Security-first MCP server for Umami analytics (Cloud + self-hosted): set up, analyze, report, and manage your instance from any MCP client.
Security-first MCP server for Umami analytics (Cloud + self-hosted): set up, analyze, report, and manage your instance from any MCP client. That is what the umami mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
…with credentials supplied via environment variables. For Umami Cloud, create an API key at Dashboard → Settings → API keys and set UMAMI_API_KEY. For self-hosted, set UMAMI_API_URL + UMAMI_USERNAME + UMAMI_PASSWORD. See MCP client setup for copy-paste configs.
The server publishes 14 tools. What each one is for:
Variable — ModeUMAMI_API_KEY — CloudUMAMI_CLOUD_REGION — CloudUMAMI_API_URL — self-hostedUMAMI_TEAM_ID — bothUMAMI_DEFAULT_TIMEZONE — bothUMAMI_ENABLE_WRITE — bothUMAMI_ENABLE_ADMIN — bothUMAMI_ALLOW_DESTRUCTIVE — bothMCP_AUTH_TOKEN — remoteTier — Enable withread — (always on)Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
Configuration is passed through the environment: UMAMI_API_KEY, UMAMI_API_URL, UMAMI_USERNAME, UMAMI_PASSWORD, UMAMI_ENABLE_WRITE, UMAMI_CLOUD_REGION, UMAMI_TEAM_ID, MCP_AUTH_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Umami's toolset — Variable, UMAMI_API_KEY, UMAMI_CLOUD_REGION and 11 more — is a fair guide to whether it matches your workflow. It is maintained by msiatrak; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Variable | Mode |
| UMAMI_API_KEY | Cloud |
| UMAMI_CLOUD_REGION | Cloud |
| UMAMI_API_URL | self-hosted |
| UMAMI_TEAM_ID | both |
| UMAMI_DEFAULT_TIMEZONE | both |
| UMAMI_ENABLE_WRITE | both |
| UMAMI_ENABLE_ADMIN | both |
| UMAMI_ALLOW_DESTRUCTIVE | both |
| MCP_AUTH_TOKEN | remote |
| Tier | Enable with |
| read | _(always on)_ |
| write | UMAMI_ENABLE_WRITE=1 |
| admin | UMAMI_ENABLE_ADMIN=1 _(self-hosted)_ |
{
"mcpServers": {
"umami": {
"command": "npx",
"args": ["-y", "umami-analytics-mcp"],
"env": {
"UMAMI_API_KEY": "your_cloud_api_key"
// self-hosted instead:
// "UMAMI_API_URL": "https://stats.example.com",
// "UMAMI_USERNAME": "admin",
// "UMAMI_PASSWORD": "••••••",
// opt into writes:
// "UMAMI_ENABLE_WRITE": "1"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| UMAMI_API_KEY | Credential the server authenticates with. | Yes |
| UMAMI_API_URL | Endpoint or connection string the server talks to. | Yes |
| UMAMI_USERNAME | Configuration value read at startup. | Optional |
| UMAMI_PASSWORD | Configuration value read at startup. | Optional |
| UMAMI_ENABLE_WRITE | Configuration value read at startup. | Optional |
| UMAMI_CLOUD_REGION | Configuration value read at startup. | Optional |
| UMAMI_TEAM_ID | Configuration value read at startup. | Optional |
| MCP_AUTH_TOKEN | Credential the server authenticates with. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.