Mcp Pirsch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Pirsch (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A focused, read-only Model Context Protocol server for Pirsch Analytics API v1. It uses MCP SDK v2 and returns both structured results and JSON text for every successful tool call.
{
"mcpServers": {
"pirsch": {
"command": "npx",
"args": ["-y", "@verygoodplugins/mcp-pirsch@latest"],
"env": {
"PIRSCH_CLIENT_ID": "your-read-only-oauth-client-id",
"PIRSCH_CLIENT_SECRET": "your-oauth-client-secret",
"PIRSCH_DEFAULT_DOMAIN_ID": "optional-default-domain-id"
}
}
}
}PIRSCH_DEFAULT_DOMAIN_ID is optional. When it is unset, every query tool requires domainId; the server never picks the first accessible domain. Use pirsch_list_domains to discover IDs safely.
Optional PIRSCH_TIMEZONE supplies the default timezone for requests that do not explicitly include timezone.
| Tool | Purpose |
|---|---|
pirsch_list_domains | Lists only id, hostname, display name, and timezone. |
pirsch_query_statistics | Reads one documented v1 metric, with dates and filters. |
pirsch_list_filter_options | Lists allowed values for a documented filter dimension. |
pirsch_compare_periods | Compares actual totals and visitor series for two periods. |
All tools are read-only. They return structuredContent matching their output schema as well as an equivalent JSON text block. Input or API failures use MCP isError: true and do not expose credentials or raw upstream bodies.
pirsch_query_statistics accepts a metric, optional domainId, and flat camel-case filters. Most metrics require ISO dates:
{
"metric": "pages",
"domainId": "your-domain-id",
"from": "2026-08-01",
"to": "2026-08-23",
"limit": 20,
"sort": "visitors",
"direction": "desc"
}The server maps public camel-case fields such as eventMetaKey, entryPath, operatingSystem, and utmCampaign to Pirsch's documented API-v1 parameter names. limit is constrained to 1–100 and active visitor start to 0–3600 seconds.
Metrics include totals, visitors, pages and entry/exit pages, session and page duration, goals, events and event metadata, growth, active visitors, time breakdowns, acquisition, browser/device, geographic, UTM, tags, keywords, funnels, sessions, and session details. session_details requires both visitorId and sessionId; event-specific metrics require event.
Provide a named period (today, yesterday, week, lastWeek, month, or lastMonth) or both explicit date pairs:
{
"domainId": "your-domain-id",
"from": "2026-08-01",
"to": "2026-08-07",
"compareFrom": "2026-07-25",
"compareTo": "2026-07-31",
"scale": "day"
}The response compares /statistics/total and retains the two /statistics/visitor series; it does not estimate totals by summing charts.
Version 1.0 intentionally replaces the former 17-tool interface. There are no default aliases because aliases would keep unsafe domain-selection and ambiguous input behavior alive.
| Previous tools | Replacement |
|---|---|
pirsch_overview, pirsch_total, pirsch_pages, pirsch_events, and other statistic tools | pirsch_query_statistics with metric |
pirsch_utm | pirsch_query_statistics with one of the utm_* metrics |
pirsch_compare | pirsch_compare_periods |
| Domain discovery | pirsch_list_domains |
Input names are now camel-case and flat (domainId, compareFrom, eventMetaKey), not domain_id, nested filter, or compatibility aliases.
npm install
npm run typecheck
npm run lint
npm test
npm run build
npx -y @modelcontextprotocol/inspector@latest --cli node dist/index.js --method tools/list --format jsonThe release workflow publishes to npm with trusted publishing and then publishes the same tagged manifest to the MCP Registry through GitHub OIDC. Local development and CI never publish anything.
For bugs and feature requests, open an issue in this repository. Pirsch questions are best answered through the Pirsch documentation; package support is maintained by Very Good Plugins.
Built with 🧡 by Very Good Plugins.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.