B

PostHog MCP Server

Official PostHog MCP server providing analytics, feature flags, experiments, dashboards, surveys, and error tracking via Cloudflare Workers

Overall Score77/100

Score Breakdown

Server Info

Package
posthog-mcp-monorepo
Registry
npm
Repository
posthog/mcp
Maintainer
PostHogVendor
Category
Analytics & Data
Tags
product-analyticsfeature-flagsexperiments
Last Scanned
7 Apr 2026

Findings

6 issues

Authentication & Identity

MEDIUMHTTP/SSE transport supports per-request credentials

Runs as a Cloudflare Worker with HTTP/SSE transport (not stdio). Authenticates users via Bearer token in the Authorization header, which is a PostHog personal API key. The token is used directly to call the PostHog API. User state (active project/org) is cached in Cloudflare Durable Objects per user hash. INKEEP_API_KEY is a server-side env var for docs search, not a user credential. No MCP OAuth implementation.

Remediation

Implement the MCP OAuth spec so users authenticate directly without platform mediation.

Tool Schema Quality

MEDIUMOnly 7 of 44 schemas have parameter constraints

Most schemas lack maxLength, enum, or pattern constraints on string parameters.

Remediation

Add constraints to string parameters, especially on write operations.

LLM Safety

MEDIUM2 tool descriptions are too vague

Short or generic descriptions make tool selection unreliable.

Remediation

Expand descriptions with specific actions, data types, and side effects.

HIGHTool descriptions contain instructional language

Descriptions include directives that could influence LLM behavior beyond tool selection.

Remediation

Remove instructional language. Descriptions should be purely factual.

Data Exposure

MEDIUM5 list operations lack pagination

dashboards-get-all, insights-get-all, feature-flag-get-all, and list tools support pagination via limit/offset parameters. Several list tools (experiment-get-all, organizations-get, projects-get, surveys-get-all, event-definitions-list) return full result sets. No explicit field selection; full records are returned. The API client handles response formatting.

Remediation

Add limit/offset or cursor-based pagination.

LOWNo field selection on responses

Responses return full records rather than projected fields.

Remediation

Implement field selection to return only relevant fields.

Tools

44 total
NameDescriptionRisk
add-insight-to-dashboardAdd an existing insight to a dashboard. Requires insight ID and dashboard ID. Optionally supports layout and color customization.write
dashboard-createCreate a new dashboard in the project. Requires name and optional description, tags, and other properties.write
dashboard-deleteDelete a dashboard by ID (soft delete - marks as deleted).write
dashboard-getGet a specific dashboard by ID. The response will include insights / tiles that are on the dashboard.read
dashboards-get-allGet all dashboards in the project with optional filtering. Can filter by pinned status, search term, or pagination.read
dashboard-updateUpdate an existing dashboard by ID. Can update name, description, pinned status or tags.write
docs-searchUse this tool to search the PostHog documentation for information that can help the user with their request. Use it as a fallback when you cannot answer the user's request using other tools in this MCP. Only use this tool for PostHog related questions.read
error-detailsUse this tool to get the details of an error in the project.read
list-errorsUse this tool to list errors in the project.read
create-feature-flagCreates a new feature flag in the project. Once you have created a feature flag, you should: Ask the user if they want to add it to their codebase, Use the "search-docs" tool to find documentation on how to add feature flags to the codebase (search for the right language / framework), Clarify where it should be added and then add it.write
delete-feature-flagDelete a feature flag in the project.admin
feature-flag-get-allGet all feature flags in the project with optional filtering.read
feature-flag-get-definitionGet the definition of a specific feature flag.read
update-feature-flagUpdate an existing feature flag in the project.write
experiment-get-allGet all experiments in the project.read
experiment-createCreate a new experiment in the project.write
experiment-deleteDelete an experiment in the project.admin
experiment-updateUpdate an existing experiment in the project.write
experiment-getGet details of a specific experiment.read
experiment-results-getGet comprehensive results for a specific experiment.read
insight-create-from-queryCreate a new insight from a query.write
insight-deleteDelete an insight by ID.admin
insight-getGet a specific insight by ID.read
insight-queryRun an insight query.read
insights-get-allGet all insights in the project.read
insight-updateUpdate an existing insight.write
query-runRun a query against PostHog data.read
query-generate-hogql-from-questionGenerate HogQL from a natural language question.read
get-llm-total-costs-for-projectGet total LLM costs for the project.read
organization-details-getGet details about the active organization.read
organizations-getGet all organizations the user belongs to.read
switch-organizationSwitch the active organization.write
projects-getGet all projects in the active organization.read
event-definitions-listList event definitions in the project.read
properties-listList properties in the project.read
property-definitionsGet property definitions for the project.read
switch-projectSwitch the active project.write
survey-createCreate a new survey in the project.write
survey-getGet a specific survey by ID.read
surveys-get-allGet all surveys in the project.read
survey-updateUpdate an existing survey.write
survey-deleteDelete a survey by ID.admin
surveys-global-statsGet global survey statistics.read
survey-statsGet statistics for a specific survey.read

Deploy PostHog MCP Server securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow