Provider REST API

Analytics

Connect Claude to Segment

Inspect a Segment workspace: sources, destinations, tracking plans, warehouses, and functions. Toolspoke puts 10 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connection
Provider REST API
Authentication
Public API token
Actions exposed
10
Cost per call (typical)
1 credit
Adapter
Maintained by Toolspoke

Connected in three steps

  1. 1

    Install Segment

    Open the marketplace in your workspace, add Segment to the project your agents work in, and it appears on the gateway immediately.

  2. 2

    Connect the credential

    Authenticate with public api token. Where to get one, and what it has to be able to reach, is the next section.

  3. 3

    Point your agent at the gateway

    Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json
{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Segment shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code

Run it in your project, then /mcp to sign in

claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop

Settings, then Connectors, then Add custom connector

https://toolspoke.com/mcp
Cursor

~/.cursor/mcp.json, or .cursor/mcp.json for one project

{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex

~/.codex/config.toml

[mcp_servers.toolspoke]
url = "https://toolspoke.com/mcp"
VS Code

.vscode/mcp.json, or the MCP: Add Server command

{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Segment asks for

Public API token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

Public API tokenRequired
Segment → Settings → Workspace settings → Access Management → Tokens → Create token. A token belongs to one workspace; give it read-only access unless you have a reason not to.
sgp_…
Regional API hostOptional
Leave blank for the US region. An EU workspace is served from https://eu1.api.segmentapis.com, and a US token will not work against it.
https://api.segmentapis.com

What Claude can do in Segment

10 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads
10Reads
Writes
0Writes
Destructive
0Destructive

Reads

10

Fetches data and changes nothing.

  • get_workspace

    Return the workspace this token belongs to, with its id, name and slug. Segment has no endpoint that lists workspaces - a Public API token opens exactly one, and this is how you find out which. Call it first when you do not know what the connection reaches, and treat it as the connection test: it costs nothing, needs no arguments, and a token that fails here is wrong rather than under-scoped.

  • list_sources

    List the sources in the workspace - the websites, apps, servers and cloud integrations that send data in - with each one's id, name, slug, enabled state and metadata. This is the usual second call after get_workspace and the way to find the source id every other source operation takes. It returns configuration, not events: nothing here reads what a source has collected.

  • get_source

    Fetch one source by id, with its full settings, its metadata and the id of the tracking plan connected to it. Ids come from list_sources. Use list_connected_destinations to see where this source's data goes.

  • list_destinations

    List every destination in the workspace - the tools data is forwarded to - with each one's id, name, enabled state and the source it is attached to. Use it to answer "where does our data end up" across the whole workspace; use list_connected_destinations when the question is about one source. Destination settings frequently contain the API keys of other products, so treat what comes back as configuration that names secrets even where their values are masked.

  • get_destination

    Fetch one destination by id, with its full settings and the source it is attached to. Ids come from list_destinations or from list_connected_destinations. This is the call that explains why a destination is or is not receiving something.

  • list_tracking_plans

    List the tracking plans in the workspace with their ids, names and types. A tracking plan is the contract for what events a source is allowed to send and what shape they take, so this is where a question about expected event schemas starts. Requires the Protocols feature on the workspace - without it this fails whatever the token's scopes say, which reads as a permission error and is not one.

  • get_tracking_plan_rules

    Return the rules of one tracking plan: the JSON Schema for every event it governs, with each event's name, type and property definitions. This is the schema surface an agent actually wants - it says what a valid event looks like without reading a single real event. Ids come from list_tracking_plans. Segment rate-limits this route harder than the rest of the Public API, at 200 requests a minute, so page through it rather than looping it tightly.

  • list_warehouses

    List the warehouses the workspace loads into, with each one's id, metadata, enabled state and settings. Use it to find out where Segment data lands for analysis - the answer is usually the same database a BigQuery, Snowflake or Postgres connection on this gateway already reaches, and this is how you confirm it is the same one.

  • list_connected_destinations

    List the destinations one source is connected to. This is the per-source view of the data flow, and the call to make when the question is "where does this website's data go". Note the asymmetry: the route is named connected-destinations and the payload comes back under `destinations`, which is Segment's shape rather than a mistake here. Source ids come from list_sources.

  • list_functions

    List the functions in the workspace - the custom code Segment runs to shape data on the way in or out - with each one's id, display name, description and code preview. IMPORTANT: `resource_type` is required and there is no call that returns all of them at once. Segment lists functions one kind at a time, so ask for SOURCE, DESTINATION, INSERT_SOURCE, INSERT_DESTINATION or INSERT_TRANSFORMATION separately and combine the answers yourself. Omitting it returns an error that reads like a bad request rather than a missing filter. Requires the Functions feature on the workspace.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else
The 10 actions above are the whole of it. A call to any other name is refused before it reaches Segment rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It only reads
Every action here reads. Nothing this connector can do changes anything in Segment.
It reaches no further than your credential
Toolspoke holds no access to Segment of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Segment
Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Segment. An agent has to ask.
It does not smooth over provider limits
Toolspoke does not retry, queue or back off around Segment's own rate limits. A call that Segment refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Segment?

10 named actions: 10 that only read. They include get_workspace, list_sources and get_source. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Segment connector need?

Public API token. The connector asks for public api token, and optionally regional api host. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Segment connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 10 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Segment connector not do?

The 10 actions above are the whole of it. A call to any other name is refused before it reaches Segment rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Every action here reads. Nothing this connector can do changes anything in Segment. Toolspoke holds no access to Segment of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Segment. An agent has to ask. Toolspoke does not retry, queue or back off around Segment's own rate limits. A call that Segment refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Segment's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Segment?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.