PostHog MCP (official, remote)

68/100
Last tested 2026-11-11 (Fresh: tested within 30 days) Needs credentialsNo tool call tested yet OAuth

Advisories: not checked (remote-only)

Security review: not tested

Score = points from our five tests (install, handshake, maintenance, docs, license). Not a quality or security rating. Methodology

  • Install20/20
  • Handshake5/30
  • Maintenance25/25
  • Docs15/15
  • License3/10

Vendor-hosted
What we probed (2026-11-11, no credentials): an MCP initialize POST to https://mcp.posthog.com/mcp returned HTTP 401 with an OAuth challenge (authorization server https://oauth.posthog.com). We did not sign in or use a key, so no tools were listed or called. PostHog's docs state this endpoint, link its source (github.com/PostHog/posthog, services/mcp) and document a personal API key (Authorization: Bearer) as an alternative to OAuth. Per its FAQ the server allows 480 requests per minute and 4,800 per hour per credential, and its tools can read and write across PostHog products (analytics, feature flags, experiments, error tracking, SQL). Scored from the public repo (GitHub reports the monorepo license as NOASSERTION). Core tools not tested.

Transport: Streamable HTTP · not tested

Token cost (estimate): the figure is pending. We have no tools/list capture to estimate from.

Permissions: tool permissions pending · Auth: OAuth · Rate limit: 480 requests/minute and 4,800 requests/hour per credential · Pricing unit: unknown

Auth: OAuth. Rate limit: 480 requests/minute and 4,800 requests/hour per credential (source). Pricing unit: unknown.

HTTP 401, WWW-Authenticate resource_metadata https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp, OAuth metadata lists authorization server https://oauth.posthog.com

Score 68/100 · Tools 0 · Token cost pending · Compare · Last tested 2026-11-11 · Server version not reported · Remote endpoint https://mcp.posthog.com/mcp (streamable-http) · Repo PostHog/posthog

Summary: PostHog MCP (official, remote) requires credentials or a backing service before it will list tools.

Evidence summary

Handshake
auth-gated
Tools listed
0
Context cost
Pending The token cost figure is pending. ranking
Login
Needs OAuth sign-in
Tested
2026-11-11

Test results

TestResultPointsEvidence
installpass20Endpoint https://mcp.posthog.com/mcp reachable over streamable-http (HTTP 401) in 0.1s; no install step for remote servers.
handshakeauth-gated5Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp; metadata lists authorization server https://oauth.posthog.com). We do not sign in; not counted as working until a credentialed test exists.
maintenancepass25Repo pushed 0 days before test; 40,737 GitHub stars.
docspass15README over 3,000 chars; install instructions present; mcpServers config example present. Check of the package's own README (vendor repo README (github.com/PostHog/posthog services/mcp/README.md)).
licensepartial3License not machine-detected as OSI (NOASSERTION).

Local-model readiness

Not tested

Not yet tested (no tools/list response without credentials).

What we tested and what we didn't

Tested on 2026-11-11

  • Install from the registry (remote endpoint: connection only)
  • We attempted an MCP initialize with no credentials and got HTTP 401, so we never reached the tool list (Method details: initialize POST answered 401; tools/list not sent)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)
  • Token cost (estimate)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

Known security issues

Not checked (remote-only): hosted endpoint, version unknown.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

No tool list: this server did not list tools without credentials in our test, so tool changes are not tracked.

Raw test record (JSON)
{
  "name": "posthog-remote",
  "version": null,
  "registry": "remote",
  "status": "auth-gated",
  "tested": "2026-11-11",
  "tools_count": null,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "Endpoint https://mcp.posthog.com/mcp reachable over streamable-http (HTTP 401) in 0.1s; no install step for remote servers."
    ],
    "handshake": [
      "auth-gated",
      5,
      "Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp; metadata lists authorization server https://oauth.posthog.com). We do not sign in; not counted as working until a credentialed test exists."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 40,737 GitHub stars."
    ],
    "docs": [
      "pass",
      15,
      "README over 3,000 chars; install instructions present; `mcpServers` config example present. Check of the package's own README (vendor repo README (github.com/PostHog/posthog services/mcp/README.md))."
    ],
    "license": [
      "partial",
      3,
      "License not machine-detected as OSI (NOASSERTION)."
    ]
  }
}

Install

https://mcp.posthog.com/mcp

Tools listed

Not available (handshake did not complete without credentials).

Quick config

{
  "mcpServers": {
    "posthog-mcp-remote": {
      "type": "http",
      "url": "https://mcp.posthog.com/mcp"
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

Without credentials it said (verbatim): Needs credentials: vendor-hosted, OAuth sign-in required. HTTP 401 with OAuth challenge (WWW-Authenticate resource_metadata https://mcp.posthog.com/.well-known/oauth-protected-resource/mcp; metadata lists authorization server https://oauth.posthog.com). We do not sign in; not counted as working until a credentialed test exists.

  1. Install. No install step: it is a remote server at https://mcp.posthog.com/mcp.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools. In our test it did not list tools without credentials.
{
  "mcpServers": {
    "posthog-mcp-remote": {
      "type": "http",
      "url": "https://mcp.posthog.com/mcp"
    }
  }
}

Not tested with credentials We have not tested this with real credentials.

Test history

Follow this server (RSS) · Monthly changelog

Related: Best data and analytics MCP servers · Troubleshooting: 401 Unauthorized on remote servers · MCP servers that need an OAuth sign-in · How to protect AI API keys

FAQ

Is PostHog MCP deprecated?

No. posthog-remote was not deprecated or archived when we last tested it on 2026-11-11.

What replaces PostHog MCP?

Nothing; PostHog MCP (official, remote) is not deprecated as of 2026-11-11.

Does PostHog MCP need an API key?

Not an API key: it needs an OAuth sign-in. Without signing in, the endpoint returned HTTP 401 with an OAuth challenge and did not list tools.

Embed the badge

TestedMCP: 68/100, tested 2026-11-11

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue