One endpoint, your own account.
The Sealmetrics MCP server exposes your analytics to an AI assistant as tools it can call in plain language. It is hosted, so there is nothing to install and nothing to keep updated. You point a client at one URL and authorise it with the Sealmetrics account you already have.
At a glance
| Endpoint | https://mcp.sealmetrics.com/mcp |
|---|---|
| Transport | Streamable HTTP |
| Authorisation | OAuth 2.1 with PKCE (S256) |
| Authorisation server | https://my.sealmetrics.com |
| Client registration | Dynamic — no client ID to request |
| Scopes | analytics:read · offline_access |
| Identity | Each user authorises with their own Sealmetrics account |
| Data residency | Dublin, Ireland |
| Local alternative | npx @sealmetrics/mcp with an API key |
How authorisation works
The server implements the MCP authorisation spec end to end, so a compliant client needs no manual configuration beyond the URL. An unauthenticated call is refused with a 401 whose WWW-Authenticate header points at the protected-resource metadata; the client reads it, discovers my.sealmetrics.com as the authorisation server, registers itself dynamically, and runs the authorisation-code flow with PKCE. The user sees one browser screen, signs in with their Sealmetrics account and approves the request.
- No client ID to request from us and no key to paste anywhere.
- The token carries analytics:read, and offline_access only so the client can refresh without asking again.
- Authorisation is per user, not per company: two colleagues each authorise separately and each sees what their own account can open.
- Revoking the authorisation in account settings kills the token immediately.
What it can do
The hosted endpoint lists more than 40 read-only tools and nothing that writes. Each one maps a business question to a canonical metric, so the model calls a documented contract instead of guessing at raw columns. The full list in the server documentation also covers tools this endpoint does not offer, such as channel-rule drafts, alerts, webhooks, segments and bot detection. Attribution is last click within each session, with no lookback across sessions, measured on traffic without consent gaps rather than the consented fraction. Worked examples, organised by business problem, are in the prompt library.
- Traffic, sessions and page performance over preset periods such as 7d, 30d, last_month or last_quarter, with comparison against the previous period or year.
- Conversions and revenue, broken down by channel, campaign, source, term, landing page or country, plus the line items of each purchase.
- Micro-conversions and the fixed purchase funnel, with the drop-off at each step.
- Custom properties the account already sends, such as a product or plan identifier.
- Landing pages, referrers, countries, devices, browsers and operating systems.
- Channel rules: list them and test how a source, medium and campaign would be classified.
- Documentation, the troubleshooting guide and the tracking code, so the assistant can help with setup.
- Search and fetch, so a client that indexes connectors can find a metric by name.
What it will not do
The boundaries are architectural, not policy. Most of them are things the store cannot produce because it never collected them.
- Read a person. There is no visitor identifier to read, because Sealmetrics never sets one.
- Return raw personal data, session recordings or a user-level journey. None of it exists in the store.
- Write anything at all. The hosted endpoint lists no tool that creates, updates or deletes: channel rules can be listed and tested but not edited, and alerts, webhooks and segments are absent, not merely refused.
- Delete data, move billing or touch account settings.
- Reach an account the authorising user cannot already open in the dashboard.
Connecting a client
Every client takes the same URL. The exact place you paste it differs, and the full walkthrough for each one, with the progressive-discovery option for tight context windows, lives in the MCP server documentation.
| Client | Where the URL goes |
|---|---|
| Claude Code | claude mcp add --transport http sealmetrics <endpoint> |
| Claude.ai and Claude Desktop | Settings → Connectors → Add custom connector |
| ChatGPT | Settings → Connectors → Add custom connector |
| Codex | codex mcp add, or a plugin that carries the endpoint |
| Cursor | An entry in ~/.cursor/mcp.json |
| Anything else | Any client that speaks remote MCP over Streamable HTTP |
If a client asks for a local command instead of a URL, it does not support remote MCP yet. Use npx @sealmetrics/mcp with SEALMETRICS_API_KEY in the environment, which runs the server on your machine; its tools are listed in the server documentation. API keys are read-only by design.
Data handling
Sealmetrics is cookieless analytics: no cookie, no fingerprint, no visitor identifier, and therefore no personal data in the store the connector reads. That is what makes an AI assistant safe to point at it — the model cannot leak an identifier that was never collected.
- Data is collected and stored in the European Union, in Dublin, Ireland.
- Designed for GDPR from the architecture up (self-assessed) and aligned with the ePrivacy Directive; visitor data is not transferred outside the EU, so no Schrems II transfer arises for it.
- A DPA is included with every account, and the TPSR package is available for procurement review.
- The connector inherits those terms. It adds a reader, not a new collection.
Full detail on infrastructure and subprocessors is on the security page, and the agreement itself is at /dpa.
Frequently asked questions
Do I need an API key to use the MCP server?
Not for the hosted endpoint. You authorise it with your own Sealmetrics account in the browser and the client stores the token for you. An API key is only needed for the local server, which runs on your machine via npx and is there for offline or pinned-version setups.
What can the connector see?
Aggregate analytics for the sites your Sealmetrics account can already open: traffic, conversions, revenue, campaigns, funnels, custom properties and setup status. It cannot see anything your dashboard login cannot, and it cannot read a visitor, because Sealmetrics stores no visitor identifier.
Can an AI assistant change my configuration through it?
Not through the hosted endpoint. It lists read-only tools only: there is no tool on it that creates, updates or deletes anything, so a change is not refused at call time, it is simply not offered. The server documentation also lists channel-rule tools that work on drafts only and can never change or publish a live rule; publishing a rule, like any other configuration change, happens in the dashboard.
How do I revoke access?
Open my.sealmetrics.com, go to the connected applications section of your account settings and revoke the authorisation. The token stops working immediately and the assistant loses the tools on its next call.
Does connecting an AI assistant create a new consent obligation?
No. The connector reads aggregate data that was collected without cookies and without personal data, so there is nothing to consent to that was not already lawful to collect. The processing terms are the ones in the DPA you already signed.
Which model or vendor processes my data?
Whichever assistant you connect. The server answers the tools that assistant calls; it does not choose or host a model. If the model itself must run in the EU, use LENS with Private AI, Sealmetrics' managed model served in Paris, France, with no prompt retention.
Questions about the connector: contact