Provider REST API
AnalyticsConnect Claude to PostHog
Run HogQL queries and read insights, events, flags, cohorts and recordings. Toolspoke puts 12 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.
- Connection
- Provider REST API
- Authentication
- Personal API key
- Actions exposed
- 12
- Cost per call (typical)
- 1 credit
- Adapter
- Maintained by Toolspoke
Connected in three steps
- 1
Install PostHog
Open the marketplace in your workspace, add PostHog to the project your agents work in, and it appears on the gateway immediately.
- 2
Connect the credential
Authenticate with personal api key. Where to get one, and what it has to be able to reach, is the next section.
- 3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.
.mcp.json{
"mcpServers": {
"toolspoke": {
"type": "http",
"url": "https://toolspoke.com/mcp"
}
}
}One block covers every tool you have installed. PostHog shows up in the client as soon as your policy allows it, and so does everything else you install later.
Where the address goes, per client
- Claude Code
Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp- Claude and Claude Desktop
Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp- Cursor
~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }- Codex
~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"- VS Code
.vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }
What PostHog asks for
Personal API key. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.
- Personal API keyRequired
- PostHog → Settings → Personal API keys. Give it the read scopes you need (query, insight, event, person, feature_flag, cohort, session_recording, dashboard) and scope it to the projects this install may reach.
- phx_…
- Project IDRequired
- The numeric project id from PostHog → Settings → Project. It is in the dashboard URL: /project/12345/.
- 12345
- API hostOptional
- https://us.posthog.com for US Cloud, https://eu.posthog.com for EU Cloud, or your own origin for a self-hosted install. Use the app host, not the ingestion host (i.posthog.com).
- https://us.posthog.com
What Claude can do in PostHog
12 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.
- Reads
- 11Reads
- Writes
- 0Writes
- Destructive
- 1Destructive
Reads
11Fetches data and changes nothing.
run_queryRun a HogQL query - ClickHouse SQL over PostHog's own tables - and return the rows with their column names. This is the operation to reach for whenever a question is not already answered by a saved insight: `select properties.$current_url, count() from events where event = '$pageview' and timestamp > now() - interval 7 day group by 1 order by 2 desc limit 20`. The tables are events, persons, sessions, groups and person_distinct_ids. HogQL is select-only, which is why this is a read. Always include a LIMIT: the rows come back verbatim. Response payloads are kept out of the audit log because they can contain person properties.
list_insightsList the saved insights in the project - the charts people have built and kept - with their id, short id, name, description and type. Use it to find out what the team already measures before writing a HogQL query for it, and to get the id that get_insight needs. Returns definitions, not results.
get_insightFetch one saved insight by its numeric id, including its full query definition and its most recent computed result. Use it after list_insights when you want the numbers a chart shows, rather than rebuilding the chart's logic yourself in run_query.
list_eventsList raw events in a time window, newest first, with their properties and the person who sent them. Useful for looking at exactly what one user did, or checking that a newly instrumented event is arriving. PostHog treats this endpoint as legacy and it is narrow: without `after` you only get the last 24 hours, the window between `after` and `before` cannot exceed a year, and paging stops at 50,000. For anything aggregate, use run_query instead. Payloads are kept out of the audit log because event properties carry personal data.
list_personsSearch the people PostHog has identified, by email, distinct id or free text, and return their properties and distinct ids. Call this first when you need the person id that get_person takes. This returns other people's personal data, so the response is never written to the audit log.
get_personFetch one person by their numeric PostHog id, with every property PostHog holds and all of their distinct ids. Get the id from list_persons - a distinct id is not a person id. This returns another person's personal data, so the response is never written to the audit log.
list_feature_flagsList the project's feature flags with their key, name, active state, rollout conditions and variants. Call this before get_feature_flag or update_feature_flag - those take the numeric flag id, which only this returns, not the human-readable key. It is also the cheapest call here, so it is the connection's health check.
get_feature_flagFetch one feature flag by numeric id, with its complete filter groups, rollout percentages, variants and payloads. Read this before update_feature_flag: an update replaces the fields you send, so you need to know what is there now to avoid dropping a targeting rule.
list_cohortsList the project's cohorts - named groups of people defined by properties or behaviour - with their id, name, description and member count. Use it to find the cohort id you can then reference from a HogQL query in run_query, or to see how the team already segments its users.
list_session_recordingsList session replay recordings with their id, duration, start time, click and keypress counts and the person they belong to. Returns the index only - the replay data itself is not available through this endpoint. Use it to find a recording worth watching in PostHog, then open it there. Recordings are other people's browsing sessions, so the response is never written to the audit log.
list_dashboardsList the project's dashboards with their id, name, description and the insights on each. Use it to see how the team organises its reporting, and to find which insight ids belong to a dashboard before calling get_insight on them.
Destructive
1Deletes or permanently alters something. Worth granting on purpose.
update_feature_flagChange a feature flag: turn it on or off, rename it, archive it, or replace its targeting filters. Destructive because it changes what real end users see the moment it lands - flipping `active` can expose an unfinished feature to everyone, or switch one off underneath people mid-session - and because `filters` replaces the whole targeting object rather than merging into it. Call get_feature_flag first and send back the full filters object with your change applied, or you will silently delete the existing rollout rules.
What it will not do
Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.
- It cannot call anything else
- The 12 actions above are the whole of it. A call to any other name is refused before it reaches PostHog rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
- It reaches no further than your credential
- Toolspoke holds no access to PostHog of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
- It never hears from PostHog
- Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in PostHog. An agent has to ask.
- It does not smooth over provider limits
- Toolspoke does not retry, queue or back off around PostHog's own rate limits. A call that PostHog refuses comes back to the agent as a failed call.
Before you connect it
What can Claude do in PostHog?
12 named actions: 11 that only read and 1 that delete or permanently alter something. They include run_query, list_insights and get_insight. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.
What credentials does the PostHog connector need?
Personal API key. The connector asks for personal api key and project id, and optionally api host. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.
Does the PostHog connector work with Cursor and Codex, or only Claude?
Any client that speaks MCP, and every one of them gets the same 12 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.
What does the PostHog connector not do?
The 12 actions above are the whole of it. A call to any other name is refused before it reaches PostHog rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to PostHog of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in PostHog. An agent has to ask. Toolspoke does not retry, queue or back off around PostHog's own rate limits. A call that PostHog refuses comes back to the agent as a failed call.
Can I limit which actions an agent can call?
Yes, in two places. The project switches PostHog's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.
What gets recorded when an agent calls PostHog?
Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.