AI assistants

Point an AI assistant at your own numbers and ask questions in plain language. The server speaks Model Context Protocol, the open standard that lets clients like Claude Code and Cursor call external tools, so "how did the pricing page do last week" becomes a real query against your site instead of a guess.

It is a thin layer over the Stats API. Same key, same data, same limits, no separate access path.

https://statable.com/api/mcp

Before you start

You need an API key. Keys are created in the dashboard and shown once.

1. Open Settings → API.

2. Select Create API key.

   

3. Fill in the dialog:

   Field	What it does
   Name	A label, up to 100 characters. Name it after the machine or client that will hold it.
   Access	All sites, or one specific site. A single-site key can never read anything else.
   Expires in	Never, 30d, 60d, 90d or 1y.

4. Copy the token from the Your API key dialog. It starts with stbl_ and is stored only as a hash, so this is the one time it is shown. Lose it and you rotate the key or create a new one.

You can hold up to 10 active keys. The table on the same page shows each key's name, access, creation date, last use and expiry, with Rotate and Revoke in the row menu.

The token is a secret

Anyone holding it can read every site the key covers. Keep it on your own machine or in a server-side secret store, never in a repository or in browser JavaScript. Revoke a leaked key immediately, then create a replacement.

Connect Claude Code

claude mcp add --transport http statable https://statable.com/api/mcp \
  --header "Authorization: Bearer stbl_YOUR_KEY"

Check the connection with claude mcp list, then run /mcp to see the tools.

Connect other clients

Any client that supports a remote MCP server over Streamable HTTP works, as long as it can send an Authorization header. Most of them read a JSON config in this shape:

{
  "mcpServers": {
    "statable": {
      "type": "http",
      "url": "https://statable.com/api/mcp",
      "headers": { "Authorization": "Bearer ${STATABLE_API_KEY}" }
    }
  }
}

Read the token from an environment variable, as above, whenever the config file is shared or committed.

Available tools

Twelve tools, all read-only. Each takes an optional site (a numeric site ID or a domain), which you can omit when the key is locked to a single site.

Tool	Returns
list_sites	Sites the key can read, with timezone and, optionally, headline metrics
query_stats	The full query surface: totals, time series or a top-N breakdown, with filters
top_pages	Most visited pages
top_sources	Where traffic came from
top_countries	Visitors by country
top_custom_events	Custom events ranked by count
top_goals	Goals ranked by conversions, with conversion rate
list_prop_keys	Custom property keys a site has recorded
list_funnels	Saved funnels, and the IDs funnel_report needs
funnel_report	One funnel run out to per-step visitors, conversion rate and dropoff
current_visitors	Visitors active in the last five minutes
visitors_over_time	Daily visitors and pageviews

query_stats covers everything the others do and more. The rest are shortcuts for the questions people ask constantly.

Dates and time buckets follow each site's own timezone, the one set under Site settings → General.

What to ask

The client picks the tool, so ask for the answer rather than the endpoint:

• How many visitors did example.com get last week?
• Top 10 countries for the last 30 days.
• Which pages get the most traffic this month?
• How is my signup funnel converting?
• Anyone on the site right now?

Limits

Read-only. There are no tools that create, edit or delete anything. Your data cannot be changed through this server.

Aggregates only. Tools return counts and rates, the same numbers the dashboard draws. There is no tool that hands back raw visitor-level rows.

Rate limits. Two hourly windows apply, one per key and one across every key on the account. Both scale with your plan. Over the limit, requests answer 429 with a Retry-After header, and your client will report the tool call as failed until the window resets.

Your key's reach. A key never sees more than its owner. An all-sites key covers the sites you have access to today; a single-site key covers one.

Common problems

Symptom	Cause
Client reports 401 or "unauthorized"	The key is missing, mistyped, expired or revoked. Confirm the header reads Bearer stbl_…, then check the key's status under Settings → API.
Tools connect but list one site	The key is locked to that site. Create an all-sites key if you need the rest.
A site is not found by name	Sites are stored as the owner typed them, often as a full URL. Call list_sites and pass the numeric site_id.
Empty results on a new site	Nothing has been collected yet. Check Verify installation.

Reference

• Protocol version 2025-06-18, with 2025-03-26 and 2024-11-05 also accepted.
• Server identifies itself as statable, version 1.0.0.
• Transport is stateless. Every call is one HTTP POST answered with one JSON response, so nothing is kept between calls.

---

Ready to take control of your web analytics? Try Statable free for 30 days — no credit card required, full feature access, GDPR-compliant by default. Start your free trial or view a live demo.