Connect an AI Assistant (MCP)

Ask Claude or ChatGPT about your SourceTrack setup (is the tracker firing, is attribution coverage healthy, how many leads came from which campaign) without leaving the chat. Read-only, and scoped by a token you issue.

Agent guidance

• Connect over the hosted endpoint below. There is no package to install.
• Send the API token in the Authorization: Bearer header of the MCP client configuration. Do not paste an API token into a chat message, a prompt, a code file or any client-side code.
• Never put a server API token in the browser. The only value that belongs in browser code is the public site key in the tracking snippet.
• Every tool is read-only. No tool returns revenue, order value, cost, ad spend, ROAS, CPL or CAC.

Connection and setup

SourceTrack serves MCP over a remote Streamable HTTP endpoint. There is no package to install: every client below connects to the same URL.

1. Streamable HTTP endpoint

Add this endpoint to any remote MCP client (ChatGPT Developer Mode, Claude, or a custom agent). Send your API token as an Authorization: Bearer header and the token-authed tools use it:

https://api.srctk.com/api/mcp

2. Claude Code CLI

Add the endpoint with your token as a header:

claude mcp add --transport http sourcetrack https://api.srctk.com/api/mcp --header "Authorization: Bearer st_live_your_api_token_here"

3. Clients configured with JSON

For clients that take a remote server entry with headers (for example a project .mcp.json in Claude Code):

{
  "mcpServers": {
    "sourcetrack": {
      "type": "http",
      "url": "https://api.srctk.com/api/mcp",
      "headers": {
        "Authorization": "Bearer st_live_your_api_token_here"
      }
    }
  }
}

Which clients work

Both the modern stateless revision (2026-07-28) and earlier handshake-based revisions (2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25) are served concurrently on the same endpoint. The endpoint accepts POST only.

Issue a token

Key-authed tools require a SourceTrack API token. Generate one in the app at Settings, Advanced, API tokens (https://app.sourcetrack.ai/settings?tab=advanced#api-tokens), then send it as an Authorization: Bearer header from your client. If your client cannot set a header, a tool also accepts the token as its api_key argument, but that puts the token in the conversation, so prefer the header.

Grant only the scopes required:

• read:diagnostics: pipeline state, configuration, and event validation tools.
• read:volume: lead and campaign counts and volume breakdowns.
• read:attribution: conversion counts by first-touch channel.
• write:capi_push, write:crm_sync, write:campaign_tags: reserved groundwork scopes (dry-run simulation only).

One token, one site. The site is resolved from the token itself. There is no site argument on any tool, so a token can never read a site it was not issued for, and an assistant cannot be talked into naming a different one.

Available tools

These descriptions are the exact text your AI client is given, not a summary of it, so what you read here is what the model reads.

detect_platform

API token, scope read:diagnostics.

Detect the CMS or platform (Shopify, WordPress, Webflow, GTM) of the site this API key belongs to. Scans only that site's registered domain — no other domain can be passed.

get_install_snippet

No credential.

Get the tracking script snippet and step-by-step install instructions for a target platform

verify_installation

Signed-in session.

Verify if tracking script events are active on a site. Note: Live backend status API requires an authenticated user session Bearer token (auth_token or SOURCETRACK_AUTH_TOKEN env var)

get_workspace_context

API token, scope read:diagnostics.

Identify the site this API key reads: site_id, domain, timezone, attribution window, onboarding state. Configuration only, no metrics — call this first so later answers can name which site and timezone they refer to.

get_site_health

API token, scope read:diagnostics.

Is the tracker plumbed in? Reports script_detected, last_seen_at, hours since last seen, onboarding state and plan. Answerable without the analytics read store, so it still works when that store is the thing that is broken.

get_data_quality

API token, scope read:diagnostics.

Latest result per check from the nightly data-quality job (status, value, threshold, message). Returns has_data:false when the job has never run for this site — never an all-clear it cannot substantiate.

debug_data_flow

API token, scope read:diagnostics.

Attribution COVERAGE over a window: how many recorded conversions carry a usable source, and what share arrived UTM/click-id tagged. Pipeline completeness only — it does not say which channel deserves credit and returns no revenue.

verify_events

API token, scope read:diagnostics.

Is the ingest rail receiving events? Returns the most recent event timestamp and minutes since. If the analytics read store is unreachable this fails explicitly (READ_STORE_UNAVAILABLE) rather than reporting zero events — a SourceTrack read failure must never be read as broken customer tracking.

get_leads_volume

API token, scope read:volume.

Lead COUNTS over a window, plus a breakdown by one dimension (source, medium or campaign). Volume only: returns no revenue, no cost and no cost-derived metric, and takes no attribution-model argument — dimension values are always the FIRST touch, echoed back as "touch":"first" on every row. The breakdown is a complete partition: untagged traffic is reported as its own "(untagged)" bucket rather than omitted. distinct_leads (unique converting visitors) and breakdown.total (conversion events) are different units and are not expected to match.

get_campaign_volume

API token, scope read:volume.

Per-campaign VOLUME over a window: distinct visitors and lead-type conversions per campaign. Volume only: there is no revenue, cost, ROAS or CPL column, and no attribution-model argument — campaign values are always the FIRST touch, echoed back as "touch":"first" on every row. Untagged traffic is included as the "(untagged)" campaign so the totals are a complete partition. This tool ranks campaigns by volume and says nothing about which campaign caused or deserves credit for anything.

get_conversions_by_channel

API token, scope read:attribution.

Conversion COUNTS over a window, split by acquisition channel. Counts only: returns no revenue, no value in any unit, no cost and no cost-derived metric, and takes no attribution-model argument — the channel is always the FIRST touch, echoed back as "touch":"first" on every row. Refunds are not counted. The breakdown is a complete partition: conversions with no recorded channel are reported as "(untagged)" rather than omitted, so rows sum to the stated total. Figures come from the attribution job, so very recent conversions may not appear until it has run. This tool reports volume by channel and says nothing about which channel caused or deserves credit for a conversion.

push_offline_conversion

API token, scope write:capi_push.

Validate and simulate pushing an offline conversion to ad platform Conversion APIs (Meta, Google, TikTok, Microsoft). Groundwork tool, dry-run only: returns simulated validation and payload structure without executing live external writes.

sync_lead_to_crm

API token, scope write:crm_sync.

Validate and preview syncing a lead record to CRM integrations (HubSpot). Groundwork tool, dry-run only: evaluates lead properties, reports connection status, and returns payload preview without executing live external writes.

tag_campaign

API token, scope write:campaign_tags.

Validate and preview applying organizational tags or flags to a campaign or lead. Groundwork tool, dry-run only: verifies entity format and returns tag payload preview without persisting changes.

What this server will not tell an AI

Stated up front rather than left to be discovered as a gap. No tool returns revenue, order value, cost, ad spend, ROAS, CPL or CAC, and no tool accepts an attribution-model argument. Lead and campaign figures are counts, always first-touch, and every response says so inline.

This is a product decision, not a gap to be filled later: an assistant that holds your revenue numbers is one convincing prompt away from repeating them somewhere it should not. Every tool here is read-only: nothing an assistant does through this server can change your data, your billing, or your settings.