Skip to main content

​
What this lets you do

Point an AI coding assistant at your Traceten account and ask it questions directly:
Which AI assistant drove the most revenue last month, and what did those visitors read before they bought?
Your assistant answers by calling Traceten, in the same conversation you are already working in. No dashboard, no CSV export, no glue code. Traceten runs a remote MCP server at https://api.traceten.com/mcp. There is nothing to install and nothing to run locally, and 83 tools become available.

​
Two ways to connect

Only AI apps we have approved can start a connection. Claude, Claude Code, Codex, ChatGPT and VS Code are approved; anything else is refused before the sign-in page appears until we add it. None of them asks you for a client ID or secret. Each identifies itself with a metadata document it publishes, so the server URL is the only thing you type. See Install if you need an app added. ChatGPT is the one with a plan requirement, and it is OpenAI’s, not ours: custom MCP servers need developer mode, which exists only on Business, Enterprise and Edu (full access) and Pro (read tools only). See Install. Connecting with your account can never issue a credential. Minting an API key, a bot token or a webhook secret needs credentials:write, and that permission is not offered over a connection, because a connection you can stop by removing one person should not be able to leave behind a key that nobody remembers. Do those in the dashboard. There is no way to revoke a connection, and it does not expire on its own: the AI app holds a refresh token and replaces its own access token. Removing the person from your organization is what ends it, and we re-check that on every request. See Turning a connection off.

​
Before you start

If you are pasting a key, create one under Settings, then API keys, and copy the plaintext value (it is shown exactly once). Which permissions you tick decides what your assistant can do: Start with stats:read alone. You can create a second key later. A read-only key still sees every tool listed, and any tool that would change something fails with a clear permission error rather than acting. See Install for the exact steps for your client.

​
What you can ask

The tools cover the whole product surface. Some of what that makes answerable:
  • AI attribution. Which assistants send traffic, how much each one is worth, and how confident the detection was.
  • AI crawlers. Which AI companies read which pages, how far each one could be verified, and whether anyone is impersonating them.
  • Revenue. Attributed revenue by source, over time, by product, and lifetime value per acquisition source.
  • Sessions and journeys. Individual visits, what they did, and the chain of AI touchpoints leading to a purchase.
  • Visitors. People rather than visits: who keeps coming back, which assistant first sent them, and what they went on to spend.
  • Configuration. Goals, funnels, sites, webhooks and keys.
Full list: Tools.

​
What it deliberately cannot do

  • Look anyone up by identity. traceten_visitors_list finds people by dimensions you already report on, such as source, campaign, country or device. No tool takes a name, an email address, an IP address or a visitor identifier as an input, because Traceten stores none of them in a form a tool could match. Rows carry an opaque, site-scoped handle instead of an identifier, and a handle addresses a visitor your assistant has already listed rather than searching for one.
  • See a person across your sites. Every tool is scoped to a single site, and a handle issued for one site means nothing on another. Traceten attributes traffic; it does not resolve identities.
  • Send or delete event data. Recording events stays with the server SDKs, and deletion stays with the data deletion API, which requires its own permission and its own deliberate call.
  • Connect Stripe or Shopify. Connecting pastes a secret and involves a browser redirect. Your assistant can read whether a provider is connected, not change it.
  • Change your team. Membership lives in your identity provider. traceten_team_list reads it; nothing writes it.

​
Safety

Twelve tools delete something, issue a credential, or change how your numbers are measured. Called normally they return a preview of what would happen and change nothing, so your assistant can show you the consequences before anything happens. That includes every tool that returns a secret, and registering a webhook, which starts a continuous outbound flow of your data to a URL. See Safety and permissions.

​
Limits

  • 600 requests per minute per network address, and 240 per minute per key. A request has to satisfy both. A connection made with your account skips the address limit and gets 240 per person and 240 per connected app instead. Tool calls that read data also draw on your account’s normal read limit.
  • One tool call per request. Batched JSON-RPC is refused.
  • Requests are stateless. Every call carries its own credential, and there is no session to expire.
  • The server speaks POST only. There is no event stream to hold open.

​
Next