Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Statable

NPM · @STATABLE/MCP · 2 COMPONENTS · SCANNED SEP 24

Privacy-first, cookieless web analytics: traffic, sources, pages, goals, funnels and site setup.

+3 this week 78 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4444 tokens (~177/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
  • Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 82% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 25 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Statable MCP server?

Statable runs locally as an npm package, launched with npx -y @statable/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @statable/mcp

# add to Claude Code
claude mcp add com-statable-analytics -- npx -y @statable/mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "com-statable-analytics": {
      "command": "npx",
      "args": [
        "-y",
        "@statable/mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-statable-analytics": {
      "command": "npx",
      "args": [
        "-y",
        "@statable/mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add com-statable-analytics -- npx -y @statable/mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-statable-analytics": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@statable/mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-statable-analytics --command npx --arg -y --arg @statable/mcp
# ~/.hermes/config.yaml
mcp_servers:
  com-statable-analytics:
    command: "npx"
    args: ["-y", "@statable/mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-statable-analytics": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@statable/mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add com-statable-analytics -t stdio -c npx -a -y @statable/mcp
// mcp.json
{
  "mcpServers": {
    "com-statable-analytics": {
      "command": "npx",
      "args": [
        "-y",
        "@statable/mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +3
    • Stability: unverified → 0.23 ▲ functional
  • 5 Sept 26 +15
    • Malware scan: unverified → pass ▲ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Analysed npm/@statable/mcp@0.1.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 95 packages
Packages resolved 95
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 25 exposed · ~4,444 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
create_funnel ~150

Add a funnel: an ordered list of 2+ steps. Each step is one of {"type":"page","value":"/pricing"}, {"type":"event","value":"Signup"}, {"type":"entry_page"|"exit_page","value":"/"}. An exit_page step must be last. scope "visitor" (default) or "session". A duplicate name is refused (funnel_exists). Read the result with funnel_report.

NameTypeReqDescription
namestringyes–
scopestring––
sitestring|integeryessite_id from list_sites.
stepsarrayyes–
strict_orderboolean–Steps must occur in exactly this order with nothing between.

No output schema declared.

No examples provided.

create_goal ~192

Add a goal to a site. A goal is EITHER a custom event (event_name), OR a page (path with operator), OR a scroll depth — give one of the three, not several. operator: "e" exact, "b" begins with, "c" contains. A duplicate name is refused (goal_exists).

NameTypeReqDescription
event_namestring–Custom event to count, e.g. "Signup". Use list_prop_keys or top_custom_events to see what the site already sends.
namestringyesShown in reports, e.g. "Signup".
operatorstring–How path is matched: e exact, b begins with, c contains.
pathstring–Page path, e.g. "/thanks". Pair with operator.
scroll_depthinteger–Percent scrolled.
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

create_site ~178

Add a site to this account and get back its id and tracking code. Response: {"site_id":123,"name":"https://example.com","timezone":"Europe/Amsterdam",...}. The url must include the scheme. A url this account already has is REFUSED (site_exists) rather than returned — two sites collecting the same traffic is worse than an error. Retrying with the same arguments replays the first result instead of creating a second site. Follow with get_tracking_snippet to obtain the script tag to install.

NameTypeReqDescription
hobbyboolean–Optional. Request the free hobby tier; only certain domains qualify.
timezonestring–Optional IANA name, e.g. "Europe/Amsterdam". Defaults to the account's.
urlstringyesFull origin including scheme, e.g. "https://example.com".

No output schema declared.

No examples provided.

current_visitors ~98

Realtime count of unique visitors active in the last 5 minutes for a site. Returns {"site_id":123,"visitors":N}.

NameTypeReqDescription
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

funnel_report ~302

Run a saved conversion funnel and return its per-step result (NON-tabular). Returns {"funnel":{"id","name","scope"},"entering":N,"all_visitors":N,"steps":[{"index":0,"name":"Visited /pricing","kind":"page","visitors":N,"conversion_rate":percent0to100,"dropoff":N}, ...]}. steps are ORDERED; conversion_rate is cumulative vs the first step (entering), NOT step-to-step; dropoff is visitors lost vs the previous step. Get funnel_id from list_funnels first.

NameTypeReqDescription
filtersarray–Optional SEGMENT filters (session-level only: country/browser/os/device/source/channel/utm_*/entry_page/exit_page/hostname). Event-level fields are rejected.
funnel_idintegeryesFunnel id from list_funnels.
periodstring|array–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d. Or a custom ["YYYY-MM-DD","YYYY-MM-DD"] pair.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

get_site_filters ~122

Who gets counted on a site, and who may look at the stats. Response: {"site_id":123,"hostnames":{"allowed":[],"blocked":[]},"blocked_ips":["1.2.3.4"],"countries":{"allowed":[{"code":"UA","created_at":"RFC3339"}],"blocked":[]},"public_dashboard":false}. An empty allowed list means "no restriction", not "nothing allowed". public_dashboard true means the stats are readable by anyone with the link.

NameTypeReqDescription
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

get_subscription ~112

The account's plan state — not a site's. Response: {"status":"trialing"|"active"|"past_due"|"expired"|"trial_expired"|"none","is_trial":true,"ends_at":"RFC3339","only_hobby":false}. ends_at is when the CURRENT state stops being true (trial end while trialing, period end otherwise) and is omitted when unknown. status "none" with only_hobby true means a free account, not a missing one. Takes no arguments.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_tracking_settings ~138

What the installed script actually does: which tracking features are on, which exist, and what each costs in bytes. Response: {"site_id":123,"version":N,"bundle":"...","enabled":["hash","outbound"],"features":[{"id":"outbound","label":"...","enabled":true,"locked":false,"default":false,"requires":[...],"size_br":123}]}. Locked features cannot be changed; `requires` lists features that must be on for this one to work. Needs the same access as changing them (see update_tracking_settings).

NameTypeReqDescription
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

get_tracking_snippet ~137

The script tag to install on a site, and the url it loads. Response: {"site_id":123,"type":"default","script_url":"https://...","snippet":"<script ...></script>"}. Install snippet verbatim; do not rebuild a tag from script_url. A hobby site's snippet also carries data-id, which is the only place the counter in its bundle reads the site id. Read-only: it reports the code, it does not install or verify anything.

NameTypeReqDescription
sitestring|integeryessite_id from list_sites.
typestring–Optional bundle variant; omit for the default script.

No output schema declared.

No examples provided.

list_funnels ~114

List the conversion funnels configured for a site (discovery — get a funnel_id for funnel_report). Returns {"funnels":[{"id":45,"name":"Signup flow","scope":"visitor","steps_count":3}]}.

NameTypeReqDescription
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

list_goals ~94

The goals CONFIGURED on a site — what it measures, not how those goals performed. Use top_goals for conversion numbers. Response: {"goals":[{"id":7,"name":"Signup","event_name":"Signup"|null,"path":"/thanks"|null,"operator":"e|b|c","scroll_depth":N|null}]}.

NameTypeReqDescription
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

list_prop_keys ~190

List the custom-property keys a site has recorded (with the event each belongs to) — discovery for the event:props:<key> breakdown in query_stats. Returns {"props":[{"key":"plan","event":"Signup","count":N,"first_seen":"RFC3339"}]}.

NameTypeReqDescription
periodstring|array–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d. Or a custom ["YYYY-MM-DD","YYYY-MM-DD"] pair.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

list_sites ~302

List the sites this API key can read. Response: {"sites":[{"site_id":123,"name":"<as entered by the owner — often a full URL like https://example.com/>","hash":"07k1eD84d2","timezone":"Europe/Amsterdam","hobby":false,"stats_start_date":"YYYY-MM-DD"|null,"created_at":"RFC3339"}]}. hobby=true is a free-plan site: it counts only through the bundled /t/ script get_tracking_snippet returns, so install that snippet verbatim. Use site_id with the other tools. With date_range each site also carries metrics NESTED under stats.metrics (never flat on the site object). Units: visit_duration = average seconds per visit; bounce_rate = percent 0-100; views_per_visit = pageviews/visits ratio; visitors/pageviews/visits = counts. Stats period boundaries are server-time approximations; use query_stats for timezone-exact numbers.

NameTypeReqDescription
date_rangestring–Optional. "7d"/"30d"/"month"/"realtime" or "Nd" for the last N days (1-90), e.g. "7d". Each site then gets {"stats":{"date_range":"7d","metrics":{"visitors":N,"pageviews":N,"visits":N,"visit_duration…

No output schema declared.

No examples provided.

query_stats ~604

Run a read-only analytics query for one site: aggregate totals, a time series, or a top-N breakdown. Returns {"results":[{"dimensions":{...omitted for aggregates},"metrics":{...}}]}. All dates and time buckets are in the site's own timezone (see list_sites .timezone). The event:name breakdown lists custom events (data-statable-event); its `events` metric is the raw event count. The event:goal breakdown lists the site's configured goals with `visitors` (converters), `events` (conversions) and `conversion_rate` (percent). `events`/`conversion_rate` are breakdown-only (rejected on aggregate/time-series or a dimension that doesn't compute them). Units: visit_duration = average seconds per visit; bounce_rate = percent 0-100; views_per_visit = pageviews/visits ratio; visitors/pageviews/visits = counts.

NameTypeReqDescription
comparestring|array–"previous_period" (equal-length window before date_range) or a custom ["YYYY-MM-DD","YYYY-MM-DD"] pair. Adds a compare {value, change%} block: per-metric (aggregate), per-row (breakdown; not event:st…
date_rangestring|arrayyesPreset "7d" or "30d" (last N full days), "month" (current calendar month to date; the first bucket may land on the prior month's last day), "realtime" (last ~30 min — pair with the time:minute dimens…
dimensionsarray–Zero = aggregate; one time dimension (time, time:hour, time:day, time:week, time:month) = time series; one breakdown dimension = top-N. Besides the enum you may also pass a dynamic 'event:props:<key>…
filtersarray––
limitinteger–Breakdown only. Default 100, max 1000.
metricsarrayyes–
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

top_countries ~197

Top countries by visitors for a site. Returns {"results":[{"dimensions":{"visit:country":"US"},"labels":{"visit:country":"United States"},"metrics":{"visitors":N}}]} — the dimension value is the ISO alpha-2 code (drops straight into a country filter); the display name is in labels.

NameTypeReqDescription
limitinteger–Default 100, max 1000.
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

top_custom_events ~194

Top custom events (data-statable-event) by count for a site — pageview/engagement excluded. Returns {"results":[{"dimensions":{"event:name":"Signup"},"metrics":{"events":N,"visitors":N}}]}, where events is the raw occurrence count and visitors is unique users who triggered it.

NameTypeReqDescription
limitinteger–Default 100, max 1000.
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

top_goals ~199

The site's configured goals ranked by conversions. Returns {"results":[{"dimensions":{"event:goal":"Signup"},"metrics":{"visitors":N,"events":N,"conversion_rate":percent0to100}}]}, where visitors is unique converters, events is total conversions, and conversion_rate is visitors as a percent of all visitors in the period.

NameTypeReqDescription
limitinteger–Default 100, max 1000.
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

top_pages ~167

Top pages by visitors for a site. Returns {"results":[{"dimensions":{"event:page":"/path"},"metrics":{"pageviews":N,"visitors":N}}]}.

NameTypeReqDescription
limitinteger–Default 100, max 1000.
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

top_sources ~170

Top traffic sources by visitors for a site. Returns {"results":[{"dimensions":{"visit:source":"Google"},"metrics":{"visitors":N,"bounce_rate":percent0to100}}]}.

NameTypeReqDescription
limitinteger–Default 100, max 1000.
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

update_funnel ~87

Replace a funnel's definition. Send the whole funnel including every step — omitted steps are removed, not kept.

NameTypeReqDescription
funnel_idintegeryesid from list_funnels.
namestringyes–
scopestring––
sitestring|integeryessite_id from list_sites.
stepsarrayyes–
strict_orderboolean––

No output schema declared.

No examples provided.

update_goal ~97

Replace a goal's definition. Send the whole goal, not just the changed fields — omitted fields are cleared, not kept.

NameTypeReqDescription
event_namestring––
goal_idintegeryesid from list_goals.
namestringyes–
operatorstring––
pathstring––
scroll_depthinteger––
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

update_site ~102

Change a site's url, timezone or week start. Omitted fields are left alone. Returns the updated site. Changing the url to one this account already has is refused (site_exists).

NameTypeReqDescription
sitestring|integeryessite_id from list_sites.
timezonestring–Optional IANA name.
urlstring–Optional. Full origin including scheme.
week_startinteger–Optional. 0 = Sunday ... 6 = Saturday.

No output schema declared.

No examples provided.

update_site_filters ~217

Change who gets counted, and who may look. Send only the sections you want to change — an omitted section is left untouched. A section you DO send replaces that setting entirely: {"countries":{"blocked":["RU"]}} also clears the country allow list, and {"blocked_ips":[]} empties the blocklist. Read the current state with get_site_filters and send it back with your edit applied. Filtering takes effect on new traffic; it does not remove data already collected. Answers with the resulting state plus "updated":["hostnames",...] naming what changed.

NameTypeReqDescription
blocked_ipsarray–Replaces the IP blocklist.
countriesobject–Replaces the country lists. ISO 3166-1 alpha-2 codes, e.g. "UA".
hostnamesobject–Replaces the hostname lists. Allowed non-empty = count only these.
public_dashboardboolean–true makes the stats readable by anyone with the link.
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

update_tracking_settings ~118

Set which tracking features the site's script includes. REPLACES the whole selection: send every feature you want enabled, not just the new one — anything omitted is turned off. Call get_tracking_settings first for the valid ids. Rebuilds and republishes the script, so the change reaches visitors after the CDN cache clears.

NameTypeReqDescription
featuresarrayyesFeature ids to enable, from get_tracking_settings. The complete list, not a delta; [] disables every optional feature.
sitestring|integeryessite_id from list_sites.

No output schema declared.

No examples provided.

visitors_over_time ~163

Daily visitors and pageviews time series for a site, in the site's own timezone. Returns {"results":[{"dimensions":{"time:day":"YYYY-MM-DD"},"metrics":{"visitors":N,"pageviews":N}}]}.

NameTypeReqDescription
periodstring–"7d"/"30d", or any "Nd" = last N full days (N = 1..90); "month" = current calendar month to date. Default 30d.
sitestring–Numeric site_id (preferred, from list_sites) or a domain, e.g. example.com — scheme, www. and path are ignored when matching. If several sites share the domain the call fails and lists their site_ids…

No output schema declared.

No examples provided.

Common questions

What is the Statable MCP server?

Statable is an MCP server listed in the public MCP registry as com.statable/analytics. Privacy-first, cookieless web analytics: traffic, sources, pages, goals, funnels and site setup. This page covers its npm package (@statable/mcp).

Is the Statable MCP server safe to use?

Statable scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Statable MCP server expose?

Statable exposes 25 tools: list_sites, query_stats, top_pages, top_sources, top_countries, and 20 more. Their descriptions and schemas cost roughly 4,444 tokens of context every time the server is loaded.

Is the Statable MCP server still maintained?

Statable is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Statable MCP server under?

Statable declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.