Umami Compass MCP server
io.github.webcredo/umami-compass·v0.5.1Secure Umami Analytics MCP server for Cloud and self-hosted deployments
0 stars40 downloads/wk
Reviews
Write oneNobody has reviewed Umami Compass yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Umami Compass tools (42, 7 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
analyze_performance_portfolioCompare Core Web Vitals across a bounded website portfolio with compact-by-default output, metric-specific drill-down selection, confidence, event/pageview ratios, and precise section truncation metadata.
analyze_release_impactCompare equal pre- and post-release windows across traffic breakdowns and Core Web Vitals. Returns a compact executive summary by default; request full detail for drill-down evidence. Recent releases use a partial post window and an equally shortened pre window.
compare_performance_breakdownAlign page, page-title, device or browser rows across two periods. Comparable rows come first; undersized rows are excluded by default and missing capped candidates remain unknown rather than being treated as zero.
compare_traffic_seriesReturn aligned current and comparison traffic buckets to locate the exact day or hour when traffic changed.
compare_web_vitalsCompare all five Web Vital p75 summaries against a previous, year-over-year or custom period with ratings, materiality, event-count readiness and explicit filter scope.
explain_traffic_changeCompare traffic with a previous, year-over-year, or custom period and rank observed changes across pages, referrers, countries, devices, channels, and events. Results describe association, not causation.
get_active_visitorsGet the current number of active visitors for a website.
get_event_seriesGet custom-event counts over time, optionally filtered to a named event.
get_event_statsGet aggregate custom-event statistics and comparison values.
get_heatmapGet Umami 3.2 click or scroll heatmap data. Successful responses state whether data is available and why an authorized result is empty. Omit urlPath to list pages; provide it for bounded detail.
get_metricsGet a ranked aggregate Umami metric breakdown such as paths, referrers, countries, devices, events, channels or URLs. Visitor identifiers are excluded from the core toolset.
get_pageviewsGet Umami 3.2 pageview and session time series. Both arrays are preserved in the response.
get_performance_breakdownRank Web Vital percentiles by page, page title, device or browser. Rows default to 20 performance events and report the upstream limitation that per-metric non-null counts are unavailable.
get_performance_cross_tabDerive a bounded two-dimensional performance breakdown through explicit fan-out. Candidate source, request count, sample limitations and truncation are reported so the result is not mistaken for a native exhaustive pivot.
get_portfolio_overviewSummarize bounded aggregate traffic across visible websites, including period changes, growth and decline leaders, stale tracking, failures, and suspicious jumps.
get_revenue_metricsBreak down Umami 3.2 revenue by country, region, referrer or channel.
get_revenue_statsGet Umami 3.2 revenue totals and comparison values in a chosen currency.
get_route_group_performanceMeasure caller-defined route templates with exact regex-filtered performance queries instead of attempting to merge non-composable percentiles from individual URLs.
get_saved_reportGet one saved report definition. The website ID is required to enforce the local allowlist and is verified against the response.
get_server_infoGet the local package version, enabled toolsets, safety limits, and supported analysis capabilities without exposing credentials.
get_sessionGet metadata for one Umami visitor session.
get_session_activityGet a bounded list of pageviews and events that occurred during one session and time range.
get_session_statsGet aggregate session metrics for a website and time range.
get_web_vitalsGet normalized Umami 3.2 LCP, INP, CLS, FCP and TTFB summaries plus a bounded series for one metric. Empty data, partial buckets, filter scope and unavailable upstream sample counts are explicit.
get_websiteGet metadata for one website.
get_website_date_rangeGet the earliest and latest analytics timestamps available for a website.
get_website_statsGet visits, visitors, pageviews, bounces, visit duration and Umami's comparison values for a time range.
list_eventsList and search custom events for a website and time range.
list_replaysList Umami 3.2 session replay metadata. Successful responses state whether data is available and why an authorized result is empty. Raw rrweb event payloads are intentionally excluded.
list_saved_reportsList saved report definitions for one website without modifying them.
list_segmentsList reusable website segments or cohorts from Umami's paged response with explicit context limits.
list_sessionsList and search visitor sessions for a website and time range.
list_websitesList websites visible directly or through any team membership of the configured Umami identity. If UMAMI_WEBSITE_IDS is set, returns only that exact allowlist.
resolve_websiteResolve a website UUID from a UUID, domain, URL, or website name. Ambiguous matches return bounded candidates instead of guessing.
run_attribution_reportwrite actionCalculate first-click or last-click attribution for a conversion path or event with bounded channel arrays.
run_breakdown_reportwrite actionCross-tabulate up to three Umami dimensions, including derived channel combinations, and return the highest-ranked bounded rows.
run_funnel_reportwrite actionCalculate a 2–8 step Umami funnel. windowMinutes controls the allowed time between consecutive steps.
run_goal_reportwrite actionCalculate an Umami conversion goal for a path or custom event.
run_journey_reportwrite actionCalculate the most common 2–7 step user journeys and return a bounded ranking.
run_retention_reportwrite actionCalculate daily Umami cohort retention and return a bounded result set.
run_utm_reportwrite actionCalculate Umami source, medium, campaign, term and content performance with bounded category arrays.
tracking_health_checkAudit visible websites for stale or missing traffic, traffic drops, domain mismatches, referral-spam patterns, custom-event availability, recorder configuration, and section permission failures. Disabled optional features are warnings only when marked as expected.
Public scan report
scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it
- Code scan58 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 8 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Umami Compass compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 83/100
- higher than 65% of 48,255 servers
- Tools
- 42
- the typical server has 7
- Tools that change things
- 17%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 40
- more than 31% of 12,191 servers with a package
What its tools let an agent do: 35 read · 7 run or deploy
Install Umami Compass in Claude Code, Cursor or VS Code
Runs npx -y umami-compass on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add umami-compass -- npx -y umami-compass
What the publisher says
From the Umami Compass repository's README, as published. We do not edit it. Read it on GitHub
Umami Compass
Open-source MCP server for Umami Analytics — Cloud and self-hosted.
Distribution: umami-compass on npm · io.github.webcredo/umami-compass in the official MCP Registry
Umami Compass is a secure, read-only Model Context Protocol server for Umami Analytics. It gives MCP clients accurate Umami 3.2 analytics without exposing a database or allowing arbitrary network requests.
Version 0.5.1 is the current source release. See Compatibility before using it with older Umami versions.
The npx examples follow the stable npm release channel and check it whenever the MCP process starts. For source-based evaluation, clone this repository, run pnpm install --frozen-lockfile && pnpm build, and use node /absolute/path/to/umami-compass/dist/cli.js as the MCP command.
Why this project
Existing Umami MCP servers each cover part of the problem, but our July 2026 review found gaps around Umami 3.2 response correctness, Cloud authentication, safety boundaries, or extensibility. Umami Compass sets a higher, testable quality bar:
- Correct auth for both products: x-umami-api-key for Umami Cloud and Bearer/login auth for self-hosted instances.
- Umami 3.2-aware responses, including both pageviews and sessions, Core Web Vitals, funnels, journeys, attribution, retention, revenue, bounded heatmaps, and replay metadata.
- Read-only by construction: every tool declares MCP safety annotations; no create, update, delete, raw HTML, or arbitrary URL tool exists.
- Defense in depth: fixed upstream origin, HTTPS policy, website and team allowlists, range/page/response-byte caps, request timeout, cancellation propagation, and redacted errors.
- Decision-ready insights: bounded traffic and performance portfolio overviews, traffic-change evidence, release-impact analysis, tracking-health audits, and website resolution without arbitrary API access.
- Agent-friendly output: machine-readable structuredContent, a common status/range/truncation envelope, two resources, and six guided prompts.
- Contributor-friendly architecture: endpoint modules, dependency-injected HTTP, a central access policy, ADRs, and real MCP integration tests.
See the dated landscape review for the evidence and methodology.
Quick start
Requirements: Node.js 22 or newer and an Umami identity with view-only access where possible.
The examples use the auto-updating stable launcher:
npx --yes --prefer-online umami-compass@latest@latest selects the stable npm channel and --prefer-online makes npm check the registry even when package metadata is cached. npm still reuses the cached package when that exact release is already present. Updates take effect the next time the MCP process starts; an already running local server cannot replace itself.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Umami Compass: common questions
- Is Umami Compass MCP server safe?
- Mostly: it is graded B (83/100). Read the Umami Compass safety report
- How do I install Umami Compass?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Umami Compass need an API key?
- Yes. The registry entry asks for
UMAMI_API_KEY,UMAMI_ACCESS_TOKEN,UMAMI_PASSWORD. - Is Umami Compass maintained?
- The last commit was 48 days ago (2026-09-17). The latest release is v0.5.1.
- How does Umami Compass compare with other MCP servers?
- safety score 83/100 (higher than 65% of 48,255 servers); tools 42 (the typical server has 7); tools that change things 17% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.