Give your AI agents direct access to website analytics. Query visitor sessions, investigate UX friction, analyze conversion funnels, review campaigns and errors, and get anomaly alerts — all from Claude, Cursor, or any MCP-compatible client.

Connection Options

Hosted Remote MCP

Use this when your client supports remote MCP servers or connector-style OAuth. No local package install is required.

Field	Value
Endpoint	`https://krystalview.com/mcp`
Transport	`streamable-http`
Authentication	OAuth authorization code + PKCE
OAuth metadata	`https://krystalview.com/.well-known/oauth-authorization-server`
Protected resource metadata	`https://krystalview.com/.well-known/oauth-protected-resource`

During OAuth, KrystalView asks the signed-in user to choose the site the MCP client can read. The issued token is read-only and scoped to that site. The hosted OAuth server supports dynamic client registration, authorization code + PKCE, resource indicators, refresh-token rotation, and token revocation.

For clients that support custom headers instead of OAuth, the hosted endpoint also accepts a KrystalView read API key as either:

Authorization: Bearer kv_live_...

or:

X-API-Key: kv_live_...

Local stdio MCP Package

Use this when your MCP client runs local stdio servers, such as Claude Desktop, Claude Code, Cursor, or similar developer tools.

Install

pip install krystalview-mcp

Configure

Generate an API key in your KrystalView console under Settings > API Keys.

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "krystalview": {
      "command": "krystalview-mcp",
      "env": {
        "KRYSTALVIEW_API_KEY": "your-api-key-here"
      }
    }
  }
}

Claude Code

claude mcp add krystalview -- krystalview-mcp
# Then set your API key:
export KRYSTALVIEW_API_KEY="your-api-key-here"

Cursor

Add to your MCP settings:

{
  "krystalview": {
    "command": "krystalview-mcp",
    "env": {
      "KRYSTALVIEW_API_KEY": "your-api-key-here"
    }
  }
}

Available Tools

Tool	Description
`get_sessions`	List/search visitor sessions with filters (device, location, friction, rage clicks)
`get_session_detail`	Deep dive into a specific session — full timeline, events, navigation path
`get_site_stats`	Aggregate performance metrics — sessions, friction, devices, top pages
`get_scroll_depth`	Scroll-depth buckets for a specific page path
`get_live_visitors`	Currently active visitor count and recent live sessions
`get_anomalies`	AI-detected anomalies with explanations (traffic spikes/drops, friction surges)
`get_funnels`	List defined conversion funnels
`get_funnel_analysis`	Step-by-step funnel conversion rates and drop-off analysis
`get_campaign_summary`	UTM campaign attribution summary
`get_campaign_sessions`	Visitor sessions from a specific campaign
`get_campaign_roas`	Paid campaign spend, conversions, and ROAS where connected
`get_errors`	Aggregated client-side browser errors
`get_notifications`	Recent KrystalView notifications and insights

Example Prompts

Once connected, try asking your AI assistant:

"How's my site performing this week?"
"Show me frustrated mobile users from the last 24 hours"
"Why did our traffic drop yesterday?"
"Where are users dropping off in the checkout funnel?"
"Find sessions with rage clicks on the pricing page"
"Which campaigns are driving the most high-friction sessions?"
"Show me unresolved browser errors with sample session IDs"
"Are there any anomalies I should know about?"

Environment Variables

Variable	Required	Default	Description
`KRYSTALVIEW_API_KEY`	Yes	—	Your KrystalView API key
`KRYSTALVIEW_BASE_URL`	No	`https://krystalview.com/api`	API base URL
`KRYSTALVIEW_TIMEOUT`	No	`15`	Request timeout in seconds

Rate Limits

API keys have configurable rate limits (default: 60 requests per minute). Rate limit headers are included in every response. If you hit the limit, the server returns a clear error with retry timing.

Security

API keys are scoped to a single site — agents can only access data for the site the key was created for
OAuth tokens issued by the hosted MCP endpoint are read-only and scoped to the selected site
Hosted OAuth supports refresh-token rotation and token revocation
Browser-originating MCP/OAuth requests are checked against explicit trusted origins
Tools are read-only
All requests use HTTPS
Keys can be rotated or revoked in the KrystalView console
The local stdio package stores no data — it proxies directly to the KrystalView API