Agent-first analytics: what it is, and what to ask of any tool
Agent-first analytics is web analytics built so an AI agent can do the whole job on its own: create the account with one request, install the tracking code, confirm that events arrive, and answer questions, all through a documented API and an MCP server. A person comes in at the end to see the numbers and own the account, not to sign up, verify an email or click through setup screens.
The definition
Most analytics tools were designed for a person in a browser. The account needs an email to verify, the property needs a form, the tracking code is copied from a settings page, and "is it working?" is answered by watching a realtime report. An agent can help with parts of that, but a person has to do the steps in between.
An agent-first tool turns each of those steps into a call the agent can make and a result it can check. We use seven properties to decide whether a tool qualifies. They're the rules every AgentFirstStack service is built to, and they apply to any tool you're evaluating.
The seven properties
- One request to an account. The agent gets a working API key from a single call. No email to verify, no captcha, no form. If a person has to sign up first, the agent can't start a project on its own.
- Everything over REST and MCP. Every feature, including the ones that change things (create a site, add a goal, connect payments), exists as an API route and as an MCP tool. A read-only MCP server added to a tool built for people doesn't count.
- A manual the agent reads in one fetch. One plain-text file, conventionally at
/llms.txt, with a quickstart, every endpoint, every tool and every config field. The agent shouldn't have to crawl a docs site or guess. - Answers say what to do next. Creating a site returns the snippet, the install code for the framework and the next call to make. The agent doesn't have to know the order in advance.
- Errors carry hints. A failed call says what went wrong and how to recover, in words the agent can act on.
- Setup the agent can verify itself. Every setup step has a check the agent runs: verify the install, see its own test event, run a setup check that says ready or lists what's missing. Without this, the agent reports success it hasn't confirmed.
- Retries are safe. Creating something that already exists returns the existing one instead of an error or a duplicate. Agents retry, restart and run twice; the tool has to tolerate it.
Two more things keep this safe once an agent operates the tool. Content that comes from outside (what visitors typed, pages the tool fetched, email bodies) is marked as untrusted, so an agent doesn't follow instructions hidden in it. And keys have scopes, so a read-only key can answer questions without being able to change anything.
Agent-first is more than an MCP server
An MCP server is how an agent calls a tool. It says nothing about what the agent can do with it. If a person still has to create the account, accept terms, create the property and paste a key into the agent's config, the agent only starts after setup is done, which is the part it could have done for you.
So the useful question isn't "does it have an MCP server?" but "can an agent start from nothing, get to working tracking and prove it?" Our comparisons of the Google Analytics, PostHog and Mixpanel MCP servers go through what each can and can't do, and the benchmark counts the steps for GA4, PostHog and Plausible from their own docs.
What it changes for teams
- Analytics ships with the code. The agent that builds the sign-up form adds the goal and the server event in the same change. What it set up is written down in the repo (in AgentFirstStack,
AGENTFIRSTSTACK.md: ids and the names of the env vars that hold keys, never the keys). - No shared logins. The key lives in
.envand the production secrets. People get access through a claim link and their own Google sign-in, not by passing a password around. - Questions get answered where the work happens. "Which sources bring sign-ups?" is a question to the agent in the terminal or a chat app, answered from the API.
- Checks replace "looks right to me". A setup check returns
"ready": trueor a list of fixes. Any key can run it, read-only ones too, so a later session or a CI job can confirm nothing broke. - Later sessions keep it current. When the platform adds a setup item, answers to the project's key carry a notice (at most once a day), and the next agent session runs the setup check and applies it.
What to ask of any analytics tool
Ten questions, in the order an agent would hit them. Ask them of any tool, including this one.
| Ask | A good answer |
|---|---|
| Can an agent create the account without a person? | One unauthenticated request returns a key. No email, captcha or phone. |
| Can it create the property and get the tracking code by API? | One call with the domain returns the snippet, ideally per framework. |
| Is every feature available to the agent, writes included? | Every capability is a REST route and an MCP tool, not only reports. |
| Where is the manual? | One plain-text file the agent can fetch and read in full. |
| Does each answer say what to do next? | Create calls return what the agent needs next and a next_steps list. |
| What does an error look like? | A code, a message and a hint that says how to recover. |
| How does the agent know tracking works? | It can send a test event, see it within seconds and run a check that says ready, without a person watching a report. |
| What happens if the agent runs setup twice? | The same site comes back ("existing": true), not a duplicate or an error. |
| Can I give an agent read-only access? | Read keys, with write tools hidden from them over MCP. |
| How does a person get in afterwards? | A handover link to a dashboard, with their own sign-in, that doesn't stop the agent's key. |
How AgentFirstStack does each
| Property | What AgentFirstStack does |
|---|---|
| One request | POST https://agentfirststack.com/v1/signup returns api_key, account_id, the MCP config and next_steps. No body is needed. The same key works on analytics, tags, mail and replay. |
| REST and MCP | Each REST route and its MCP tool call the same service function. One MCP server at https://agentfirststack.com/mcp carries 250 tools; chat apps such as claude.ai connect over OAuth 2.1. |
| Manual | /llms.txt is the overview and the full setup procedure; each service has its own complete manual, such as analytics.agentfirststack.com/llms.txt. |
| Next steps | POST /v1/sites returns the site, its snippet, install code for html, nextjs, astro, react, wordpress, gtm and tags, and next_steps such as "Open the site in a browser, then confirm: POST /v1/sites/:id/verify". |
| Errors with hints | Every error is {"error":{"code","message","hint"}}. Without a key: "hint": "Send `Authorization: Bearer <api_key>`. No key yet? POST /v1/signup returns one instantly." |
| Verifiable | verify fetches the live page and checks the snippet, the script, the Content-Security-Policy and whether events arrived. ?afsa_debug=1 marks a visit as test traffic, visible in realtime?debug=only and kept out of reports. GET /v1/setup is the setup check; POST /v1/setup/test sends test traffic through everything. |
| Safe retries | A second POST /v1/sites with the same domain returns the same site with "existing": true. The same holds for containers, inbox addresses and destinations. |
| Untrusted content | Tools that return visitor-sent values (breakdowns, sessions, SQL rows) say so, and verify returns anything copied from the fetched page only under untrusted, with a notice. |
| Scopes | Keys are full (*) or read. Read keys can't make changes over REST, and MCP doesn't list write tools to them. |
| Handover | POST /v1/claim-link returns a single-use link, valid for 7 days. The person signs in with Google and sees the project in the dashboard. |
Measured from a clean shell against production, an agent goes from no account to a site whose test pageview shows in realtime, confirmed by the setup check, in 6 HTTP requests. Two runs took 5.9 and 7.3 seconds. The benchmark page has the method and the script, so you can repeat it.
Try it
Paste the setup prompt from the home page into Claude Code, Cursor, Codex or any agent that can make HTTP requests, or read the easiest way to add analytics with an AI agent for what the agent does at each step and what's left for you.
FAQ
What is agent-first analytics?
Web analytics built so an AI agent can do the whole job on its own: create the account with one request, install the tracking code, confirm events arrive and answer questions, through a documented REST API and an MCP server. A person comes in afterwards to see the numbers and own the account.
Is agent-first analytics the same as AI analytics?
No. AI analytics usually means a tool that writes summaries or insights for a person. Agent-first is about who operates the tool: an agent can set it up, check it and query it without a person doing the signup or the setup screens. A tool can be one without the other.
Does an MCP server make an analytics tool agent-first?
Not on its own. If a person still has to create the account, accept terms, create the property and paste a key into the agent, the agent only takes over after setup. Agent-first means the agent can also create and configure everything, and check that it works.
Do people still get a dashboard?
Yes. In AgentFirstStack the agent finishes by creating a claim link. The person opens it, signs in with Google and sees everything the agent set up in a dashboard, where they can also manage keys, invite teammates and connect chat apps. The agent's key keeps working.
Is it safe to let an agent create the account?
The account holds no payment details, and the key only reaches this project. Keys can be read-only, MCP hides write tools from read keys, tools that return visitor-sent or fetched content mark it as untrusted, and once a person claims a project only its owner can delete it.
Related
- All servicesThe easiest platform for AI agentsRequests and seconds from nothing to tracking, measured.
- AnalyticsAdd analytics with an AI agentOne prompt, every step, and what's left for you.
- AnalyticsGoogle Analytics MCP comparedRead GA4, or let the agent create the analytics.
- AnalyticsPostHog MCP comparedA product platform, or web analytics an agent sets up alone.
- AnalyticsUmami alternativeTwo open-source analytics tools, compared.
- All servicesOne MCP server for every serviceAnalytics, tags, mail and replay tools on one key.