MCP.Market

Umami Compass MCP server

by webcredo·io.github.webcredo/umami-compass·v0.5.1

Secure Umami Analytics MCP server for Cloud and self-hosted deployments

B83/100grade B
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

0 stars40 downloads/wk

Reviews

Write one

Nobody has reviewed Umami Compass yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Umami Compass tools (42, 7 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_performance_portfolio

    Compare Core Web Vitals across a bounded website portfolio with compact-by-default output, metric-specific drill-down selection, confidence, event/pageview ratios, and precise section truncation metadata.

  • analyze_release_impact

    Compare equal pre- and post-release windows across traffic breakdowns and Core Web Vitals. Returns a compact executive summary by default; request full detail for drill-down evidence. Recent releases use a partial post window and an equally shortened pre window.

  • compare_performance_breakdown

    Align page, page-title, device or browser rows across two periods. Comparable rows come first; undersized rows are excluded by default and missing capped candidates remain unknown rather than being treated as zero.

  • compare_traffic_series

    Return aligned current and comparison traffic buckets to locate the exact day or hour when traffic changed.

  • compare_web_vitals

    Compare all five Web Vital p75 summaries against a previous, year-over-year or custom period with ratings, materiality, event-count readiness and explicit filter scope.

  • explain_traffic_change

    Compare traffic with a previous, year-over-year, or custom period and rank observed changes across pages, referrers, countries, devices, channels, and events. Results describe association, not causation.

  • get_active_visitors

    Get the current number of active visitors for a website.

  • get_event_series

    Get custom-event counts over time, optionally filtered to a named event.

  • get_event_stats

    Get aggregate custom-event statistics and comparison values.

  • get_heatmap

    Get Umami 3.2 click or scroll heatmap data. Successful responses state whether data is available and why an authorized result is empty. Omit urlPath to list pages; provide it for bounded detail.

  • get_metrics

    Get a ranked aggregate Umami metric breakdown such as paths, referrers, countries, devices, events, channels or URLs. Visitor identifiers are excluded from the core toolset.

  • get_pageviews

    Get Umami 3.2 pageview and session time series. Both arrays are preserved in the response.

  • get_performance_breakdown

    Rank Web Vital percentiles by page, page title, device or browser. Rows default to 20 performance events and report the upstream limitation that per-metric non-null counts are unavailable.

  • get_performance_cross_tab

    Derive a bounded two-dimensional performance breakdown through explicit fan-out. Candidate source, request count, sample limitations and truncation are reported so the result is not mistaken for a native exhaustive pivot.

  • get_portfolio_overview

    Summarize bounded aggregate traffic across visible websites, including period changes, growth and decline leaders, stale tracking, failures, and suspicious jumps.

  • get_revenue_metrics

    Break down Umami 3.2 revenue by country, region, referrer or channel.

  • get_revenue_stats

    Get Umami 3.2 revenue totals and comparison values in a chosen currency.

  • get_route_group_performance

    Measure caller-defined route templates with exact regex-filtered performance queries instead of attempting to merge non-composable percentiles from individual URLs.

  • get_saved_report

    Get one saved report definition. The website ID is required to enforce the local allowlist and is verified against the response.

  • get_server_info

    Get the local package version, enabled toolsets, safety limits, and supported analysis capabilities without exposing credentials.

  • get_session

    Get metadata for one Umami visitor session.

  • get_session_activity

    Get a bounded list of pageviews and events that occurred during one session and time range.

  • get_session_stats

    Get aggregate session metrics for a website and time range.

  • get_web_vitals

    Get normalized Umami 3.2 LCP, INP, CLS, FCP and TTFB summaries plus a bounded series for one metric. Empty data, partial buckets, filter scope and unavailable upstream sample counts are explicit.

  • get_website

    Get metadata for one website.

  • get_website_date_range

    Get the earliest and latest analytics timestamps available for a website.

  • get_website_stats

    Get visits, visitors, pageviews, bounces, visit duration and Umami's comparison values for a time range.

  • list_events

    List and search custom events for a website and time range.

  • list_replays

    List Umami 3.2 session replay metadata. Successful responses state whether data is available and why an authorized result is empty. Raw rrweb event payloads are intentionally excluded.

  • list_saved_reports

    List saved report definitions for one website without modifying them.

  • list_segments

    List reusable website segments or cohorts from Umami's paged response with explicit context limits.

  • list_sessions

    List and search visitor sessions for a website and time range.

  • list_websites

    List websites visible directly or through any team membership of the configured Umami identity. If UMAMI_WEBSITE_IDS is set, returns only that exact allowlist.

  • resolve_website

    Resolve a website UUID from a UUID, domain, URL, or website name. Ambiguous matches return bounded candidates instead of guessing.

  • run_attribution_reportwrite action

    Calculate first-click or last-click attribution for a conversion path or event with bounded channel arrays.

  • run_breakdown_reportwrite action

    Cross-tabulate up to three Umami dimensions, including derived channel combinations, and return the highest-ranked bounded rows.

  • run_funnel_reportwrite action

    Calculate a 2–8 step Umami funnel. windowMinutes controls the allowed time between consecutive steps.

  • run_goal_reportwrite action

    Calculate an Umami conversion goal for a path or custom event.

  • run_journey_reportwrite action

    Calculate the most common 2–7 step user journeys and return a bounded ranking.

  • run_retention_reportwrite action

    Calculate daily Umami cohort retention and return a bounded result set.

  • run_utm_reportwrite action

    Calculate Umami source, medium, campaign, term and content performance with bounded category arrays.

  • tracking_health_check

    Audit visible websites for stale or missing traffic, traffic drops, domain mismatches, referral-spam patterns, custom-event availability, recorder configuration, and section permission failures. Disabled optional features are warnings only when marked as expected.

Public scan report

scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it

no findings
  • Code scan58 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 8 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Umami Compass compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,255 servers
Tools
42
the typical server has 7
Tools that change things
17%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
40
more than 31% of 12,191 servers with a package

What its tools let an agent do: 35 read · 7 run or deploy

Install Umami Compass in Claude Code, Cursor or VS Code

Runs npx -y umami-compass on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add umami-compass -- npx -y umami-compass
Add to Cursor

What the publisher says

From the Umami Compass repository's README, as published. We do not edit it. Read it on GitHub

Umami Compass

Open-source MCP server for Umami Analytics — Cloud and self-hosted.

Distribution: umami-compass on npm · io.github.webcredo/umami-compass in the official MCP Registry

Umami Compass is a secure, read-only Model Context Protocol server for Umami Analytics. It gives MCP clients accurate Umami 3.2 analytics without exposing a database or allowing arbitrary network requests.

Version 0.5.1 is the current source release. See Compatibility before using it with older Umami versions.

The npx examples follow the stable npm release channel and check it whenever the MCP process starts. For source-based evaluation, clone this repository, run pnpm install --frozen-lockfile && pnpm build, and use node /absolute/path/to/umami-compass/dist/cli.js as the MCP command.

Why this project

Existing Umami MCP servers each cover part of the problem, but our July 2026 review found gaps around Umami 3.2 response correctness, Cloud authentication, safety boundaries, or extensibility. Umami Compass sets a higher, testable quality bar:

  • Correct auth for both products: x-umami-api-key for Umami Cloud and Bearer/login auth for self-hosted instances.
  • Umami 3.2-aware responses, including both pageviews and sessions, Core Web Vitals, funnels, journeys, attribution, retention, revenue, bounded heatmaps, and replay metadata.
  • Read-only by construction: every tool declares MCP safety annotations; no create, update, delete, raw HTML, or arbitrary URL tool exists.
  • Defense in depth: fixed upstream origin, HTTPS policy, website and team allowlists, range/page/response-byte caps, request timeout, cancellation propagation, and redacted errors.
  • Decision-ready insights: bounded traffic and performance portfolio overviews, traffic-change evidence, release-impact analysis, tracking-health audits, and website resolution without arbitrary API access.
  • Agent-friendly output: machine-readable structuredContent, a common status/range/truncation envelope, two resources, and six guided prompts.
  • Contributor-friendly architecture: endpoint modules, dependency-injected HTTP, a central access policy, ADRs, and real MCP integration tests.

See the dated landscape review for the evidence and methodology.

Quick start

Requirements: Node.js 22 or newer and an Umami identity with view-only access where possible.

The examples use the auto-updating stable launcher:

npx --yes --prefer-online umami-compass@latest

@latest selects the stable npm channel and --prefer-online makes npm check the registry even when package metadata is cached. npm still reuses the cached package when that exact release is already present. Updates take effect the next time the MCP process starts; an already running local server cannot replace itself.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Umami Compass: common questions

Is Umami Compass MCP server safe?
Mostly: it is graded B (83/100). Read the Umami Compass safety report
How do I install Umami Compass?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Umami Compass need an API key?
Yes. The registry entry asks for UMAMI_API_KEY, UMAMI_ACCESS_TOKEN, UMAMI_PASSWORD.
Is Umami Compass maintained?
The last commit was 48 days ago (2026-09-17). The latest release is v0.5.1.
How does Umami Compass compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,255 servers); tools 42 (the typical server has 7); tools that change things 17% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.