Yandex Metrica Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Yandex Metrica Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for Yandex Metrica. It lets an AI agent query your web-analytics data — traffic, sources, landing pages, conversions, geography, devices and trends — through a small set of flexible, read-only tools.
Read-only by design, no secrets stored in the package: interactive login uses a built-in public OAuth client with PKCE, and the server talks only to Yandex.
Status: early development (v0.1, work in progress). General-purpose: SEO is one of many use cases, not the focus.
There is no official Yandex Metrica MCP server, and existing community ones are mostly thin, unmaintained, or dump raw data straight into the model's context. This server aims to be the well-engineered, well-maintained, open option: flexible report tools, strict token/context discipline, read-only by default.
run_report — flexible wrapper over the Reporting API (/stat/v1/data).run_comparison — compare two periods with absolute and percentage deltas.run_drilldown — drill down through a dimension tree.run_timeseries — metrics split into a time series (/bytime) for trends.get_metadata — discover available counters, goals, and commondimensions/metrics so the model queries with real field names.
limits, and sampling/quota surfaced back to the model.
Planned for later: Logs API (raw row-level export → local SQL), Streamable HTTP transport, write tools (behind an explicit flag).
metrika:read scope (seeAuthentication). Whoever the credentials belong to must have access to the counters you query.
Recommended: interactive login. No app registration needed — the server ships a built-in public OAuth client. Run once:
yandex-metrica-mcp auth # or, in dev: bun run authIt opens a Yandex consent page; after you approve, Yandex shows a code that you paste back into the terminal. The token is cached at ~/.config/yandex-metrica-mcp/token.json (mode 0600) and is valid for ~1 year; re-run auth when it expires. The login uses authorization-code + PKCE, so no client secret is stored anywhere. A cached login takes precedence over YANDEX_METRIKA_TOKEN.
Alternative: static token. Get a token for an app with the metrika:read scope at <https://oauth.yandex.ru> and pass it as YANDEX_METRIKA_TOKEN — handy for CI or non-interactive use.
Own OAuth app (optional). To use your own app instead of the built-in one, set YANDEX_OAUTH_CLIENT_ID; add YANDEX_OAUTH_CLIENT_SECRET to also enable automatic token refresh.
Add the server to your MCP client (e.g. Claude Desktop) configuration:
{
"mcpServers": {
"yandex-metrica": {
"command": "npx",
"args": ["-y", "yandex-metrica-mcp"],
"env": {
"YANDEX_METRIKA_TOKEN": "your-oauth-token",
"YANDEX_METRIKA_COUNTER_ID": "12345678"
}
}
}
}See .env.example for all configuration options. The published package runs on Node (so npx/MCP clients work out of the box); local development uses Bun.
Once connected, an agent can answer questions like:
source?” → run_report with metrics: ["ym:s:visits","ym:s:users"], dimensions: ["ym:s:lastsignTrafficSource"].
run_comparison(server returns A, B, and the deltas).
versions.” → run_drilldown, then again with parentId.
get_metadata.This project is Bun-first:
bun install
bun run dev # run from source with hot reload
bun run typecheck # tsc --noEmit
bun run lint # eslint
bun test # bun's test runner
bun run build # emit dist/ with tsc (Node-compatible)MIT © boxlab
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.