#MCP server

3x ships a remote MCP server at https://<api-host>/mcp. With it, Claude (Claude Code, claude.ai, Claude Desktop, any MCP client) can

• analyse traffic, campaigns, relevance, videos, quizzes, funnels and ad costs with the same filter as the dashboard, and run read-only SQL;
• act: mark conversions (for example a confirmed WhatsApp lead), retry uploads, define goals, funnels and relevance rules, sync ad accounts;
• install 3x on a website: detect the stack, read the setup recipe, create the project and keys, write the snippet into the code, verify the installation and watch the first live event.

#Transport

• Streamable HTTP, stateless, JSON responses (no SSE), protocol version 2025-11-25. Only POST; GET and DELETE answer 405.
• Request body ≤ 64 KB, JSON-RPC batches of 1–10 messages.
• Browsers are blocked: a request with an Origin header gets 403 unless the deployment lists the origin in X3_MCP_ALLOWED_ORIGINS.
• Limits: 120 requests and 60 tool calls per minute per principal (429 with Retry-After).
• /mcp never redirects – use the exact host, otherwise clients drop the Authorization header.

#What works without signing in

initialize, tools/list, resources/*, prompts/* and the developer tools docs_search, docs_read, setup_detect_stack, setup_get_instructions and events_validate need no credentials. Without a token tools/list shows every tool so the model can plan; the first call of a protected tool answers 401 with a WWW-Authenticate challenge, which makes Claude start the OAuth sign-in. With a token, tools/list only shows the tools your scopes allow.

#Projects

Every data tool takes project – a project id, org-slug/project-slug, or a project slug that is unique among the projects you can see. It is optional when the credential is bound to exactly one project. Start with project_list.

#Output

• Tool results contain structuredContent (typed by the tool's output schema) and the same data as JSON text.
• Rates are fractions 0–1, durations seconds, money in the project currency.
• Large results are compacted (floats rounded, nulls dropped, long strings cut, ≤ 150 000 characters with a truncation note) – narrow the filter or use limit for more detail.

#Privacy and audit

Only leads_list and leads_get return personal data; they need leads:read and are marked with _meta.personalData. leads_list never returns phone numbers or free text. Contact data passed to conversions_mark is hashed before it is stored and redacted in the audit log. Every tool call is written to the audit log (mcp_audit: principal, tool, shortened arguments, duration, result size).

Next: Tools · Resources and prompts.