Hitsteps Analytics and Operations

com.hitstepsPublished by hitsteps.comOfficial publisherv1.1.4Updated Nov 2, 2026

AI access to Hitsteps analytics, live visitors, uptime, goals, alerts, and chats.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringData & Analytics

Overview

AI-generated overview

Hosted Hitsteps MCP server giving an assistant OAuth-scoped access to website analytics, live visitors, uptime, goals, alerts and chats.

What you can do
  • Read website analytics and live visitor data from a Hitsteps account
  • Check uptime, goals and alerts for tracked sites
  • Access chat conversations tied to the account
  • Perform scoped write operations that require explicit confirmation and an idempotency key
  • Results are privacy-shaped: no raw SQL, private keys, visitor-profile dumps or session-replay video
When to use it
Useful when you already run Hitsteps on your websites and want an assistant to answer questions about traffic, live visitors, uptime, goals or chats, or to make confirmed changes, without building your own integration.
Requirements
A remote Streamable HTTP endpoint; nothing is installed locally. Requires a Hitsteps account and OAuth sign-in with scope approval. Client configuration holds only the endpoint URL. Works with clients such as VS Code/Copilot, Cursor, Claude, ChatGPT (custom server) and Google Antigravity.
Before you install
Access is tied to your Hitsteps account, sub-user permissions, visible websites, license state and granted scopes. Write operations change data and need their specific scope plus explicit confirmation. Never paste a Hitsteps password, tracking API key, OAuth token or private key into client configuration; analytics data is sent to the assistant through the hosted service.

Installation

In SourceWeft

  1. Open Hitsteps Analytics and Operations in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.hitsteps%2Fanalytics-operations/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "hitsteps-analytics-and-operations": {
      "type": "http",
      "url": "https://www.hitsteps.com/mcp/"
    }
  }
}

README

Hitsteps MCP Server

Public metadata and setup notes for the Hitsteps remote Model Context Protocol server.

Hitsteps exposes a hosted MCP server for analytics and website operations:

text
https://www.hitsteps.com/mcp/

The current registry metadata release is 1.1.6. This repository is intentionally small: it contains public registry metadata and setup notes, not the production Hitsteps PHP service, private OAuth keys, reviewer accounts, customer data, or deployment credentials.

Install

Use the full Hitsteps setup and security guide:

text
https://www.hitsteps.com/plugin/?type=mcp

Available client paths:

Google Antigravity configuration:

json
{  "mcpServers": {    "Hitsteps": {      "serverUrl": "https://www.hitsteps.com/mcp/"    }  }}

The same managed endpoint is used by every client. There is no local package, Node.js process, desktop bridge, SSE worker, or separate customer-hosted service to install.

Registry Metadata

The root server.json file is the canonical public metadata for MCP registries and galleries. It declares:

  • registry name: com.hitsteps/analytics-operations
  • display title: Hitsteps Analytics and Operations
  • transport: Streamable HTTP
  • remote endpoint: https://www.hitsteps.com/mcp/
  • icon: https://www.hitsteps.com/favicon.png
  • documentation: https://www.hitsteps.com/plugin/?type=mcp
  • current metadata version: 1.1.6

The com.hitsteps/analytics-operations name is domain-authenticated. Keep this identity unless Hitsteps intentionally publishes a second GitHub-namespaced entry such as io.github.Hitsteps/....

Authentication and Safety

Hitsteps uses OAuth for public MCP access. Users sign in on Hitsteps and approve the requested scopes before the client receives a token. The client configuration contains only the endpoint URL; never paste a Hitsteps password, tracking API key, OAuth token, private key, or reviewer credential into a client configuration or this repository.

The server rechecks the signed-in account, sub-user permissions, visible websites, license state, feature limits, and granted OAuth scopes on every request. Write operations require their specific scope, explicit confirmation, and an idempotency key. Results are privacy-shaped and do not expose raw SQL, private keys, raw visitor-profile dumps, or session-replay video.

Validation

Validate metadata before publishing:

sh
mcp-publisher validate

Publish from this repository only after domain authentication is available to the publisher environment. Private signing keys and domain-authentication material must stay outside this repository.

Security Reports

Please report suspected vulnerabilities through the Hitsteps contact page. Do not open public issues containing OAuth tokens, customer analytics data, account credentials, private keys, reviewer credentials, or raw request logs with sensitive values.

Source: README.md at commit 9ce4b28

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.1.4LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.