google Cloud's remote MCP list. - Read tools: `get_account_summaries`, `get_property_details`, `list_google_ads_links`, `list_property_annotations`, `list_key_events`, `run_report`, `run_funnel_report`, `run_conversions_report`, `get_custom_dimensions_and_metrics`, `run_realtime_report`. - Write tools: `create_property_annotation`, `create_custom_dimension`, `create_key_event`. Clients - Any client that runs local stdio servers: Claude Code, Claude Desktop, Cursor, VS Code, Codex. - claude.ai web and ChatGPT need a remote endpoint. Use the GA4 BigQuery export with BigQuery MCP, a licensed bridge, a Secure MCP Tunnel with a named owner, or your own HTTP deployment, which makes your team the operator (choosing-servers.md). Auth and who can connect - Enable the Analytics Admin API and Analytics Data API in the Cloud project. - Application default credentials: `gcloud auth application-default login --scopes https://www.googleapis.com/auth/analytics.readonly,https://www.googleapis.com/auth/cloud-platform --client-id-file=`, or `--impersonate-service-account`. - Env: `GOOGLE_APPLICATION_CREDENTIALS` (only when not using the default location) and `GOOGLE_CLOUD_PROJECT`. Older articles name `GOOGLE_PROJECT_ID`; the repository uses `GOOGLE_CLOUD_PROJECT`. Read-only layer - Read-only by default. Writing needs `--allow-write` or `ANALYTICS_MCP_ALLOW_WRITE`, plus the `analytics.edit` scope. Google's developer guide (updated 2026-10-26) still says read-only and lists no write tools, so trust the repository and T2. - Never set the flag or the variable (scanner S06), and mint the credential with `analytics.readonly`. T1 and T3 - T1: `get_account_summaries`; the intended property is present. Count the other properties the identity reaches. - T3: sessions for one complete day at least three days old, with no breakdown. Limits and meters (standard / 360, page updated 2026-10-26) - 200,000 / 2,000,000 core tokens per property per day; 40,000 / 400,000 per property per hour; 14,000 / 140,000 per project per property per hour; 10 / 50 concurrent requests. - Property quotas count every project and credential that reads the property, so an agent's reports draw on the same daily and hourly budget as dashboards, connectors and scripts. Keep agent reports narrow and record the quota used in T5. Traps - The API and the UI can differ through thresholding, sampling and reporting-surface differences. Trace the cause before failing T3 (failure F16). - A credential file in the repository or a relative `GOOGLE_APPLICATION_CREDENTIALS` path (scanner S12). The `cloud-platform` scope is broad: record the credential as sensitive. - A team-owned OAuth client (the `--client-id-file` login) whose consent screen is External in Testing status issues refresh tokens that expire after 7 days: the server works for a week, then fails with `invalid_grant` (failure F15). - Application default credentials are one file per machine. A later `gcloud auth application-default login` for another tool overwrites it, and GA4 calls then fail with insufficient scopes. Give the server its own credential file through `GOOGLE_APPLICATION_CREDENTIALS`, outside the repository, or use impersonation. Revocation - `gcloud auth application-default revoke`, remove the server, and delete the credential file at offboarding. ## Mixpanel Server and status - Endpoints: US `https://mcp.mixpanel.com/mcp`, EU `https://mcp-eu.mixpanel.com/mcp`, India `https://mcp-in.mixpanel.com/mcp`. - On by default for Free and Growth accounts created after 2026-08-01; otherwise an org admin enables it. The doc gives two paths (Settings > Org > AI Settings and Settings > Org > Overview): follow the live UI. Changes take up to 15 minutes. Clients - Claude Desktop and claude.ai: the directory connector (a custom connector for EU and India projects). - Claude Code: `claude mcp add --transport http mixpanel `. - ChatGPT: the Mixpanel app. For EU, India and custom plugins, add a custom MCP server from the Plugins page. Mixpanel's page still asks for Developer Mode first; OpenAI's help centre says no toggle is needed, and workspace permissions still apply. - Cursor: vendor guides use `npx -y mcp-remote `; prefer a native `url` entry, or pin the proxy (scanner S13). Auth and who can connect - OAuth with the user's existing project permissions, or service accounts (beta) limited to the projects they were added to. Read-only layer - No read-only mode or per-tool restriction on the server. Enforce with a project role without write access, plus client blocks. Roles are per project, so T4 in a test project proves production only when the role is the same there. Write surface to block (2026-11-01) - Create-, Update-, Duplicate- and Delete-Dashboard; Edit-Event, Edit-Property, Bulk-Edit-Events, Bulk-Edit-Properties; tag tools; Dismiss-Issues; Update-Business-Context; Merge-Group; Dismiss-Duplicate-Group; create and update tools for custom properties, cohorts, lookup tables, metrics, experiments and feature flags. Edit-Property can change PII classification. T1 and T3 - T1: Get-Projects or List-Organizations; project ID and region match `stack.md`. - T3: Get-Report on one saved report. Limits and meters - 600 MCP requests per hour per user. - Run-Query cannot filter or break down by cohort and does not support SCD fields or saved metrics: the answer must say so instead of substituting. Traps - An EU project on the US endpoint signs in and then shows no projects or a 403 (failure F02; scanner S07 with `--expect-region mixpanel=eu`). - Audit: MCP changes appear in the audit log with Origin MCP; read-only and failed calls are not logged. Get-Audit-Log is beta and needs an org admin or owner. Revocation - Remove the server and sign out; an org admin can switch MCP off for the organization. Vendor tooling - `mixpanel/ai-plugins` install skill (chooses region and engine). Lexicon bulk work through its manage-lexicon skill, after approval in agent-write-safety. ## Amplitude Server and status - Endpoints: US `https://mcp.amplitude.com/mcp` (default), EU `https://mcp.eu.amplitude.com/mcp`. - Admins allow or block MCP at Settings > Content Access > MCP; users cannot override. - An unauthenticated read-only docs MCP serves the public documentation. Clients - Claude Desktop and claude.ai: the directory connector uses the US server; EU projects need a custom connection to the EU endpoint, after the EU note on Amplitude's Claude setup page (check the live page). - ChatGPT: the listed plugin gets a curated subset of tools, with one `search` tool in place of `search_amp_entities` and `search_amp_data_taxonomy`. - `?discovery=progressive` shrinks the tool list to `get_amplitude_context` plus `list_tool_categories`, `get_category_tools` and `describe_tool`, which cuts token use but hides the tools themselves from T2 and from per-tool client blocks. Do not use it on a connection that relies on T2 and client blocks (failure F19; scanner S06 WARN). Auth and who can connect - OAuth. RBAC actions per project: Use MCP (read) `USE_MCP_READ` and Use MCP (write) `USE_MCP_WRITE`, checked on every call and overriding admin status. Every role grants read; Member, Manager and Admin also grant write, so Viewer is the only default role without write. - Amplitude ties Use MCP (write) explicitly to tracking-plan changes (event, property and taxonomy create, update, delete and restore). It does not map it to the dashboard, notebook, comment, sharing, cohort, monitor, experiment or flag tools, so treat a role with Use MCP (read) only as unproven for those tools until T4 denies one. - Custom roles need an Enterprise plan (RBAC role customization). On other plans, Viewer is the read-only role. - A call to a tool the role does not permit fails at call time; the tool stays in the list. Read-only layer - Viewer on the project, or on Enterprise a custom role with Use MCP (read) only, plus a client allowlist of the read tools below, so a tool Amplitude adds or renames stays off. Where a client has no allowlist, block `use_amp*`, `share_amp_entities`, `manage_*` and `run_amp`. Key tools (2026-11-06, page updated 2026-11-04) - Read: `get_amplitude_context`, `search_amp_entities`, `search_amp_data_taxonomy`, `get_from_url`, `query_amplitude_data`, `get_amplitude_charts`, `render_amplitude_chart`, `get_amp_taxonomy`. `get_amp_user_data` returns user profiles (P): allow it only when the job needs people. - Read and write under one name: `use_amp_dashboards`, `use_amp_notebooks`, `use_amp_comments`, `share_amp_entities` (sharing and access roles), `use_amplitude_cohorts` (create, sync to destinations and export CSVs: an S tool), `use_amplitude_chart_monitors`, `use_amp_experiments`, `use_amp_flags`, `use_amplitude_metrics`, `use_amp_ai_visibility`, and `run_amp`, which runs `amp` CLI commands (deletes need `allowDestructive: true`). - Write: `manage_amp_events`, `manage_amp_properties`, `manage_amp_branches`, `manage_amp_context`, `manage_amp_entities` and the `manage_wave_*` tools. T1 and T3 - T1: `get_amplitude_context`. - T3: one saved chart through `query_amplitude_data` or `get_from_url`. - T4: a `manage_amp_*` call and one non-taxonomy write (a notebook or a dashboard) in a test project where the identity holds the production role (connection-tests.md). Traps - Charts on dashboards may use default chart settings instead of the saved dashboard filters: compare against the chart, not the dashboard tile. - The same vendor exposes different tools per client (failure F12). - Member, Manager or Admin with Use MCP (read) only stays unproven for the content tools above until T4 denies one. Viewer, or client blocks, close them. Revocation - Block MCP at Settings > Content Access > MCP, or remove the user's MCP role action. ## PostHog Server and status - Endpoint `https://mcp.posthog.com/mcp`; the region follows the signed-in account (one connection per region). Auth and who can connect - OAuth, or a personal API key with the MCP Server preset, scoped to one project, for clients without OAuth. Read-only layer - `readonly=true` (or 1) on the URL, or the `x-posthog-read-only` header, which wins, removes create, update and delete tools. - `project_id` on the URL, or `x-posthog-project-id`, pins the project and removes the switch-project and switch-organization tools; `organization_id` or `x-posthog-organization-id` pins only the organization. - `mode=tools` on the URL, or `x-posthog-mcp-mode: tools`, lists every tool individually. Without it, Claude, Claude Code, Cowork and Codex default to CLI mode, which lists one `exec` tool that lists and calls the others; Cursor defaults to tools mode. - `features` and `tools` filters combine as a union. - The read-only URL is `https://mcp.posthog.com/mcp?readonly=true&project_id=&mode=tools` (scanner S06 checks all three). T1 and T3 - T1: switch-project and switch-organization tools are absent; one known insight belongs to the project. - T3: one saved insight against the UI. Traps - CLI mode makes T1, the T2 snapshot and T4 pass whether or not `readonly=true` is set, because the client sees only `exec`, and per-tool client blocks cannot tell reads from writes (failure F19). Use tools mode on every connection that relies on T2 and client blocks. Where CLI mode stays, `readonly=true` is the only layer: take the T2 snapshot from the listing `exec` returns, and run T1 and T4 against it. Limits and meters - 480 requests per minute and 4,800 per hour per credential, including setup and tool listing; a 429 carries Retry-After. AI-powered tools have their own lower limits. Revocation - Revoke the MCP Server key or sign out of the OAuth connection. Vendor tooling - Installer `npx @posthog/wizard mcp add` (article research); vendor skills in `PostHog/ai-plugin`.