MCP for Claude, Cursor and other clients

ServerStats runs a remote Model Context Protocol server. It is read-only: no tool changes a setting, acts on a player or runs a command.

Endpoint: https://serverstats.cc/api/v1/mcp (Streamable HTTP, JSON responses).
Auth: Authorization: Bearer ssk_..., a token from authentication. A token with only mcp:read works here.
Plan: Network. After a downgrade, tools answer "needs the Network plan".

Connect

Claude Code:

bash

claude mcp add --transport http serverstats https://serverstats.cc/api/v1/mcp --header "Authorization: Bearer ssk_..."

Cursor (~/.cursor/mcp.json):

json

{ "mcpServers": { "serverstats": { "url": "https://serverstats.cc/api/v1/mcp", "headers": { "Authorization": "Bearer ssk_..." } } } }

Claude Desktop uses mcp-remote as a bridge (it needs Node.js) in claude_desktop_config.json:

json

{ "mcpServers": { "serverstats": { "command": "npx",
  "args": ["-y", "mcp-remote", "https://serverstats.cc/api/v1/mcp", "--header", "Authorization:${AUTH}"],
  "env": { "AUTH": "Bearer ssk_..." } } } }

Claude's "Add custom connector" dialog expects OAuth, which ServerStats does not offer yet; use the config above.

Tools

Tool	Returns
`list_servers`	Every server and Roblox experience, status, plan and history window. Call first.
`server_overview`	One server now: players online, joins and playtime today, latest gauges
`list_metrics`	Which metric keys and event types have data
`get_timeseries`	1 to 4 metrics over a range: summary and up to 48 points each
`top_events`	Most frequent event types in a range
`top_players`	Most active players (pseudonymous `p_xxxxxxxxxx`)
`player_retention`	Sessions, new and returning players, day-1/7/30 retention
`lag_spikes`	Count, worst tick and top causes
`store_revenue`	Store revenue summary, packages, creator codes, top spenders (Operator and above)
`basic_mode_status`	A basic-mode server's polling state and uptime
`get_server_notes`	Your organisation's notes

Ranges are hours (look back from now) or from and to, and are clamped to your plan's history. Tools are annotated readOnlyHint: true.

Limits

30 requests burst then 1 a second per token (429 with Retry-After), and 5,000 tool calls per organisation per UTC day. MCP calls use none of your ServerStats AI questions: your client's model does the thinking.

Protocol details

Revisions 2026-07-28 (stateless, current), 2025-11-25, 2025-06-18 and 2025-03-26. A request whose params._meta carries io.modelcontextprotocol/protocolVersion is served as 2026-07-28 and must send matching MCP-Protocol-Version, Mcp-Method and (for tools/call) Mcp-Name headers, else 400 with JSON-RPC error -32020.
POST only; GET and DELETE answer 405. One JSON-RPC message per POST; batches are refused. No SSE.
A browser Origin other than https://serverstats.cc is refused (403).
401 carries WWW-Authenticate: Bearer realm="ServerStats", error="invalid_token". There is no OAuth server yet.

Privacy

Tools return the same pseudonymised projection as the dashboard assistant: aggregates, server names and notes, players as p_ plus 10 hex characters of the organisation's keyed hash, names only with name display on. Never raw platform ids, IPs or emails. Where the data goes next is decided by your client and its model provider.