KrystalView MCP Server
Give your AI agents direct access to website analytics. Query visitor sessions, investigate UX friction, analyze conversion funnels, review campaigns and errors, and get anomaly alerts — all from Claude, Cursor, or any MCP-compatible client.
Connection Options
Hosted Remote MCP
Use this when your client supports remote MCP servers or connector-style OAuth. No local package install is required.
| Field | Value |
|---|---|
| Endpoint | https://krystalview.com/mcp |
| Transport | streamable-http |
| Authentication | OAuth authorization code + PKCE |
| OAuth metadata | https://krystalview.com/.well-known/oauth-authorization-server |
| Protected resource metadata | https://krystalview.com/.well-known/oauth-protected-resource |
During OAuth, KrystalView asks the signed-in user to choose the site the MCP client can read. The issued token is read-only and scoped to that site. The hosted OAuth server supports dynamic client registration, authorization code + PKCE, resource indicators, refresh-token rotation, and token revocation.
For clients that support custom headers instead of OAuth, the hosted endpoint also accepts a KrystalView read API key as either:
Authorization: Bearer kv_live_...
or:
X-API-Key: kv_live_...
Local stdio MCP Package
Use this when your MCP client runs local stdio servers, such as Claude Desktop, Claude Code, Cursor, or similar developer tools.
Install
pip install krystalview-mcp
Configure
Generate an API key in your KrystalView console under Settings > API Keys.
Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"krystalview": {
"command": "krystalview-mcp",
"env": {
"KRYSTALVIEW_API_KEY": "your-api-key-here"
}
}
}
}
Claude Code
claude mcp add krystalview -- krystalview-mcp
# Then set your API key:
export KRYSTALVIEW_API_KEY="your-api-key-here"
Cursor
Add to your MCP settings:
{
"krystalview": {
"command": "krystalview-mcp",
"env": {
"KRYSTALVIEW_API_KEY": "your-api-key-here"
}
}
}
Available Tools
| Tool | Description |
|---|---|
get_sessions | List/search visitor sessions with filters (device, location, friction, rage clicks) |
get_session_detail | Deep dive into a specific session — full timeline, events, navigation path |
get_site_stats | Aggregate performance metrics — sessions, friction, devices, top pages |
get_scroll_depth | Scroll-depth buckets for a specific page path |
get_live_visitors | Currently active visitor count and recent live sessions |
get_anomalies | AI-detected anomalies with explanations (traffic spikes/drops, friction surges) |
get_funnels | List defined conversion funnels |
get_funnel_analysis | Step-by-step funnel conversion rates and drop-off analysis |
get_campaign_summary | UTM campaign attribution summary |
get_campaign_sessions | Visitor sessions from a specific campaign |
get_campaign_roas | Paid campaign spend, conversions, and ROAS where connected |
get_errors | Aggregated client-side browser errors |
get_notifications | Recent KrystalView notifications and insights |
Example Prompts
Once connected, try asking your AI assistant:
- "How's my site performing this week?"
- "Show me frustrated mobile users from the last 24 hours"
- "Why did our traffic drop yesterday?"
- "Where are users dropping off in the checkout funnel?"
- "Find sessions with rage clicks on the pricing page"
- "Which campaigns are driving the most high-friction sessions?"
- "Show me unresolved browser errors with sample session IDs"
- "Are there any anomalies I should know about?"
Environment Variables
| Variable | Required | Default | Description |
|---|---|---|---|
KRYSTALVIEW_API_KEY | Yes | — | Your KrystalView API key |
KRYSTALVIEW_BASE_URL | No | https://krystalview.com/api | API base URL |
KRYSTALVIEW_TIMEOUT | No | 15 | Request timeout in seconds |
Rate Limits
API keys have configurable rate limits (default: 60 requests per minute). Rate limit headers are included in every response. If you hit the limit, the server returns a clear error with retry timing.
Security
- API keys are scoped to a single site — agents can only access data for the site the key was created for
- OAuth tokens issued by the hosted MCP endpoint are read-only and scoped to the selected site
- Hosted OAuth supports refresh-token rotation and token revocation
- Browser-originating MCP/OAuth requests are checked against explicit trusted origins
- Tools are read-only
- All requests use HTTPS
- Keys can be rotated or revoked in the KrystalView console
- The local stdio package stores no data — it proxies directly to the KrystalView API
License
MIT