DevDome Analytics

npx add-mcp 'https://analytics.devdome.com/mcp'

1URL, no install

20tools, from stats to live domain checks

9clients documented below

0analytics data stored on our side

The server is a stateless proxy over your account at https://analytics.devdome.com/mcp. Every answer comes straight from your live data, scoped to your API key. What stays on our side is the key record itself: its hash, a four-character hint, the account it belongs to and when it was last used. The same data is available as a plain REST API.

01

Get your API key

One key per account, created under Account → API. It is shown exactly once - copy it right away. Preferred transport is the Authorization: Bearer header; clients that cannot send headers append ?key=YOUR_API_KEY to the URL instead (treat that URL as a secret). Claude.ai and ChatGPT connectors need no key at all: they sign you in on devdome.com (OAuth 2.1) and receive a key of their own, listed under Account → API where you can revoke it.

02

Connect your client

Pick yours - each card is the complete setup.

Claude Code

Terminal

One command in your terminal:

claude mcp add --scope user devdome https://analytics.devdome.com/mcp \
  -t http -H "Authorization: Bearer YOUR_API_KEY"

Claude Desktop

Config file

Settings, Developer, Edit Config. Add this to claude_desktop_config.json and restart the app:

{
  "mcpServers": {
    "devdome": {
      "url": "https://analytics.devdome.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Claude.ai (web)

In the browser

Settings, Connectors, Add custom connector. Paste the URL below and click Connect: Claude sends you to devdome.com to sign in (OAuth), no key to copy. A key still works where OAuth is not offered: append?key=YOUR_API_KEY to the URL.

https://analytics.devdome.com/mcp

Cursor

Config file

Settings, MCP, Add new global MCP server (or.cursor/mcp.json in a project):

{
  "mcpServers": {
    "devdome": {
      "url": "https://analytics.devdome.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Windsurf

Config file

Settings, Cascade, MCP Servers (or ~/.codeium/windsurf/mcp_config.json - note serverUrl):

{
  "mcpServers": {
    "devdome": {
      "serverUrl": "https://analytics.devdome.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

VS Code (Copilot)

Config file

Command palette, "MCP: Add Server", HTTP - or.vscode/mcp.json:

{
  "servers": {
    "devdome": {
      "type": "http",
      "url": "https://analytics.devdome.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

ChatGPT

In the browser

Settings, Connectors, Advanced, Developer mode, then Create connector. Paste the URL, pick OAuth as the authentication and create it: ChatGPT sends you to devdome.com to sign in. The key form still works: append?key=YOUR_API_KEY to the URL instead.

https://analytics.devdome.com/mcp

Zed

Config file

settings.json, context_servers:

{
  "context_servers": {
    "devdome": {
      "source": "custom",
      "url": "https://analytics.devdome.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Any other MCP client

Terminal

Plain streamable HTTP, no session. An API key in the Authorization header, or OAuth 2.1 (PKCE, dynamic client registration, discovery at /.well-known/oauth-protected-resource). Prove it works with curl:

curl https://analytics.devdome.com/mcp \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

03

What it can do

Ten tools, each mapped 1:1 to a dashboard report. Time arguments default to the full history your plan retains.

Tool	Arguments	What it answers
list_sites	none	The sites on your account with verification status.
add_site	domain	Add a website. Returns the verification file to upload; stays pending until verified.
verify_site	domain	Verify a pending website (installed snippet or DNS TXT record).
get_stats	site, days? | from?/to?	Headline KPIs vs the previous window.
get_timeseries	site, days? | from+to?	Daily traffic series in the site timezone.
get_breakdown	site, dimension, days? | from?/to?, limit?	Top-N by pages, referrers, countries, devices, browsers, os, dates, keywords, products, redirects or campaigns.
get_bot_report	site, kind?, days?, limit? (bots only)	Which bots hit the site and why they were flagged; kind "threats" = detection-category totals.
get_realtime	site	Visitors active in the last 5 minutes with their current page.
get_visitors	site, days? | from?/to?, limit?	Recent individual visits with step-by-step paths.
get_site_health	site	Uptime, response times, TLS/DNS checks, open incidents, the daily audit and the Malware Scanner roll-up (compact).
get_hourly	site, filters?	The last 24 hours by hour.
get_paths	site, page, days? | from?/to?, limit?, filters?	The visitors who entered on one page, each with the path they took.
get_incidents	site, limit?, before?	Downtime incidents, newest first, paged with before.
get_goals	site, days? | from?/to?, filters?	Saved goals with human and bot completions; rows carry the goal id for the goal filter.
get_events	site, days? | from?/to?, limit?, filters?	Custom events, one row per name.
check_domain	domain, check, record_type?, dkim_selector?, ip?	Live DNS, MX, NS, TXT, SPF / DMARC / DKIM, RDAP registration, certificate or reverse DNS for any public domain.
check_url	url, check	Live status and headers, the redirect chain, or the security-header audit of any public URL.
lookup_bot	user_agent	Is a user-agent string a known bot, and which one.
inspect_page	url, check?	On-page checks of any public page: meta tags, canonical and hreflang, schema, mixed content, images without alt; all five in one fetch by default.
generate_file	kind, options	A ready-to-use file or link, nothing fetched or stored: a WordPress robots.txt (presets or rules, AI crawler blocks, sitemap),.htaccess redirects (301 pairs, force HTTPS, www, trailing slash), a UTM campaign link, or an llms.txt.

Things to ask

Once connected, these all work out of the box:

• “How was my traffic this week compared to last week?”
• “Which pages got the most visitors this month, and which of them are broken?”
• “Which bots hit example.com yesterday, and how much of my traffic is bots?”
• “Where do my visitors come from - top referrers and countries for the last 90 days?”
• “Is anyone on my site right now? What are they looking at?”
• “Add newsite.com to my DevDome account and tell me which file to upload to verify it.”
• “Is my site healthy? Any downtime incidents this month?”
• “Write a weekly traffic report I can paste into Slack.”

Five workflows come built in. Your client lists them as prompts (Claude shows them under the plus menu, Cursor as slash commands):

Prompt	Arguments	What it does
weekly_report	site, days (7)	This period against the previous one, top pages, referrers, countries, bot share. Paste-ready.
bot_audit	site, days (7)	Bot share, top bots, suspicious patterns, concrete Bot Protection rules.
site_health_check	site, days (30)	Uptime, incidents, certificate and domain expiry, headers, HTTPS, mixed content, tracker reachability, fixes in order.
why_did_traffic_change	site, days (7)	Which day traffic moved, which source, page, country or device carried it, whether bots or an outage explain it. Observed, inferred and unknown kept apart.
wordpress_care_check	site, days (30)	Monthly care report: uptime, security, broken pages, bots, traffic trend, fixes in order, and what DevDome cannot see.

Troubleshooting

The four things that ever go wrong, and their fixes.

• 401 invalid API key: the key was mistyped, revoked or rotated. Copy a fresh one from Account, API.
• 429 rate limit: 60 requests per minute per key, plus 60 per minute per IP address for calls that need a fresh key lookup. Assistants that fan out many tool calls can hit this; it resets within a minute.
• "not your site": the site argument must be a domain on THIS account, in punycode for international names (münchen.de = xn--mnchen-3ya.de). Ask the assistant to run list_sites first.
• Client cannot connect: the server answers POST with JSON-RPC only, no session. Verify with the curl example above, then check your client uses the HTTP transport. OAuth clients: the 401 names the discovery document (WWW-Authenticate, /.well-known/oauth-protected-resource); the sign-in happens on devdome.com.