# Agents

An AI agent can be connected to the account to consult its configuration, event types, fields, rules, metrics, monitors and lists, and metric values over time. The connection uses the MCP protocol (Model Context Protocol), supported by the most common code and chat assistants.

The feature is in **beta**. Available functionality and usage limits may change at any time, without prior notice.

## What the agent can see

Access is granted on your behalf and operates with **your** permissions: the agent never reaches anything your [access profile](/en/admin/users/#access-profiles) does not reach. Two checks are applied to every call, and both must pass: the permission of the user who authorized it and the permission consented to the agent at connection time.

| Permission | What it authorizes |
| :--------- | :----------------- |
| Read the configuration | consult event types, fields, rules, analyses, metrics, monitors and lists |
| Read the account's data | consult received events, a metric's measured values and the values already received by a field |
| Write the configuration | change a field's name and description |

Reading the account's data reaches personal data present in events, such as emails, IP addresses, card BINs and device identifiers. That is why it is consented to separately from reading the configuration: a connection can read the account's configuration without reaching any event data.

The agent operates on one account at a time, shown on the connection screen. To consult another account, connect the agent again from it.

## How to connect

In **Agents > Connect agent**:

1. Select the agent by its logo. The screen then shows the instructions specific to it.
2. Configure the agent with the **MCP server URL** and the **client_id** shown on the screen. Wherever the agent asks for a client secret (`client secret`), leave it blank: the connection uses no secret.
3. Authorize access to the account in your browser, when the agent requests it.

Command-line agents present, instead of the steps above, a ready command to run in the terminal, followed by the same browser authorization.

**Claude Code**, **Claude Desktop**, **Cursor**, **VS Code** and **Gemini CLI** are covered today. An agent not yet registered must be enabled by us before it can connect: contact support if yours is not listed.

## Connected agents

**Agents** lists the existing connections on the account in the authenticated user's name, with the client, the authorization date and the last activity recorded, updated in fifteen minute intervals. A connection that was never used is identified as such.

**Disconnect** ends that agent's access immediately, without affecting the other connections or those of other users. A disconnected agent operates again only after a new authorization.

## What the agent can do

The agent has listing and detail operations over each kind of configuration, plus the lookup of values already observed in a field:

| Operation | Content |
| :-------- | :------ |
| Account | general data of the connected account, with the consents granted to the connection |
| Event types | list of types and the detail of each one, with its fields |
| Fields | values already observed in a field, including the values received by a list field with no registered items |
| Events | count of a period's events in time blocks, optionally split by a field, and the event rows themselves |
| Rules | list of rules and the detail of a version, with its conditions and actions |
| Analyses | list of analyses and the detail of one, with the effect of each cell and the rules that run and record it |
| Metrics | list of metrics, the detail of one, with dimensions, aggregations and filters, and the values measured per period, with the expected band and the alerts of the interval |
| Monitors | list of monitors and the detail of one, with its criteria |
| Lists | list of the configured lists and the detail of one |
| Field editing | change of a field's name and description |

The event lookup takes the same filters as [Explore](/en/admin/explore/), including the reference to a list and the [comparison between fields](/en/admin/explore/#comparison-between-fields). It answers over a recent window, not over the account's whole history.

In clients compatible with MCP interfaces, the lookup of a metric's values is presented as a chart in the conversation itself.

The typical questions are ones of orientation and review: which rule decides a given event type, which metrics exist over a field, what a rule version does before publishing it, how many events of a type arrived per status in the period.

Each response also carries the address of the corresponding article in this documentation, so the agent consults the reference rather than deducing the platform's behavior.

## Consents

The operations the agent reaches depend on the consents granted at connection time. An operation that was not consented to does not appear to the agent, which makes it indistinguishable from one that does not exist.

That is why the account lookup reports which consents the connection received and which operations were withheld, with the consent missing from each one. An agent that answers that something is not possible can, with that, check whether the operation exists and merely was not consented to.

Releasing it requires reconnecting the agent granting the missing consent, as described in [How to connect](#how-to-connect). An existing connection does not start reaching anything more without that new authorization.

The operations the user's [access profile](/en/admin/users/#access-profiles) does not reach are not listed as withheld: no reauthorization would grant them, because the check that blocks them is the user's, not the agent's.

### Change to the read consent

The lookup of a metric's values and the listing of a field's values came to require **reading the account's data**, previously reached by reading the configuration. A connection authorized only to read the configuration stops reaching both, and reaches them again after being reconnected with the new consent.

## Usage limits

Calls are limited per user and per account within a time window, with a limit of its own for each operation, sized according to its cost and expected frequency. An agent that exceeds the limit is refused and resumes in the following window.