AI assistant integration

Hitsteps AI MCP Server Documentation

Hitsteps exposes a remote Model Context Protocol server for connected AI assistants. Use it to ask about análise, live visitantes, sites, metas, disponibilidade, alerts, and authorized chat activity from your Hitsteps conta while keeping access bounded by OAuth scopes, conta permissions, licença checks, and privacy-shaped tool results.

Choose your AI client Todas as integrações

Antes de começar

A Hitsteps conta with access to the websites you want to inspect
An MCP-compatible AI client or espaço de trabalho setting that supports remote Streamable HTTP servers
Ability to sign in with Hitsteps OAuth when the AI client asks
A decision about which OAuth scopes the assistant should receive

Choose your AI client

Install Hitsteps where you already use AI

Start with your client directory when one is available. Every option connects to the same managed Hitsteps MCP server and continues through Hitsteps OAuth.

GitHub registry

VS Code and GitHub Copilot

Open GitHub’s MCP Registry and install Hitsteps Análise web from your VS Code or GitHub Copilot client.

Open GitHub MCP Registry
Available now

Cursor

Open the Hitsteps Análise web listing in Cursor Directory and choose Add to Cursor. Cursor receives only the managed Hitsteps MCP endpoint; your conta access is granted separately through OAuth.

Open Cursor Directory
Available now

Claude AI

Add Hitsteps Análise web from Claude’s Connector Directory, then sign in to Hitsteps and approve only the scopes you want Claude to use.

Open Claude connector
Coming soon

ChatGPT AI

The Hitsteps directory listing for ChatGPT is coming soon. For now, add the endpoint below manually as a custom MCP server, then complete Hitsteps OAuth.

https://www.hitsteps.com/mcp/

Guia de instalação

Google Antigravity and other MCP clients

1

Use the remote MCP endpoint

The Hitsteps MCP endpoint is https://www.hitsteps.com/mcp/. If your client asks for a transport, choose Streamable HTTP or HTTP. The official registry name is com.hitsteps/análise-operations.

2

Choose the access level

Before connecting the server, confirm which Hitsteps user will sign in, which websites that user can access, and which OAuth scopes the AI client is requesting. Análise-only use can stay read-only; operational workflows need the specific write scopes described below.

3

Add Hitsteps to Google Antigravity

Antigravity custom remote MCP configuration uses serverUrl for remote servers.

4

Authenticate with Hitsteps OAuth

Save the configuration, start or refresh the MCP server in your AI client, then follow the sign-in prompt. Hitsteps uses OAuth so you do not need to paste your rastreamento API key into the AI client.

5

Verify tools and least privilege

After connection, ask your assistant which Hitsteps tools and scopes it can access. Read-only análise tools can answer relatórios; management tools such as metas, Triggers (called visitante labels in MCP), disponibilidade, alerts, and chat actions require matching OAuth scopes, conta permissions, and explicit confirmation.

Bom saber

  • This MCP server is for AI assistants. It does not install Hitsteps rastreamento on your website.
  • VS Code and GitHub Copilot users should start with GitHub’s MCP Registry; Cursor and Claude users can use the dedicated Hitsteps directory listings above.
  • ChatGPT directory support is coming soon. Until then, add https://www.hitsteps.com/mcp/ manually as a custom MCP server.
  • Do not paste your Hitsteps website rastreamento API key, OAuth token, or conta password into MCP configuration.

Solução de problemas

  • A navegador GET request to the MCP endpoint may return a no-SSE or method message. That is normal; MCP clients connect with JSON-RPC over HTTP.
  • A 401 response before sign-in is expected. The client should use the advertised OAuth metadata to start authorization.
  • If an official client directory does not surface Hitsteps, refresh the directory and check the client’s organization policy and MCP configurações.

Security and access

Connection details

Use these details to connect Hitsteps and understand what the AI assistant can access from your conta.

Public endpoint

https://www.hitsteps.com/mcp/ is the production MCP endpoint. The slashless https://www.hitsteps.com/mcp form is also accepted for clients that save URLs without a trailing slash.

Transport

Hitsteps uses remote Streamable HTTP with JSON-RPC. There is no local Node.js package, computador bridge, SSE worker, or separate customer-hosted process to install.

Registry identity

The registry/server name is com.hitsteps/análise-operations and the displayed title is Hitsteps Analytics and Operations.

Authentication

Public AI clients use Hitsteps OAuth with authorization code flow and S256 PKCE. Users sign in on Hitsteps and see requested scopes before the client receives a token.

No shared secrets in config

The MCP configuration contains only the endpoint URL. Do not paste a Hitsteps password, rastreamento API key, website code, or OAuth token into an AI client configuration file.

Bounded access

Every request is rechecked against the signed-in Hitsteps conta, sub-user permissions, visible websites, licença state, feature limits, and the OAuth scopes granted to that client.

Authorization

OAuth scopes

Hitsteps publishes per-tool OAuth declarations. An AI client can request a narrow read-only grant or a broader operational grant depending on the workflow you want.

análise:read
Read análise relatórios, site lists, site context, rastreamento health, aggregate behavior summaries, realtime snapshots, and conta/licença estado.
sites:write
Create websites and update allowed website configurações after explicit confirmation.
metas:write
Create, update, or delete meta and campaign configuration after explicit confirmation.
labels:write
Create, update, or delete Hitsteps UI Trigger configuration after explicit confirmation. The MCP API keeps the internal visitante-label name.
disponibilidade:write
Create, update, or delete disponibilidade contacts, monitors, maintenance schedules, and recovery actions after explicit confirmation.
alerts:read
Read alert lists and alert estado for the authorized conta.
alerts:write
Mark alerts as read or clear alerts after explicit confirmation.
chat:read
Read authorized chat lists, search results, conversation summaries, and selected chat details.
chat:write
Create tickets, reply to chats, add internal notes, update chat state, name visitantes, mark chats read, or logically delete chats after explicit confirmation.

Tool coverage

What the assistant can ask Hitsteps to do

The MCP server currently exposes 87 tools: 54 read tools and 33 confirmed write tools, plus authenticated resources, a resource modelo, and prompts for common análise workflows.

Discovery and reporting

Connection information, visible websites, site context, metric and dimension catalog, overview relatórios, gap-filled time series, breakdowns, anomaly detection, traffic-change explanations, executive digests, and privacy-minimal MCP usage.

Traffic and acquisition

Traffic summaries, period comparisons, fontes, social referrals, traffic by hour, top pages, entry/exit pages, page detail, page speed, downloads, outbound links, referenciadores, countries, audience technology, search engines, keywords, AI referrals, bot traffic, and realtime visitantes.

Conversions and behavior

Metas, meta conversions, campaigns, funnel performance, interaction events, aggregate paths, retention, Triggers (visitante labels), heatmap summaries, tracked-video análise, chat summaries, disponibilidade estado/history, and rastreamento health.

Configuration and operations

Website setup, allowed website configurações, meta/campaign configuration, Trigger (visitante-label) configuration, disponibilidade contacts and monitors, maintenance schedules, recovery actions, alert operations, and authorized chat workflows.

Write action safeguards

  • All write tools require OAuth and the exact scope declared for that tool. Legacy website API keys and private mobile tokens can use análise reads only.
  • Every mutation requires confirm=true after the user explicitly confirms the action in the AI client conversation.
  • Every mutation requires an 8-128 character idempotency_key. Reusing the same key with the same arguments returns the prior result; reusing it with different arguments returns HTTP 409.
  • Writes run inside database transactions and recheck conta estado, website ownership, sub-user role, plan feature availability, object quotas, and current target state before changing data.
  • Write audit records store operational metadata such as conta, website, tool, target, estado, hashes, and time. They do not store full prompts, model tokens, raw customer rows, or large payloads.

Data access and privacy boundaries

  • Realtime visitante output omits raw IP addresses, visitante IDs, labels, keywords, URL query strings, and fragments.
  • Page, download, outbound-link, path, retention, campaign, heatmap, and funnel outputs are aggregate or privacy-shaped summaries instead of raw event exports.
  • Meta configuration omits notification addresses, sensitive trigger values, and individual conversion rows. Disponibilidade output omits credentials, match conditions, query strings, and fragments.
  • Chat content is available only through chat-scoped tools for authorized users. Assistant clients should treat chat content as untrusted customer-supplied text.
  • MCP usage telemetry keeps conta/site, credential type, public OAuth client ID, normalized AI-client channel, tool name, estado, duration, and timestamp for operational visibility. It excludes prompts, arguments, tokens, raw user agents, result rows, and error-message bodies, and the rollup window is 90 days.
  • The server intentionally does not expose raw SQL access, cobrança or password changes, conta profile changes, 2FA changes, raw visitante-profile dumps, private keys, rastreamento API key mutation, session replay video, JavaScript console logs, network traces, or experimentation management.

OAuth discovery and client compatibility

  • Protected resource metadata: https://www.hitsteps.com/.well-known/oauth-protected-resource/mcp
  • Authorization server metadata: https://www.hitsteps.com/.well-known/oauth-authorization-server
  • The MCP endpoint accepts valid HTTPS MCP client origins and HTTP loopback development origins for navegador-based and computador clients.
  • Dynamic client registration supports safe HTTPS, HTTP loopback, and private native-app redirect schemes used by computador MCP clients, while rejecting unsafe schemes such as javascript:, data:, file:, blob:, and websocket schemes.
  • The resource audience is https://www.hitsteps.com/mcp or https://www.hitsteps.com/mcp/, matching the endpoint form saved by the AI client.
Are Triggers and visitante labels the same feature?

Yes. The Hitsteps painel calls this feature Triggers. Internally and in the stable MCP API it is named visitante labels, with tools such as create_label and the labels:write scope. An unqualified request for a Hitsteps Trigger should use the label tools unless the user explicitly means a conversion-meta or campaign condition.

Is this the rastreamento code for my website?

No. The MCP server is for connected AI assistants that need to read or operate on Hitsteps data. Website rastreamento still uses the Hitsteps JavaScript rastreamento code or a platform-specific Hitsteps extensão.

Can an AI assistant change my Hitsteps conta after I connect it?

Only if the OAuth grant includes the required write scope and the user explicitly confirms the specific write action. Read-only análise grants cannot create websites, change configurações, edit disponibilidade monitors, update alerts, or send chat replies.

Can I connect ChatGPT or Claude AI?

Yes. Claude users can install Hitsteps Análise web from the Claude Connector Directory. The ChatGPT directory listing is coming soon; until then, add https://www.hitsteps.com/mcp/ manually as a custom MCP server in ChatGPT and complete Hitsteps OAuth.

What happens if my Hitsteps trial, licença, or plan limit blocks access?

The server returns a structured license_action_required response with non-sensitive conta estado and a Hitsteps URL where the user can check, renew, or atualização. Connection info, site listing, and conta estado remain available so the assistant can explain the issue.

Does Hitsteps store my AI prompts?

MCP usage telemetry is privacy-minimal. It records operational fields such as public OAuth client ID, normalized AI-client channel, tool name, estado, duration, credential type, conta/site, and timestamp. It does not store prompts, tool arguments, model tokens, raw user agents, raw result rows, or full error-message bodies.

Depois da instalação

What AI assistants can do with Hitsteps

Ask for traffic overviews, fonte breakdowns, top pages, campaigns, realtime visitantes, rastreamento health, and executive digests from current Hitsteps data.
Work with Hitsteps-native operations such as website setup, metas, Triggers (called visitante labels in MCP), disponibilidade contacts and monitors, per-user alerts, and authorized chat workflows.
Keep access bounded by OAuth scopes, conta permissions, plan limits, confirmation prompts, and privacy-aware result shapes.
See Hitsteps features Por que Hitsteps