
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@convai/analytics-mcp
Advanced tools
Local stdio MCP server for the Convai analytics API. Designed for AI agents using a customer Convai API key.
Local stdio MCP server for Convai Analytics.
This package is the recommended agent interface for Convai Analytics. It lets MCP-capable agents answer questions about your Convai sessions, latency, reliability, usage, and provider/model performance without writing custom SDK scripts. It wraps the public @convai/analytics TypeScript SDK, uses CONVAI_API_KEY, and returns structured JSON plus Vega-Lite chart specs.
Package: @convai/analytics-mcp
Official MCP Registry name: io.github.Conv-AI/convai-analytics-mcp
export CONVAI_API_KEY="ck_live_your_key_here"
npx -y @convai/analytics-mcp@latest
Optional:
export CONVAI_ANALYTICS_BASE_URL="https://analytics-api.convai.com/v1/analytics"
Leave CONVAI_ANALYTICS_BASE_URL unset for production. Do not put the API key in source code, committed MCP config, screenshots, or logs.
After adding or changing MCP config, restart Claude Desktop, Claude Code, Cursor, Codex, or your MCP host so it reloads the server command and CONVAI_API_KEY.
{
"mcpServers": {
"convai-analytics": {
"command": "npx",
"args": ["-y", "@convai/analytics-mcp@latest"],
"env": {
"CONVAI_API_KEY": "ck_live_your_key_here"
}
}
}
}
After saving this config, quit and reopen Claude Desktop so it starts the new MCP server.
Use the same stdio command:
{
"command": "npx",
"args": ["-y", "@convai/analytics-mcp@latest"],
"env": {
"CONVAI_API_KEY": "ck_live_your_key_here"
}
}
For Claude Code, Cursor, Codex-compatible clients, and other stdio MCP hosts, restart the client or start a new session after adding or changing MCP config.
The server is customer-facing and public-safe by design:
@convai/analytics.CONVAI_API_KEY.Core and account tools:
get_summaryget_metrics_cataloglist_sessionsget_session_timelineget_interaction_traceLatency tools:
get_p95_latency_over_timeget_latency_percentile_seriesget_latency_percentile_chartget_latency_threshold_chartget_latency_heatmap_chartget_component_latency_breakdowngenerate_component_latency_chartfind_component_latency_bottlenecksgenerate_interaction_waterfallexplain_slow_sessionReliability tools:
get_error_trendgenerate_error_trend_chartget_error_breakdowngenerate_error_breakdown_chartget_dropped_error_persist_trendgenerate_dropped_error_persist_chartgenerate_reliability_summary_chartgenerate_reliability_trends_chartThese reliability tools use error and dropped-persistence metrics that are available today. If an agent asks for a status distribution, only use group_by=status when the returned rows contain real non-empty status groups; otherwise report that status-tagged aggregate telemetry is not available for that range.
Usage and concurrency tools:
get_usage_trendsgenerate_usage_trends_chartget_character_usage_leaderboardgenerate_character_usage_chartgenerate_session_duration_scatterestimate_active_session_concurrencygenerate_active_session_concurrency_chartgenerate_peak_concurrency_chartProvider and model tools:
get_tts_provider_attributiongenerate_tts_provider_chartget_llm_model_latencygenerate_llm_model_latency_chartcompare_providersPlan-gated advanced tools:
detect_regressionsadvanced_queryPlan-gated tools return typed MCP tool errors for 402/403 responses with the required plan in the message.
The server exposes prompt templates for common customer questions:
why_was_this_session_slowaggregate_latency_distributionp95_latency_trendcomponent_bottleneckstrace_explanationerror_rate_trendsprovider_comparisonusage_summaryconvai://analytics/docs/conceptsconvai://analytics/docs/metrics-referenceconvai://analytics/docs/authenticationconvai://analytics/catalogThe catalog resource fetches the caller's account catalog when CONVAI_API_KEY is available.
How many interactions and unique end users did I have in the last 30 days?
Break it down by character and generate a usage trend chart.
Show aggregate P50/P95/P99 voice.user_to_bot_latency for production readiness sign-off.
Add a 3000 ms p95 threshold line and summarize the worst buckets.
Explain why session s_123 was slow and generate an interaction waterfall if there is a traceable interaction.
Show reliability trends, errors by component, and dropped error-persistence events.
Estimate active session concurrency and show the peak concurrency chart.
From the repo root:
make mcp-install
make mcp-lint
make mcp-test
make mcp-build
make mcp-smoke
Live smoke against production with your own key:
export CONVAI_API_KEY="ck_live_your_key_here"
export CONVAI_ANALYTICS_BASE_URL="https://analytics-api.convai.com/v1/analytics"
export CONVAI_ANALYTICS_E2E_RANGE="last_30d"
cd packages/mcp
npm run e2e:prod
The live smoke accepts empty data for accounts without recent traffic and treats plan-gated 402/403 responses as valid gated results.
The canonical MCP registry manifest is server.json. The server is published to npm and the Official MCP Registry. Additional directories and marketplaces such as GitHub MCP Registry, Smithery, Glama, PulseMCP, mcp.so, and Docker MCP Catalog can reference the same package and registry metadata.
FAQs
Local stdio MCP server for the Convai analytics API. Designed for AI agents using a customer Convai API key.
The npm package @convai/analytics-mcp receives a total of 88 weekly downloads. As such, @convai/analytics-mcp popularity was classified as not popular.
We found that @convai/analytics-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.