MCP and API keys

LogSure has a built-in MCP server with more than 50 tools, so Claude, ChatGPT and other AI assistants can answer questions about your visitors, funnels, errors, traces, experiments, requests and waitlists, and, if you allow it, act on them. Each connection gets only the access you choose.

Turn it on

Turn on two-factor sign-in under Settings › Security. An AI connection skips the password and the code, so the MCP server answers only while two-factor sign-in is on.
Under Settings › AI access, choose Turn on. The page shows the server's address: https://logsure.example.com/mcp.

Turning it off makes the address answer 404; connections stay, and work again when it is turned back on.

Connect a client

Client	How
Claude	Settings › Connectors › Add custom connector. Name it LogSure, paste the address, then Connect: you sign in to your console and choose what it may see. Works on claude.ai, the desktop app and the phone.
ChatGPT	In developer mode, add a connector with the address and OAuth sign-in.
Claude Code	`claude mcp add --transport http logsure https://logsure.example.com/mcp`, then `/mcp` in Claude Code to sign in.
Anything else	Clients that cannot sign in (scripts, Cursor, other agents) use an API key.

Clients that sign in use OAuth 2.1 with PKCE and dynamic client registration: the client sends your browser to the console's consent page at /oauth/authorize, where you see what it asks for and choose its access.

Access

Access	Scope	What it allows
Analytics	`analytics`	Always on. Visitors, pages, sources, events, funnels, dashboards, errors, traces and logs, experiments, feature flags, feature switches, waitlist growth and apps' settings. No email addresses.
Requests and waitlist	`inbox`	Bug reports, feedback, messages and signups, with the email addresses people gave.
Changes	`write`	Change a request's or a signup's status, add notes, archive resolved requests, delete a request or a signup, triage errors, and arrange your own dashboards. Needs Requests and waitlist.
App settings	`settings`	Off unless you tick it. Change apps' rules (form fields, attachment rules and file types, retention, waitlist rules, support notes), segments, funnels, error capture, tracing settings, experiments, feature flags, feature switches and imports, and add or rename apps. No personal data, never server keys or sign-in.

settings is never implied by another scope, and only admins and the owner can grant it. No scope reaches sign-in, two-factor, passkeys, the team, devices, API keys, AI access, privacy requests, deleting apps or a feature's data, or server keys.

Tools by scope

Scope	Tools
`analytics`	`list_apps`, `get_overview`, `get_app_stats`, `get_breakdown`, `get_event`, `get_waitlist_growth`, `get_app_settings`, `preview_segment`, `list_funnels`, `get_funnel`, `preview_funnel`, `list_dashboards`, `get_dashboard`, `list_errors`, `get_error`, `list_traces`, `get_trace`, `search_logs`, `get_service_stats`, `list_experiments`, `get_experiment_results`, `list_flags`, `get_flag`, `get_features`, `get_import`, `list_google_properties`
`inbox`	`list_requests`, `get_request`, `list_waitlist`, `get_notifications`
`write`	`set_request_status`, `add_request_note`, `set_signup_status`, `archive_resolved_requests`, `delete_request`, `delete_signup`, `mark_notifications_read`, `set_error_status`, `add_error_note`, `create_dashboard`, `update_dashboard`, `reset_dashboard`, `delete_dashboard`
`settings`	`set_app_rules` (each rule named is replaced whole: read, change, send back), `set_segments`, `set_funnels`, `create_app`, `update_app`, `refresh_app_icon`, `set_error_settings`, `set_tracing_settings`, `create_experiment`, `update_experiment`, `start_experiment`, `stop_experiment`, `create_flag`, `update_flag`, `toggle_flag`, `set_flag_rollout`, `set_features`, `start_import`, `cancel_import`, `delete_imported_data`

API keys

For a client that cannot sign in, make a key under Settings › AI access › New API key: a name, and the same access choices. The key (ccm_…) is shown once and works until you revoke it.

claude mcp add --transport http logsure https://logsure.example.com/mcp --header "Authorization: Bearer ccm_…"

Cursor, Windsurf and other clients take it in mcp.json:

{
  "mcpServers": {
    "logsure": {
      "url": "https://logsure.example.com/mcp",
      "headers": { "Authorization": "Bearer ccm_…" }
    }
  }
}

Every connection and key is listed under Settings › AI access with its access, when it was added and when it was last used. Revoke one and its next request gets 401.

The protocol

POST /mcp speaks MCP over Streamable HTTP: JSON-RPC 2.0, one message or a batch of up to 50, JSON answers, no sessions. Without a valid token the answer is 401 with a WWW-Authenticate header pointing at the protected-resource metadata. The OAuth endpoints are in the API reference.

API keys and MCP tokens work for /mcp only. The console API (/api/v1) takes the web console's session or a device token.