Attensira

Attensira MCP server

Query your Attensira workspace and act on it from inside your AI assistant, over Streamable HTTP with OAuth or a workspace-scoped API key.

The Attensira MCP server puts your visibility data inside the assistant you already work in. Instead of switching to the dashboard, reading a number, and carrying it back by hand, your assistant queries the workspace directly, then changes it — adding prompts, running automations — in the same conversation.

What MCP gives you that the dashboard does not

The dashboard shows you numbers. MCP lets an assistant read those numbers and act on them without you leaving the work you are doing. That closes the loop between noticing something and changing something.

Concretely: while editing a pricing page, you can ask which prompts mention a competitor and not you, then add three new prompts covering the gap — one conversation, no tab switching. While reviewing a release, you can pull share of voice for the last 30 days, compare it against the previous window, and check whether the delta is statistically real before anyone writes it into a report.

The server exposes 33 tools across eight groups: find and measure (search, get_analytics, deciding_sources, win_plan, get_prompt, get_page), the receipts behind the numbers (answer_history, answer_slice, citation_timeline, page_history), track (add_prompts, remove_prompt, add_competitor, remove_competitor), inbox (list_inbox, resolve_inbox_task, approve_work_item, decline_work_item), automations (list_automations, get_automation, create_automation, run_automation, delete_automation, update_automation), agent (ask, get_session), account and settings (get_account, get_brief, get_ai_traffic_install, connect_github, update_settings), and memory (record_observation, write_skill). Seventeen are read-only. Three are destructive: remove_prompt, remove_competitor and delete_automation. Three spend credits: add_prompts, run_automation, and ask.

If what you are building is your own code rather than an assistant, the REST API exposes sixteen of these capabilities as conventional HTTP endpoints. It takes an API key only — no OAuth — and those keys do not expire.

Warning

An assistant granted write access — by an API key minted as read and write, or by any OAuth connection, which always carries write — can delete prompts, competitors and automations, and can spend credits. Treat either credential as a workspace credential, not a read token.

How authentication works

The server accepts two credentials, and it accepts both permanently. Which one you want depends on whether a human is present when the client starts.

	OAuth	Static API key
Best for	Interactive AI clients — Claude, Claude Code, Cursor, VS Code, ChatGPT	Headless callers — n8n, CI, scheduled scripts
What you do	Paste the server URL and sign in through the browser	Mint a key and send Authorization: Bearer atn_live_<32 hex>
What sits on disk	A refreshable token the client manages. No secret you have to place	A long-lived key in a config file or secret store
Expiry	Access tokens are short-lived and refresh silently; you sign in again occasionally	Never, until you revoke it
How you take it away	Remove the server in the client	Revoke it in Settings → Developer, effective on the next request

Prefer OAuth wherever a browser can open. There is no key to paste, so there is nothing to leak into a committed config file, and revoking one client leaves the others working. Use a key when nothing can complete a browser sign-in — that case is real and supported, which is why keys are not deprecated here. Full mechanics are in the OAuth reference; minting and scopes are in API keys.

Either way, the credential names your organisation. Every tool takes an optional project, so one connection reaches every workspace the organisation owns — an agency running three domains connects once, not three times. Omit it and the default is used: for a signed-in connection that is the organisation's only workspace, and for a static key it is the workspace the key was minted in. An organisation with several workspaces and a signed-in connection has no default, so tools ask you to name one. get_account lists the ids and is the one tool that answers without a workspace.

That is still a boundary. A workspace id outside your organisation comes back as a workspace that does not exist — the same answer as one that never existed, so naming an id you do not own tells you nothing.

An API key is displayed exactly once, because only a hash is stored; Attensira cannot re-display it, and a lost key is replaced rather than recovered.

Where the server lives

The endpoint is https://mcp.attensira.com/mcp, and it speaks Streamable HTTP only. A client that speaks stdio alone cannot reach it directly and needs a bridge — see Connect a client. https://mcp.attensira.com/healthz is unauthenticated and answers without a key, which makes it a useful reachability check when a client is silent about why it failed.

Next steps

Copy-pasteable setup for Claude Code, Cursor, VS Code, Codex, ChatGPT, n8n and more. All 33 tools, their arguments, and which ones cost credits. Endpoints, scopes, PKCE and token lifetimes, for client authors and reviewers. Worked prompts that get useful answers on the first try. See which applications have access, and revoke one. Minting, scopes, and the one-time reveal.

Note

Something not working? Troubleshooting covers 401s, sign-ins that never return, missing tools, revoked credentials, empty results, and timeouts.