Let an assistant read your numbers.

What it is

A stateless, read-only Model Context Protocol server at POST /api/mcp on the API host. An assistant connected to it reads the same defined reports the panel shows, from the same functions, so the answer it gives you about last week is the number the screen would draw.

Read-only is structural, not a promise: the MCP surface exposes report tools and nothing that writes. Which site, and which time zone its days cut on, come from the key.

Connect a client

Create a key with the read scope on the panel's API keys screen, then open Settings, Assistants: it prints the endpoint and the exact configuration for each client with your site already in it. Every client stores this differently, and the differences are exactly where an afternoon goes.

Claude Code

One command:

claude mcp add --transport http kehai https://app.kehai.io/api/mcp \
  --header "Authorization: Bearer $KEHAI_READ_KEY"

An entry written by hand into .mcp.json needs "type": "http" as well, or it is read as a local server and skipped.

Claude

Not a file: Customize, then Connectors, then add the URL and put the key in Request headers. Claude connects from Anthropic's cloud rather than from your machine, so the endpoint is reached over the public internet, which is where it lives.

Cursor, VS Code, and most other clients

{
  "mcpServers": {
    "kehai": {
      "type": "http",
      "url": "https://app.kehai.io/api/mcp",
      "headers": { "Authorization": "Bearer $KEHAI_READ_KEY" }
    }
  }
}

Cursor reads it as .cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project. VS Code reads .vscode/mcp.json, where the key is declared as an input rather than written as a literal, so it is never committed. The Assistants screen prints that shape too.

Use a read key even though full would work: an assistant that can only read is an assistant whose worst day is a wrong question.

Check the connection

Configured and working are different states, and the Assistants screen has a box for the difference. Paste a key under Check the connection and Kehai makes the call an assistant makes when it connects. "It answers" comes with how many tools that key's site offers, which is what any client using it will see. A refused key is one that was revoked or belongs to another site, and an endpoint that cannot be reached says so. The key is used for the check and nothing keeps it, including the screen.

What an assistant can do with it

• Answer questions from any report in the registry: traffic, pages, channels, campaigns, geography, technology, vitals, goals, revenue.
• Compare ranges and read the same filters the panel offers.
• Nothing else. It cannot change settings, send events, or see other sites.

A report belonging to a module you switched off is absent from the tool list, the same way it is absent from the panel. The Assistants screen lists every tool, with the ones behind a module that is off grayed and the module named, so a capability you remember is findable with its reason. The full tool list with parameters is in the OpenAPI schema, which is generated from the same registry.