Connect an MCP client

Paid plans: use permission-scoped tools or an owner-configured OAuth connection.

Connect a scoped client

Use a permission-scoped token with the versioned HTTP endpoint. Every tool checks website access and the relevant read or write permission. Destructive tools describe their effects; your client controls tool approval.

https://zijra.com/api/mcp/v2/YOUR_WEBSITE_ID

Tools follow your permissions

Analytics, breakdowns, visitors, identities, server goals, payments, websites, goals, provider goals, measured goal and funnel reports, funnels, notes, alerts, team and tokens share the v2 reporting and authorization service.

MCP requires Founder or another active paid plan. Tool permissions do not bypass plan, website or private-data permissions. Free keeps aggregate and Stripe revenue reports in the dashboard, with 3 goals and 1 funnel, but cannot create or use MCP grants. Existing grants lose access when current plan access ends; credential revocation remains available.

Pass a report selection

Read tools accept API query parameters as strings. For analytics, breakdowns, goal-report and funnel-report, provide both dates when specifying a range and serialize filters or visitCount as JSON strings. Leaving both dates out uses the website’s local default range of the last 30 days. Operators, limits, attribution and currency rules are shared with the API.

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "zijra_read_analytics",
    "arguments": {
      "query": {
        "start": "2026-09-01",
        "end": "2026-09-30",
        "filters": "[{\"dimension\":\"Page\",\"operator\":\"contains\",\"value\":\"/pricing\"},{\"dimension\":\"Page\",\"operator\":\"not_contains\",\"value\":\"/private\"}]"
      }
    }
  }
}

Measured report tools

zijra_read_goal-report and zijra_read_funnel-report expose measured results with reports:read. Pass id for a saved definition and the same query object as analytics. The report list defaults to 10, caps at 20 and does not accept a cursor. Definition tools zijra_read_goals and zijra_read_funnels retain their configuration behavior.

OAuth authorization

The owner must enable Supabase OAuth 2.1, register a client and configure Zijra’s resource-audience access-token hook. The consent screen uses the authorization server’s registered redirect, shows the client and selected website, and records the approved grant. Generic authenticated tokens cannot access this resource.

Review and revoke connected applications in Developer settings. Revocation stops OAuth requests and descendant API tokens. If OAuth is not configured, the product shows that prerequisite rather than a simulated authorization.

Compatible transport

Send JSON-RPC 2.0 over POST with JSON content type and Accept: application/json, text/event-stream. Initialize, then list tools. Existing v1 read-only MCP clients remain supported.