Umami MCP

Name: Umami MCP
Author: Asif2BD

by Asif2BDversion 0.1.3i★ –iRuns on your computer

Registry nameio.github.Asif2BD/umami-mcp

Install

Overview

Description from the maker (original English)

Query Umami Analytics v3 — stats, funnels, retention, attribution, UTM. Read-only by default.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Marketing & social media
You need to fill in: UMAMI_URL, UMAMI_PASSWORD, UMAMI_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: UMAMI_URL, UMAMI_USERNAME, UMAMI_PASSWORD, UMAMI_API_KEY, UMAMI_MCP_MODE

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "umami": {
      "command": "npx",
      "args": [
        "-y",
        "@asif2bd/umami-mcp"
      ],
      "env": {
        "UMAMI_URL": "your-value",
        "UMAMI_USERNAME": "your-value",
        "UMAMI_PASSWORD": "your-value",
        "UMAMI_API_KEY": "your-value",
        "UMAMI_MCP_MODE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add umami --env UMAMI_URL=your-value --env UMAMI_USERNAME=your-value --env UMAMI_PASSWORD=your-value --env UMAMI_API_KEY=your-value --env UMAMI_MCP_MODE=your-value -- npx -y @asif2bd/umami-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "umami": {
      "command": "npx",
      "args": [
        "-y",
        "@asif2bd/umami-mcp"
      ],
      "env": {
        "UMAMI_URL": "your-value",
        "UMAMI_USERNAME": "your-value",
        "UMAMI_PASSWORD": "your-value",
        "UMAMI_API_KEY": "your-value",
        "UMAMI_MCP_MODE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "umami": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@asif2bd/umami-mcp"
      ],
      "env": {
        "UMAMI_URL": "your-value",
        "UMAMI_USERNAME": "your-value",
        "UMAMI_PASSWORD": "your-value",
        "UMAMI_API_KEY": "your-value",
        "UMAMI_MCP_MODE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

UMAMI_URL required env
Your Umami instance URL, e.g. https://analytics.example.com
UMAMI_USERNAME env
Umami username. Self-hosted Umami has no API keys, so a login is required.
UMAMI_PASSWORD secret env
Umami password. Prefer a dedicated, limited account over your admin login.
UMAMI_API_KEY secret env
Umami Cloud API key, used instead of username and password.
UMAMI_MCP_MODE env
Permission tier: read (default), write, or admin. Tools above the tier are never registered.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Asif2BD, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Marketing & social mediai

More stars than 0% of the other 3559 servers in this category
Published to the registry more recently than 28% of the other 3559 servers in this category
Basic checks equal to or better than 100% of the other 3559 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Umami MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: UMAMI_URL, UMAMI_PASSWORD, UMAMI_API_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.1.3) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: MCP YouTube Transcript, Google Analytics MCP, BibiGPT YouTube Video Summarizer

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

MCP YouTube Transcript

by jkawamoto

An MCP server retrieving transcripts of YouTube videos

Runs on your computer★ 495MITUpdated 10 days ago

Install

Google Analytics MCP

by surendranb

GA4 MCP server for AI agents: schema discovery, server-side aggregation, analysis-ready defaults.

Runs on your computer★ 244MITUpdated 10 days ago

Install

BibiGPT YouTube Video Summarizer

by JimmyLv

AI video summarizer: summarize and transcribe YouTube, Bilibili, TikTok and podcast videos.

Runs in the cloud★ 137MITUpdated 10 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Umami MCP Server

A Model Context Protocol server for Umami Analytics. Ask Claude, Cursor or any MCP client about your traffic — and let it create and manage websites — while your credentials stay on your own machine.

"Which pages drove the most visitors last month, and where did that traffic come from?"

"Build a funnel from /pricing to /signup to /welcome for the last 30 days." "Add analytics for my new site blog.example.com and give me the tracking snippet."

A throwaway site with generated traffic, on a live Umami 3.3.1 instance, read by a view-only service account — so the counts are small and mean nothing, but every one of them was really collected and really queried. Regenerate with vhs demo/demo.tape.

Why this exists

Umami now ships an official MCP server (since v3.4.0, MCP_ENABLED=1, endpoint /mcp). If read-only analytics is all you need, use that: it runs inside Umami, so there is nothing extra to deploy. See the Umami docs.

This server is for what the official one deliberately leaves out:

	Official (`/mcp`)	umami-mcp
Read analytics and reports	yes	yes
Create and update websites, teams, tracking snippets	—	`write` mode
User management	—	`admin` mode
Delete website / reset data	—	opt-in only
Umami older than 3.4	—	3.x
Sign-in	API key	API key, password, or OAuth (multi-tenant)

Several community servers exist too, and if you just want broad API coverage you should look at 0xtlt/umami-mcp first — it wraps more of the API than this does. Some of the older servers (jakeyShakey, mikusnuz, mittwald, Macawls) were written against the v2 API and break on a modern instance, because v3 renamed things without aliases:

	Umami v2	Umami v3
Top pages	`/metrics?type=url`	`/metrics?type=path`
Hostnames	`/metrics?type=host`	`/metrics?type=hostname`
UTM data	`/metrics?type=utm_source`	`POST /api/reports/utm`
Funnels, retention, journeys, attribution, revenue	—	`POST /api/reports/*`

This server exists for two things the others do not do:

1. Complete, verified v3 report coverage. All seven v3 report types — funnel, retention, journey, goal, revenue, attribution and UTM — were exercised against a live Umami 3.3.1 instance. The report envelope is easy to get wrong: dates go in parameters as ISO-8601 strings, not in filters, and not as the epoch milliseconds the rest of the API uses. Attribution takes first-click / last-click, not the camelCase spellings you would guess.

2. A capability model rather than a boolean. See below.

Security model

An analytics MCP server holds a credential that can read every visitor session you have ever recorded — and, if you let it, delete the lot. The design follows from that.

Your credentials never leave your environment. Configuration is read only from the process environment. There is no telemetry, no phone-home, and no hosted relay. The only host this server ever contacts is the UMAMI_URL you set. If you self-host it, nothing about your analytics ever reaches a third party — including the author of this software.

Be wary of any Umami MCP that offers a hosted endpoint you point at your instance. Before

Umami 3.4 a self-hosted instance had no API keys, so "convenient" hosting meant mailing your

admin password to someone else's server. On 3.4+, give such a service a revocable API key

from a dedicated account, never a password.

Least privilege by default. The server starts in read mode. Widening is a deliberate act:

Mode	Adds
`read` (default)	Analytics, reports, listing websites
`write`	Create and update websites and teams
`admin`	User management
`+ UMAMI_MCP_ALLOW_DESTRUCTIVE=true`	Delete website, reset data, delete user

Withheld tools are not registered at all, so they never appear in the model's tool list. This is the part that differs from a READONLY=true flag: a tool that was never advertised cannot be invoked by a prompt-injected instruction hidden in, say, a referrer string or a page title inside your own analytics data. There is no runtime check to forget or bypass, because there is no tool.

Destructive actions need a typed confirmation checked against reality. umami_delete_website takes a confirmDomain argument, fetches the live record, and refuses unless they match. A model that reaches for the wrong website UUID gets an error, not a wiped dataset.

Credentials stay out of client config. Rather than requiring your password inside ~/.claude.json or mcp.json, the server reads it from a file you control at ~/.config/umami-mcp/env, and warns if that file is readable by other users. See Credentials.

Secrets are scrubbed from output. MCP output flows into a model and often into a chat transcript, which cannot be un-said. Passwords, bearer tokens and JWTs are redacted from every error and response before they leave the process.

Refuses to leak credentials over the wire. Plaintext HTTP to a remote host is rejected at startup; it is permitted only for localhost, for local development.

Install

Three ways to run it. Self-hosting is the default and the recommended one — the hosted instance exists so you can try it in two minutes without cloning anything.

	Runs where	Credentials live	Best for
Hosted	asif.dev	Sealed in your token, never stored	Trying it out; Claude web and Cowork
Source	Your machine	A file only you can read	Daily use in Claude Code
Docker	Your server	Your `.env`	Teams, always-on

If you self-host and want it in Claude web, run it with UMAMI_MCP_OAUTH=true behind your own domain — then nothing of yours touches anyone else's infrastructure.

1. Use the hosted instance (nothing to install)

Add a custom connector in Claude pointing at:

https://umami-mcp.asif.dev/mcp

You will be asked for your own Umami URL and login on a consent screen. See Claude web, Cowork, and Claude Code on web for how the credentials are handled.

2. From source

git clone https://github.com/Asif2BD/umami-mcp.git

cd umami-mcp npm install && npm run build

Then set up credentials and register it with your client:

claude mcp add umami --scope user -- node "$PWD/dist/index.js"

Requires Node 20 or newer.

3. Docker

git clone https://github.com/Asif2BD/umami-mcp.git

cd umami-mcp cp .env.example .env # then edit .env docker compose up -d

npm: not published yet. Once it is, npx -y @asif2bd/umami-mcp will replace the

clone-and-build step above. Until then use source or Docker.

Credentials

On Umami 3.4.0 or later, prefer an API key (Settings → API keys) in UMAMI_API_KEY: it can be revoked on its own without changing a password. It is sent as Authorization: Bearer to a self-hosted instance and as x-umami-api-key to Umami Cloud. Older instances have no API keys, so the credential is a real account password. Either way, MCP clients normally want that embedded in their config JSON — ~/.claude.json, mcp.json and friends — which are widely readable, get pasted into issues and screen-shares, and are synced between machines by some clients.

So this server reads credentials from a file you control instead. Create it once:

mkdir -p ~/.config/umami-mcp

cat > ~/.config/umami-mcp/env <<'EOF' UMAMI_URL=https://analytics.example.com UMAMI_USERNAME=mcp-bot UMAMI_PASSWORD=your-password UMAMI_MCP_MODE=read EOF chmod 600 ~/.config/umami-mcp/env

The server loads it automatically. It warns on startup if the file is readable by other users.

Lookup order — the first file found wins, and real environment variables always override the file, so you can still pass settings from the client config when you want to:

$UMAMI_MCP_ENV_FILE, if set
~/.config/umami-mcp/env (or $XDG_CONFIG_HOME/umami-mcp/env)
./.env in the working directory

Connect your client

Claude Code

With the credentials file above, the registration carries no secrets at all:

claude mcp add umami --scope user -- node ~/umami-mcp/dist/index.js

Use the absolute path to your checkout. If your Node lives under nvm, give the full interpreter path too, since MCP clients do not load your shell profile:

claude mcp add umami --scope user -- ~/.nvm/versions/node/v22.22.0/bin/node ~/umami-mcp/dist/index.js

Claude Desktop / Cursor / VS Code

"mcpServers": { "umami": { "command": "node", "args": ["/absolute/path/to/umami-mcp/dist/index.js"] } } }

If you would rather keep everything in one place, environment variables still work and take precedence over the file:

"mcpServers": { "umami": { "command": "node", "args": ["/absolute/path/to/umami-mcp/dist/index.js"], "env": { "UMAMI_URL": "https://analytics.example.com", "UMAMI_USERNAME": "mcp-bot", "UMAMI_PASSWORD": "your-password" } } } }

Check it works

Ask your client to run umami_whoami. It reports the instance, the account, and the permission mode — the fastest way to confirm the connection and see how much the server is allowed to do:

"instance": "https://analytics.example.com", "authenticatedAs": "mcp-bot", "role": "admin", "serverMode": "read", "destructiveOperations": "disabled" }

Then try: *"List my Umami websites"*, or *"What were my top pages last week?"*

Claude web, Cowork, and Claude Code on web

Those clients cannot launch a local process, so they need a public HTTPS MCP server — and their connector UI accepts OAuth only, with no field for a static bearer token or custom header.

Hosting the obvious way, with one set of Umami credentials baked in and no authentication, turns the URL into an open proxy to that Umami. So this server does OAuth instead, and does it without becoming a credential store.

Use the hosted instance

Add a custom connector in Claude with this URL:

https://umami-mcp.asif.dev/mcp

Claude registers itself, sends you to a consent screen, and asks for your own Umami URL, username and password. Nothing is shared with other users of the host.

Host your own

UMAMI_MCP_OAUTH=true

UMAMI_MCP_TRANSPORT=http UMAMI_MCP_ISSUER=https://mcp.example.com # public HTTPS URL of this server UMAMI_MCP_TOKEN_KEY=<32 random bytes> # keep stable; see below UMAMI_MCP_TOKEN_TTL=2592000

Only the beginning is shown; read the rest in the repo

Umami MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Marketing & social mediai

Common questions

Alternatives

MCP YouTube Transcript

Google Analytics MCP

BibiGPT YouTube Video Summarizer

README from the maker

Umami MCP Server

Why this exists

Security model

Install

1. Use the hosted instance (nothing to install)

2. From source

3. Docker

Credentials

Connect your client

Claude Code

Claude Desktop / Cursor / VS Code

Check it works

Claude web, Cowork, and Claude Code on web

Use the hosted instance

Host your own