Get started with MCP

Connect your AI assistant to Datasense to ask about traffic, revenue, goals, errors and AI crawlers in plain English. You need a Datasense account with at least one website.

Choose how to connect

Choose one method. Both use Streamable HTTP at the same URL:

https://usedatasense.com/api/mcp

• Sign in with OAuth: recommended for clients that offer it, including Claude Code, Codex and Cursor. You pick websites and permissions on Datasense; the client handles its token. No key to create or copy.
• Use an API token: for clients that ask for a Bearer token. Create a scoped account token and add it to the client's configuration.

Both methods offer the same tools, all read-only.

Connect with OAuth

1. Add Datasense to your client

Claude Code: add the server, then run /mcp inside Claude Code and choose Authenticate:

claude mcp add --transport http datasense https://usedatasense.com/api/mcp

Codex: add the server and complete the browser sign-in:

codex mcp add datasense --url https://usedatasense.com/api/mcp

Cursor, VS Code, Windsurf and others: add a remote MCP server with the URL above and choose OAuth or Sign in. Clients register themselves (dynamic registration and client ID metadata documents are both supported).

2. Sign in and approve access

1. Sign in on Datasense with your account.
2. Select the websites this client may access.
3. Review the permissions. Read permissions are selected by default; visitor names and emails (visitors:details) are off unless you turn them on.
4. Select Allow access to return to your client.

The client gets a token for that connection and refreshes it on its own. Your Datasense session and website keys are never shared with it.

3. Try it

List my websites, then show visitors and revenue for the last 7 days and the top referrers.

Manage or revoke the connection in API & MCP → Connected apps.

Connect with an API token

1. Create an account token

1. Open API & MCP in the dashboard.
2. Under New access token, choose All websites or Specific websites.
3. Keep only the permissions you need. For analytics, websites:read and analytics:read are enough.
4. Name it, select Create token, and copy the ds_at_ value. It's shown once.

A website key (ds_sk_, from a website's Settings → API) works too, with access to that one website.

2. Add it to your client

Send it as Authorization: Bearer …. Keep it in the client's settings or an environment variable, never in source control or a chat.

Claude Code:

claude mcp add --transport http datasense https://usedatasense.com/api/mcp \
  --header "Authorization: Bearer ds_at_xxx"

Codex: export the token as DATASENSE_TOKEN, then:

codex mcp add datasense \
  --url https://usedatasense.com/api/mcp \
  --bearer-token-env-var DATASENSE_TOKEN

Cursor (mcp.json), with DATASENSE_TOKEN in Cursor's environment:

{
  "mcpServers": {
    "datasense": {
      "url": "https://usedatasense.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:DATASENSE_TOKEN}"
      }
    }
  }
}

Other clients: enter the URL and Bearer token in their remote MCP settings. Clients that only run local stdio servers need a bridge such as mcp-remote.

3. Try it and manage access

Ask your client to list your websites. Delete the token in API & MCP to revoke it.

How access is limited

Every call checks the credential, the permission the tool needs, and that you still own the website. A website ID in a request is a target to check, not proof of access: a connection approved for Website A can't read Website B.

OAuth connections only reach the websites you approved; websites added later aren't shared automatically. OAuth access tokens last an hour and refresh for up to 30 days, and a connection needs fresh consent after 90 days. Account tokens last until you delete them. OAuth tokens only work at the MCP endpoint, not the REST API.

Safety

• Start small. Give a client only the websites and permissions it needs.
• Read-only. MCP can't change settings, delete data or create credentials.
• Keep credentials private. Anyone with a valid token can use its access until it expires or is revoked. Never put tokens in URLs, repositories or chat messages.
• Rate limits. 60 requests a minute per credential; a 429 means back off and retry.

For scopes and OAuth details, see the OAuth reference.

Next steps

• MCP overview and example questions
• MCP tool reference
• OAuth permissions and protocol reference
• API authentication and scopes