https://mcp.qonversion.io/mcp and uses OAuth 2.1 for authentication.
The server follows the MCP Streamable HTTP spec, supports protocol revisions up to 2025-11-25, and supports clients that connect natively over HTTP, as well as clients that use mcp-remote for compatibility.
The MCP server mirrors the Qonversion REST API v4 resource surface — most MCP tools wrap a single v4 operation. Authentication is different, though: HTTP clients authenticate with the project Secret Key, while MCP clients use OAuth 2.1 against your Qonversion account with per-tool scopes. See the full v4 guide for resource-by-resource context and the underlying HTTP operations.
Capabilities
The Qonversion MCP server exposes most of the v4 REST API as MCP tools, grouped by resource:- Customers — list, read, delete (GDPR), set properties, list and mutate permissions, and read aggregated metrics.
- Users, identities, purchases, properties — look up users, attach external identities, inspect purchase history, set and query user properties.
- Entitlements — manage entitlement definitions and grant or revoke them per user.
- Products — CRUD products consumed by the SDK.
- Legacy product bundles —
list_offerings,get_offering,update_offering,set_main_offeringanddelete_offering. Use Remote Configurations for new work. - Remote Configurations — list, create, replace, delete, change status, manage payload mappings, and attach or detach users.
- Paywalls (Screens) — list, create, update, publish, duplicate, and pull per-screen and overview analytics.
- Experiments — CRUD experiments and groups, change status, attach and detach users, read summary analytics.
- Segments — CRUD user segments and list system segments.
- Analytics — charts, KPI cards, cohorts, LTV, trial conversion, currencies, and narrative insights.
- Apple Ads — cohort performance joined with Apple Ads spend, the daily series behind it, and connection status (scope
analytics:read), plus campaign changes: pause or enable campaigns, ad groups and keywords, change keyword bids and change campaign daily budgets (scopeapple_ads:write). The Apple Ads report is available on all accounts; campaign changes need campaign management to be enabled for the account — contact support. See Apple Ads via MCP. - Exports — start asynchronous data exports and poll their history and status.
- Events — list the events Qonversion has recorded for the project (
list_events). - Scheduled Reports — CRUD recurring reports, list destinations, send a test delivery.
- Integrations — discover the catalog, create, toggle status, and delete integrations.
- Automations — CRUD event-driven automations and change their status.
- Project settings — read and update project configuration, manage store credentials. The
regenerate_project_secrettool is deprecated: it deletes the project’s oldest Secret Key immediately, without an overlap. Rotate Secret Keys in the dashboard instead — see How to manage and rotate project keys.
customers:read, screens:read, experiments:write). Your effective permissions mirror your role in the Qonversion dashboard.
Destructive actions
Destructive tools (delete_*, revoke_*, detach_*, discard_*, regenerate_project_secret) use a two-step confirmation flow designed around human-in-the-loop intent. The confirmation token is addressed to the operator, not to the agent — the agent is expected to surface the pending action and wait for explicit approval before executing.
The flow
- The agent calls the destructive tool (e.g.,
delete_product(product_id: "prem_monthly")). - The server does not perform the action. It returns a message listing the pending action, the target Resource id, and a short-lived token (5-minute TTL). The message is explicitly addressed to the human operator.
- The agent must surface the pending action to the human and wait for explicit approval.
- Once approved, the agent calls
confirm_destructive_actionwith three required arguments:
Why the echo + reason
These two fields turn a single-turndelete → confirm chain into an act of deliberate re-statement. The agent can’t forward the token blindly — it has to restate the target (which surfaces the action to the human) and commit a reason (which is easy to spot in review if fabricated). Silent auto-confirmation stops being possible without the model making a distinct act that’s visible in the transcript.
Tokens
- Tokens are bound to the MCP session that requested them — another session can’t consume them.
- Tokens expire after 5 minutes. Expired tokens must be re-requested from the original tool.
- A token can be used at most once. A mismatched
resource_id_echoconsumes the token and cancels the pending action.
Destructive tools affected
delete_automation, delete_customer, delete_entitlement, delete_experiment, delete_experiment_group, delete_integration, delete_offering, delete_product, delete_remote_configuration, delete_scheduled_report, delete_screen, delete_segment, detach_experiment_user, detach_user_from_remote_configuration, discard_audience_draft, discard_remote_configuration_draft, revoke_customer_permission, revoke_user_entitlement, regenerate_project_secret.
The Apple Ads campaign-change tools use the same flow for some calls: set_apple_ads_status when enabling, and every live set_apple_ads_bid or set_apple_ads_daily_budget call (increase or decrease). Pausing runs immediately, and a bid or daily-budget dry run (dry_run: true) runs without confirmation. The Apple Ads resource id is <level>:<campaign_id>, plus :<ad_group_id> for ad groups and keywords, plus :<keyword_id> for keywords — for example keyword:123:456:789. See Apple Ads via MCP.
Setup
Claude Desktop
Add the following to yourclaude_desktop_config.json:
Claude Code
/mcp in a Claude Code session to go through the authentication flow.
Cursor
Add the following to your.cursor/mcp.json:
Visual Studio Code
- Press
CTRL/CMD + Pand search for MCP: Add Server. - Select Command (stdio).
- Enter the following and press enter:
- Enter the name Qonversion and press enter.
- Open MCP: List Servers, select Qonversion, and click Start Server.
Windsurf
- Press
CTRL/CMD + ,to open settings. - Go to Cascade → MCP servers.
- Select Add Server → Add custom server and add the following:
Zed
- Press
CMD + ,to open settings. - Add the following:
Codex
Add the following to your~/.codex/config.toml:
codex mcp login Qonversion to authenticate.
Other clients
For clients that support MCP via stdio, use the following configuration:- Command:
npx - Arguments:
-y mcp-remote https://mcp.qonversion.io/mcp - Environment: None