Overview

The MIRA FIVE MCP server lets an AI agent work with your analytics through the Model Context Protocol. With it, an agent answers questions from your data: where buyers came from, which pages convert, what changed last week, who a person is. With your permission it also sets things up: projects, sources, goals, funnels, segments, insights and dashboards, and feature flags and experiments where your organization has them. For scripts without an agent, use the REST API.

Server URLCopy Anchor Link

https://app.mirafive.io/mcp

The server speaks MCP over Streamable HTTP. Send each JSON-RPC message as its own POST. It opens no event stream and keeps no session, so GET and DELETE answer 405. It offers tools only: no resources, no prompts. Its instructions tell the agent how to read MIRA FIVE, and Tools lists every tool.

ConnectCopy Anchor Link

Clients that support OAuth need only the URL: they open your browser, you sign in to MIRA FIVE and approve the app. Other clients send an API key.

claude mcp add --transport http mirafive https://app.mirafive.io/mcp

To check the connection, ask the agent "Who am I in MIRA FIVE?". It calls whoami and names your account, the organizations it reaches and whether it may change setup.

AuthenticationCopy Anchor Link

The server accepts two credentials, both as Authorization: Bearer. Either one acts as you: it sees what you can see, in every organization you belong to, with your role in each.

OAuthCopy Anchor Link

MIRA FIVE is an OAuth 2.1 authorization server with PKCE (S256) and dynamic client registration (RFC 7591). An MCP client finds everything from the server URL:

1. A call without a token answers 401 with WWW-Authenticate: Bearer realm="mcp", resource_metadata="https://app.mirafive.io/.well-known/oauth-protected-resource/mcp".
2. GET https://app.mirafive.io/.well-known/oauth-protected-resource/mcp names the authorization server https://app.mirafive.io and the scope mcp:use.
3. GET https://app.mirafive.io/.well-known/oauth-authorization-server gives the endpoints:

4. The client registers with POST /oauth/register (client_name, redirect_uris) and becomes a public client, without a secret.
5. You sign in to MIRA FIVE, with a confirmed email address, and approve the app on the consent screen, which names where it sends you back.
6. The client exchanges the code for tokens (grant types authorization_code and refresh_token). Access tokens last 1 hour, refresh tokens 30 days.

Redirect URIs must use https, or http only to localhost, 127.0.0.1 or [::1], or the app schemes cursor, vscode, vscode-insiders and windsurf. Anything else is refused with 400 and {"error": "invalid_redirect_uri"}. A network may register 10 clients an hour. Registrations nobody approves are removed after a week.

Approved apps are listed under Connected apps on the API & MCP page. Disconnect revokes all of an app's tokens.

API keyCopy Anchor Link

Create a personal API key as described in Keys and send it as Authorization: Bearer mf_pat_…. Use it for clients without OAuth, and for agents that run unattended. The same key also reads the REST API.

PermissionsCopy Anchor Link

Every credential, each API key and each connected app, has two switches on the API & MCP page. Both are off by default.

With both off, the credential only reads. A setup tool then answers with the switch to turn on and where. The agent can check with whoami, which returns mayChangeSetup and mayChangeLiveFlags.

The switches never go beyond your role. A change also needs the role that allows it in the dashboard:

Rate limitsCopy Anchor Link

• 120 calls per minute per person, on a budget separate from the REST API. Every answer carries RateLimit-Policy: "mcp";q=120;w=60 and RateLimit: "mcp";r=…;t=…. Past the limit the answer is 429 with Retry-After.
• 30 setup changes per minute per person. Past that, the tool answers Too many setup changes in a minute. Try again in N seconds.
• 60 refused tokens per minute from one network, as on the REST API.

Audit trailCopy Anchor Link

Every tool call is recorded under API & MCP as recent access: the tool, the credential, the project and how the call ended. Arguments are never stored, since they can name people. Every setup change is also written to the audit log, naming the app or key that made it on your behalf.

Example promptsCopy Anchor Link

• "Which channels brought the most buyers to Nordlicht Shop last month, first touch?"
• "Compare this week's revenue with last week's and tell me what changed."
• "Where do people drop off between viewing a product, starting checkout and completing the order?"
• "Find lena.hoffmann@example.com and tell me how she found us and what she bought."
• "Is tracking still working on the shop? Show me the last events from the past hour."
• "Set up a purchase goal for our order_completed event, a funnel from product page to purchase, and a dashboard with both."

TroubleshootingCopy Anchor Link