
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@statable/mcp
Advanced tools
MCP server for Statable, privacy-first cookieless web analytics. Query traffic, sources, pages, goals and funnels from Claude, Cursor, ChatGPT and any MCP client.
Ask your AI assistant about your website traffic. This package connects Claude, Cursor, ChatGPT, Claude Desktop and any other MCP client to Statable, a privacy-first, cookieless web analytics service hosted in the EU.
It is a thin stdio bridge to the hosted Statable MCP endpoint (https://mcp.statable.com/mcp). Every tool call is forwarded there with your API key. Nothing is stored locally.
| Your client | Use |
|---|---|
| Claude Code, Cursor, ChatGPT, Codex and other clients with OAuth support | Connect directly to https://mcp.statable.com/mcp and sign in in the browser. No key, no package. See the docs. |
| Claude Desktop, hosts that only run local stdio servers, CI scripts, sandboxes | This package with an API key. |
stbl_. Pick the sites and permissions the assistant may use.claude_desktop_config.json):{
"mcpServers": {
"statable": {
"command": "npx",
"args": ["-y", "@statable/mcp"],
"env": { "STATABLE_API_KEY": "stbl_your_key" }
}
}
}
Cursor (~/.cursor/mcp.json) and most other hosts accept the same shape.
Claude Code:
claude mcp add statable --scope user -e STATABLE_API_KEY=stbl_your_key -- npx -y @statable/mcp
Read: list_sites, query_stats, top_pages, top_sources, top_countries, top_custom_events, top_goals, list_goals, list_prop_keys, list_funnels, funnel_report, current_visitors, visitors_over_time, get_tracking_snippet, get_site_filters, get_subscription
Set up: create_site, update_site, create_goal, update_goal, create_funnel, update_funnel, get_tracking_settings, update_tracking_settings, update_site_filters
query_stats is the general one: aggregates, time series or a top-N breakdown over any metric (visitors, pageviews, bounce rate, engagement, goals, exit rate…), any dimension (source, page, country, device, UTM, custom event property…) and filters, with period-over-period comparison. All numbers come back in the site's own timezone. Full reference: statable.com/docs/integrations/mcp.
Write tools only touch configuration (sites, goals, funnels, tracking features, filters). Nothing deletes data.
| Setting | Env | Flag | Default |
|---|---|---|---|
| API key | STATABLE_API_KEY | --api-key | none |
| Remote endpoint | STATABLE_MCP_URL | --url | https://mcp.statable.com/mcp |
Without a key the server still starts and advertises its tools (so registries and hosts can inspect it), but every call returns a short message explaining how to add one.
git clone https://github.com/key-arg/statable-mcp.git
cd statable-mcp
npm install
STATABLE_API_KEY=stbl_your_key npm test
Docker:
docker build -t statable-mcp .
docker run -i --rm -e STATABLE_API_KEY=stbl_your_key statable-mcp
Statable is cookieless web analytics built for the EU: no consent banner needed for the core tracker, data hosted in the Netherlands, a tracker between 0.5 and 2 KB, goals, funnels, custom events, a public Stats API and this MCP server. Free tier for personal, educational and open-source sites.
Support: support@statable.com · Registry: com.statable/analytics in the official MCP registry
MIT © Key Arg B.V.
FAQs
MCP server for Statable, privacy-first cookieless web analytics. Query traffic, sources, pages, goals and funnels from Claude, Cursor, ChatGPT and any MCP client.
The npm package @statable/mcp receives a total of 23 weekly downloads. As such, @statable/mcp popularity was classified as not popular.
We found that @statable/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.