Amplitude is a product analytics platform for understanding user behavior, funnels, retention, and experiments. For MCP, use a dedicated analytics credential by default; OAuth is the alternative when access must follow an individual user.
This guide covers the Amplitude-side requirements for an MCP server. The Amplitude agent template deploys Dome resources separately; it does not create or scope Amplitude credentials.
Choose a connection method
Choose a dedicated API credential for a shared or unattended analytics connection. Choose user-delegated OAuth only when the MCP implementation explicitly supports it and access must follow the authorizing member. Use Amplitude's Administrative API documentation to confirm the credential type available to your account.
Recommended: A dedicated read-only analytics identity
Create a non-production Amplitude project or a test identity with access only to the projects the MCP server should inspect. Use a scoped API credential issued to that identity, not an individual administrator's long-lived key.
- In Amplitude, identify the organization and project(s) the server may read.
- Create the API credential using Amplitude's API key management guidance and record its owner, purpose, and rotation date.
- Grant the identity the minimum project and data permissions needed for the MCP server's intended queries.
- Store the secret only in the MCP client's secret store.
- Query a known test event or chart, then confirm that a project outside the intended scope is unavailable.
Alternative: User-delegated OAuth
If the Amplitude MCP implementation offers OAuth, prefer it for interactive use: it follows the authorizing user's project permissions and avoids sharing an account-level secret. Register the exact client redirect URL in the Amplitude application settings before starting consent. Use a dedicated test user for the first authorization.
- Open the vendor's OAuth documentation and confirm that this application or connected-app flow is supported for your account.
- Register the exact redirect URI supplied by the MCP client. For Dome, use
https://api.domesystems.ai/oauth/callback. - Authorize with the dedicated test identity, not an account owner, and approve only the intended workspace, project, or organization boundary.
- Confirm the authorized identity can read one known test record and cannot reach an unshared resource.
Verify Amplitude MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Amplitude MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Amplitude boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If a query authenticates but returns no data, first verify the project, region, and date range. If it returns too much data, reduce access at the Amplitude project or identity level and rotate the credential rather than attempting to hide data in prompts.
Next steps
Deploy the Amplitude agent template to create a governed agent in Dome that can analyze product behavior with the approved analytics boundary, with the template's included model, tools, and rules.
