Scope Analytics
PYPI · SCOPE-ANALYTICS-MCP · SCANNED SEP 20
Install + query Scope analytics from an AI coding agent (Claude Code, Cursor, etc.).
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 0 of 29 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency6
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 4 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2860 tokens (~220/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Scope Analytics MCP server?
Scope Analytics runs locally as a PyPI package, launched with uvx scope-analytics-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · scope-analytics-mcp
claude mcp add wally827-scope-analytics-mcp -- uvx scope-analytics-mcp
{
"mcpServers": {
"wally827-scope-analytics-mcp": {
"command": "uvx",
"args": [
"scope-analytics-mcp"
]
}
}
} {
"servers": {
"wally827-scope-analytics-mcp": {
"command": "uvx",
"args": [
"scope-analytics-mcp"
]
}
}
} codex mcp add wally827-scope-analytics-mcp -- uvx scope-analytics-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"wally827-scope-analytics-mcp": {
"type": "local",
"command": [
"uvx",
"scope-analytics-mcp"
],
"enabled": true
}
}
} openclaw mcp add wally827-scope-analytics-mcp --command uvx --arg scope-analytics-mcp
mcp_servers:
wally827-scope-analytics-mcp:
command: "uvx"
args: ["scope-analytics-mcp"] {
"McpServers": {
"wally827-scope-analytics-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"scope-analytics-mcp"
]
}
}
} assistant mcp add wally827-scope-analytics-mcp -t stdio -c uvx -a scope-analytics-mcp
{
"mcpServers": {
"wally827-scope-analytics-mcp": {
"command": "uvx",
"args": [
"scope-analytics-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +3
- Stability: unverified → 0.23 ▲ functional
- Package version: 0.1.3 → 0.1.4 functional
- 13 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 12 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 9 Sept 26 +28
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- Package version: 0.1.2 → 0.1.3 functional
- 7 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 3 Sept 26 +15
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/scope-analytics-mcp@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 29 packages
| Packages resolved | 29 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
scope_ask ~220
Ask the Scope analyst a natural-language question about this project's analytics. This is the headline tool: it runs Scope's full AI analyst over the project's data — events, LLM inputs/outputs (matched by meaning, not keywords), metrics, and prior investigations — and returns the analyst's reasoned answer, plus the written report when the question calls for one (a recap or digest of a period). Use it for open-ended "why / what / how" questions, e.g. "why did signups drop this week?", "what are users frustrated about?", "how is conversion trending?". (For raw event inspection use scope_query_events; for install coverage use scope_coverage_report.) This runs a real analysis server-side and can take up to a minute or two. It is READ-ONLY — it never changes the project's monitoring config or memory. Relay the answer to the user in your own words. Args: question: The natural-language analytics question to ask the analyst.
| Name | Type | Req | Description |
|---|---|---|---|
| question | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_check_integration ~345
Check specific LLM SDK identifiers against Scope's auto-capture support — the deterministic per-item checker (read-only, LOCAL, no AI, no network). Enumerate the LLM SDK package names you see in the user's code — the exact dependency strings, e.g. openai, @anthropic-ai/sdk, cohere-ai, ai, google-genai — and pass them here. You get one verdict per identifier: auto-captured (zero-code) / not-auto-captured (with the manual path) / unrecognized. Matching is EXACT (no fuzzy or keyword matching), so pass the canonical package names as written in package.json / requirements; you, the agent, do the code→identifier reading, and this tool gives the authoritative verdict. Pass language ("python" or "node") whenever you know the project's runtime — omitting it returns verdicts for BOTH runtimes (e.g. bare "openai" reports Python and Node), which is noisier than needed for a single-language app. Companion to scope_supported_integrations (the full matrix): use the matrix to see everything; use this to check the specific packages you found. For a custom wrapper or dynamic provider selection a static check can't be sure about, install and then call scope_coverage_report (the live-data ground truth). Args: identifiers: Canonical LLM SDK package names found in the code, e.g. ["openai", "cohere-ai"]. language: Optional "python" or "node" to check only that runtime; omit to check both.
| Name | Type | Req | Description |
|---|---|---|---|
| identifiers | array | yes | – |
| language | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_coverage_report ~256
Report what Scope analytics is actually capturing for this project, and what's missing. Use this to answer "what does Scope cover for my app?" or after installing Scope to confirm the right layers are flowing. Returns an honest, tenant-scoped data-flow census: which event types and sources are arriving, whether events are quarantined (domain not allow-listed), identity stitching, deploy metadata, and plain-language notes on gaps. Then explain it to the user in your own words. It also lists any DOMAINS AWAITING APPROVAL — events from an unapproved domain are stored but not counted until the user approves it, a common reason a fresh install "looks broken." When that list is non-empty, help the user decide which domains are genuinely theirs and guide them to approve those in Scope. This tool only READS — approving a domain is a click the user makes in Scope's own UI; the MCP never changes settings itself (PRODUCT.md §16). Args: window_hours: Optional look-back window in hours (1–8760). If omitted, the backend uses its configured default window (currently ≈7 days).
| Name | Type | Req | Description |
|---|---|---|---|
| window_hours | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_detect_stack ~172
Scan this codebase and report what Scope analytics would capture automatically — and what needs a manual step. Read-only and LOCAL (no network): reads dependency manifests (requirements.txt, pyproject.toml, package.json) and config files in the project root and its immediate subdirectories to detect the backend web framework, LLM SDKs, frontend framework, and deploy platform. Use this at install time to answer "what will Scope cover for my app?" from the CODEBASE (before events flow); pair it with scope_coverage_report, which answers the same from the live DATA once events arrive. Then tell the user, in your own words, what's covered and what isn't. Args: path: Project root to scan (defaults to the current directory).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_get_metric ~131
Get one metric's full recipe — how the Scope analyst computed it last time (the events it selected, joins, window, attribution) plus its provenance and edit history. Read-only and deterministic (the exact recorded recipe, not a paraphrase). Use after scope_list_metrics to inspect exactly how a metric is defined — e.g. to reproduce it in your own code, or to check the analyst's methodology. Pass the exact metric name from scope_list_metrics. Args: name: The exact metric name (as shown by scope_list_metrics).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_get_session ~214
Reconstruct one session (or one user's activity) across the frontend, backend, and LLM layers, in time order. Read-only. Scope stitches events from all three layers by session, so this returns a single chronological timeline — page views, clicks, backend calls, and LLM calls interleaved — plus a small census (counts by type/source, time span). Use it to see exactly what a user did in a session, or to correlate a session with the code you're looking at. Provide session_id and/or user_id (a user_id also picks up events linked later by identity stitching). Args: session_id: The session to reconstruct (e.g. from scope_query_events output). user_id: A user whose events to gather (matches identity-stitched events too). limit: Max events to return, time-ascending (1–1000; default 200).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | – | – | – |
| session_id | – | – | – |
| user_id | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_get_stats ~243
Get this project's headline analytics — total events, unique users, the per-type breakdown, and a day-by-day trend. Read-only, deterministic, and instant (no analysis run). This is the quick "what are the numbers?" tool: use it to size activity or eyeball a trend (growth, a drop-off, a spike) before deciding whether to dig in. Narrow it with a date range and/or a single event type. For the day-by-day counts of one metric over a window this is ideal; for raw rows use scope_query_events, for install/data-flow health use scope_coverage_report, and for an open-ended "why did it change?" hand off to scope_ask. Args: start_date: Optional inclusive start, ISO ("2026-05-01" or a full timestamp). Omit for all time. end_date: Optional inclusive end, ISO. Omit for "up to now". event_type: Optional filter to a single event type (e.g. page_view). Omit for all types.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| event_type | – | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_install_backend ~182
Give the exact steps to install Scope's BACKEND SDK for this project's stack. Read-only and LOCAL (no network). Scans the codebase and returns the canonical backend install — for Python, the zero-code `scope-run` path plus the code-based middleware for the detected framework (FastAPI/Flask/Django); for Node, the zero-code `@scope-analytics/node` `--import` bootstrap. Honest about gaps: edge runtimes need the manual wrapper and background workers need scope-run too — it says so rather than emit a command that won't work. The secret key is always a placeholder (never echoed). Apply the steps with the user's confirmation (detect-and-confirm), then run scope_verify_installation. Args: path: Project root to scan (defaults to the current directory).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_install_frontend ~152
Give the exact steps to install Scope's FRONTEND SDK for this project's stack. Read-only and LOCAL except for one lookup (it fetches this project's public key to embed in the snippet). Scans the codebase to tailor the recommendation (build-time injection for apps with a build step; the one-line script tag for any HTML), and embeds the project's public key (pk_…, safe for client HTML) when available. Use at install time, then APPLY the steps for the user with their confirmation (detect-and-confirm), and run scope_verify_installation to confirm events flow. Args: path: Project root to scan (defaults to the current directory).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_list_metrics ~108
List this project's metric definitions — the analyst's recorded recipes for how it computed each metric before (names + one-line definitions). Read-only and instant (no analysis run). Scope's analyst keeps a registry of "how we computed this metric last time" so results stay consistent across questions. Use this to see which metrics exist before asking about them; call scope_get_metric for a metric's full recipe. (These are memory, not rules — the analyst can refine them.)
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_query_events ~168
Query this project's raw analytics events (most recent first). Read-only. Use to inspect what's actually being captured — e.g. the last few LLM calls or page views. For open-ended "why/what" analysis, the Scope analyst (scope_ask) is better; this is the raw feed. Args: event_type: Optional filter by event type. Event-type names are app-specific — call scope_coverage_report first to see which ones this project actually has (e.g. page_view, api_call, llm_call). limit: Max events to return (1–1000; default 20). user_id: Optional filter to a single user's events.
| Name | Type | Req | Description |
|---|---|---|---|
| event_type | – | – | – |
| limit | – | – | – |
| user_id | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_supported_integrations ~229
List exactly which LLM SDKs/providers Scope auto-captures (zero-code), by language and canonical package name — the authoritative coverage matrix. Read-only, LOCAL, deterministic (no network, no AI). Use this to answer "does Scope automatically capture my LLM calls?" Enumerate the LLM SDK packages and method calls you see in the user's code, then match them against this list by EXACT package/ method name. Anything NOT listed as auto-captured is NOT auto-captured — Scope still captures everything else (frontend events, backend requests/errors), and an unlisted provider can be captured with a manual scope.track_event(...) call. This is the static source of truth; for a custom wrapper or dynamic provider selection a static check can't be sure about, install and then call scope_coverage_report, which reports from LIVE data which providers are actually arriving. Pair this with scope_detect_stack (which scans the codebase and tells you what was found); this tool tells you, authoritatively, what each of those findings means for coverage.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
scope_verify_installation ~97
Quick check that Scope is receiving events from this project right now. Use right after installing Scope to confirm the pipe is live. Returns whether any events arrived in the recent window and how long ago the most recent event was. Args: window_minutes: Optional recent window in minutes (1–1440). If omitted, the backend uses its configured default window (currently ≈60 min).
| Name | Type | Req | Description |
|---|---|---|---|
| window_minutes | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the Scope Analytics MCP server?
Scope Analytics is an MCP server listed in the public MCP registry as io.github.wally827/scope-analytics-mcp. Install + query Scope analytics from an AI coding agent (Claude Code, Cursor, etc.). This page covers its PyPI package (scope-analytics-mcp).
Is the Scope Analytics MCP server safe to use?
Scope Analytics scores 49 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Scope Analytics MCP server expose?
Scope Analytics exposes 13 tools: scope_ask, scope_coverage_report, scope_verify_installation, scope_detect_stack, scope_supported_integrations, and 8 more. Their descriptions and schemas cost roughly 2,517 tokens of context every time the server is loaded.
Is the Scope Analytics MCP server still maintained?
Scope Analytics is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.