AttriKit

MCP setup

Give Codex, Cursor CLI, Gemini CLI, Claude Code or any MCP client controlled access to AttriKit through 39 management tools.

Create a management key

Install Node.js 22 or newer. The npx command in each setup downloads and starts the MCP server automatically, so no global install is required.

Open Dashboard → Settings → API keys & MCP. Create a workspace key with read and write scopes for full operational control, or use an app key to keep the agent inside one app.

The first management key must be created in the dashboard. On macOS, run the command below once: it asks for the key, checks it against AttriKit and stores it in the Keychain, so your MCP client starts the server without any environment variable.

Terminal (macOS)

npx -y @attrkit/mcp login

On other systems, keep the key in your secret manager and expose it to the client as ATTRKIT_API_KEY. Never commit it or paste it into an MCP config file.

Connect your MCP client

Save this as.mcp.json in your project. Claude Code expands ${ATTRKIT_API_KEY:-} from the environment it starts in (empty when only the macOS Keychain holds the key), so the file never holds the key.

.mcp.json in your project

{
  "mcpServers": {
    "attrkit": {
      "command": "npx",
      "args": ["-y", "@attrkit/mcp"],
      "env": { "ATTRKIT_API_KEY": "${ATTRKIT_API_KEY:-}" }
    }
  }
}

Start Claude Code from the shell where the key is set, or after the login command on macOS, then run claude mcp list.

Set up a new app with one prompt

Once the server is connected, paste this prompt into your assistant from your Xcode project. It creates the app, installs the iOS SDK, waits for the first open, creates your first campaign link, then offers ad networks and RevenueCat. It asks you for every value it lacks and never prints a secret.

The dashboard's setup page shows the same prompt beside a live list of what each step has proven.

Setup promptExpandCopy prompt

Set up AttriKit (mobile attribution) in this iOS project. You have the AttriKit MCP server, named attrkit. Work in this order, and stop to ask me for any value you do not have. Never print, log or commit a secret: not the management key, not a network credential, not the RevenueCat secret. 1. App. Call whoami and confirm the plan and that the key has read and write scope; if it fails with 401, stop and tell me to check ATTRKIT_API_KEY. Call list_apps. If my app is there only as archived, leave it archived and create a new one with create_app (there is no tool to unarchive an app). If my app is not there, read the bundle id from this Xcode project, ask me for the App Store URL, and call create_app with platform iOS and an idempotency_key. Do not show me the one-time app management key it returns; tell me it exists and that I can create keys later in Settings. 2. Publishable key. Call get_publishable_key for the app. 3. Swift package. Add https://github.com/KamyarTaher/attrikit-ios with the AttriKitCore product to the app target. If you cannot add it safely, give me the exact Xcode steps instead of editing project.pbxproj. 4. Endpoint. Add the Info.plist key AttriKitEndpoint with the value https://attrikit.io to the app target. 5. Start call. Call AttriKit.start(apiKey: "<publishable key>", consent:.measurementGranted) once at launch, before any other SDK call. 6. First open. Build and run the app in the simulator, then call list_recent_events for the app every 10 seconds, for at most 3 minutes, until a first open appears. If nothing arrives, tell me what you checked. 7. Campaign link. Ask me which ad network I run first (meta, google or tiktok) and the campaign name, call create_campaign_link with the App Store URL as destination_url, and give me the campaign link from the tracking_url it returns, with where it goes: for meta, the ad's Website URL on a Sales campaign, not Traffic; for tiktok, the ad's destination; for google, the tracking template, with the App Store URL kept as the final URL. Tell me to read that network's note in AttriKit, Links, before I publish (for Google it says whether the click tracker is certified). If no tracking link comes back, tell me to create it in AttriKit, Links, Create a link. 8. Optional: ad networks. Ask whether I want to connect ad networks now. For each yes, ask me for the account id and credential and call create_integration. Skip any I do not have and tell me to finish them in AttriKit, Integrations. 9. Optional: RevenueCat. Ask whether I use RevenueCat. If yes, ask me for the RevenueCat project app id and an authorization secret of at least 16 characters, and call configure_revenuecat. Tell me to add the webhook_url it returns in RevenueCat with that same secret; if it returns none, tell me to finish the webhook in AttriKit, Integrations. 10. Finish with a short summary: app, SDK status, first open seen or not, link created, integrations connected, and anything I still have to do. Remind me that I can revoke the setup key in AttriKit, Settings, API keys.

When it does not work

The client says connected but every tool answers 401 invalid_key.

Connected means the process started, not that the key is good. Ask the agent to call whoami first: it is the cheapest read and it either names your workspace or tells you the key is wrong. One 401 covers a missing header, a wrong key, a revoked key and an expired one, so check ATTRKIT_API_KEY before anything else.

The client says the server failed to start.

The setup commands export the key into ONE shell. A client launched from a desktop icon does not inherit that shell, so the server exits immediately. Use the client's secret store or documented environment-variable expansion with ATTRKIT_API_KEY supplied by the desktop environment; if the client supports neither, start it from the terminal where the variable is set. The example above forwards a variable and deliberately does not store the key.

A tool answers with a timeout.

The server gives up after 15 seconds on most tools and after 120 seconds on export_events, import_spend and pull_network_spend, which are the calls that can run long on real data. If the call was a write, retry with the SAME idempotency_key rather than a new one, because the first attempt may have landed.

An export comes back with fewer events than you expect.

export_events defaults to the version 1 CSV, which returns at most the 100,000 most recent events INSIDE your date range. A busier range is cut to its newest 100,000, so use recent, narrow date ranges, compare the event count with your source and, for more, ask for version 2: it pages through every record, and each page's next_cursor goes back as cursor until a page carries none.

An argument you passed appears to have been ignored.

Anything a tool's schema does not declare is dropped silently. Check the tool's parameters rather than assuming the API refused it.

Know what the tools can do

The MCP server exposes the same operational boundary as the Management API. Tool calls obey the key's workspace or app scope and its read or write permission. Billing, login, membership, workspace deletion and internal administration are not available through MCP. Tool inputs are snake_case, and a rejected input is named in error.fields.

Area	Tools
Context and usage	whoami, get_usage_cap, set_usage_cap
Apps	list_apps, create_app, get_app, update_app, archive_app
Publishable key	get_publishable_key, rotate_publishable_key
Management keys	list_api_keys, create_api_key, revoke_api_key
Links	list_links, create_campaign_link, update_link_status
Reports and decisions	list_campaigns, list_ads, list_recent_events, list_event_deliveries, get_campaign_decision, record_campaign_decision, get_attribution_rollup, lookup_customer_attribution
Spend and costs	get_spend, import_spend, set_cost_model, pull_network_spend
Ad integrations	list_integrations, create_integration, update_integration, delete_integration
RevenueCat	get_revenuecat, configure_revenuecat
Outbound webhooks	list_webhooks, create_webhook, delete_webhook
Export	export_events
Server events	send_server_event

Keep agent access bounded

Use a workspace key only when the agent must work across apps or change workspace-only integrations and usage controls. Use an app key for a single-app workflow. Remove write scope for read-only reporting.

Delegated management-key and webhook signing secrets are returned once. Store them immediately and never print them in prompts, logs or committed files. Use a fresh Idempotency-Key when you intend a new mutation, and reuse the same key only when retrying the same request.

• Webhooks Payload, four headers and signature scheme.
• What the agent is driving Campaigns, evidence labels and decisions, on sample data.
• Management API boundaries Review the exact workspace-key and app-key capability matrix.
• OpenAPI 3.1 document Inspect the REST contract behind the tools.