Pro · read-only by default · Streamable HTTP

Ask your editor which product needs you

Plask runs an MCP server, so Claude Code, Cursor and Claude Desktop can read your portfolio P&L, this week's Focus cards, and your GA4 metrics and alerts, then answer in plain language. No dashboard tab required.

What it does

MCP (Model Context Protocol) is the open standard AI assistants use to call external tools. The Plask MCP server is a remote endpoint at https://plask.dev/api/mcp that any MCP-capable client can connect to with a bearer API key. Once connected, your assistant can pull the P&L per product, read the Focus cards, compare products, and dig into GA4 metrics and anomaly alerts.

Data comes from Plask's own synced copy, refreshed four times a day, not live calls to Stripe, RevenueCat or GA4, so queries are fast and never count against those API quotas. Every tool is scoped to the account that owns the key, and keys are read-only unless you create one with write access.

Setup

  1. Sign in and connect at least one product. MCP access is part of Pro.
  2. Open Settings, then API Keys, and create a key. Copy it: it is shown only once. Tick Allow write access (ad spend and markers) only if your agent should sync ad spend.
  3. Paste one of the configurations below into your client.

Claude Code

claude mcp add --transport http plask https://plask.dev/api/mcp --header "Authorization: Bearer plk_YOUR_KEY"

Then run /mcp inside Claude Code to confirm the connection. Add --scope user to make it available in every project.

Cursor, Windsurf, VS Code

Add this to .cursor/mcp.json in your project (or ~/.cursor/mcp.json globally).

{
  "mcpServers": {
    "plask": {
      "url": "https://plask.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer plk_YOUR_KEY"
      }
    }
  }
}

Claude Desktop and claude.ai

Go to Settings, Connectors, Add custom connector, enter the URL below, and paste Bearer plk_YOUR_KEY as the Authorization header under advanced settings.

https://plask.dev/api/mcp

Plain HTTP

The endpoint speaks standard JSON-RPC over POST, so you can script it directly.

curl -X POST https://plask.dev/api/mcp \
  -H "Authorization: Bearer plk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_portfolio_pnl","arguments":{}}}'

The tools

Portfolio

get_portfolio_pnl
Revenue, ad spend, fixed costs and profit per product for a period, with the change versus the previous period and the date the data runs through. Missing sources come back as null, never as zero.
get_focus_cards
This week's Focus cards (at most three): the rule that fired, the product, the evidence numbers behind it, and the one-line explanation.
compare_products
Two or more products side by side over a period: revenue, profit, traffic, revenue per visitor, and trend direction.

Ad spend and markers, synced by your AI agent

Plask doesn't connect to ad platforms. Your agent reads spend from Meta, Apple Search Ads, Google Ads or TikTok with your own access, then syncs the daily totals here over MCP, and you're responsible for those platforms' terms. Write tools need a key created with write access. A sync replaces only the dates it sends, refuses days you entered by hand, and every batch can be undone under Ad spend on Sources & costs. For Apple Ads only the spend amount is stored, never impressions, clicks or installs. Synced spend shows in your P&L after the next refresh (today's spend by the next morning) and stays private: never on the board.

list_products
Your product ids and names, so the agent can map ad accounts to products.
sync_ad_spend
Write tool. Daily spend for one product, channel (meta, apple_search_ads, google_ads, tiktok_ads or other) and optional campaign, in any currency with an ECB rate. Other channels may add impressions, clicks, installs and conversions; for Apple Ads only the spend amount is accepted. Up to 400 rows (one per day) covering at most 400 days, no future dates, amounts from 0 to 1,000,000 a day. It replaces only the dates you send, so re-running never double counts, and if any day overlaps spend you entered by hand, it writes nothing and lists those days in the error. Each call is a batch, and the agent gets its batch ID back.
get_ad_spend
Reads back spend for a date range, both what you entered in the app and what your agent synced, with the batch ID of each synced row.
delete_ad_spend
Write tool. Removes synced spend for a product, channel, optional campaign and a date range of at most 400 days. Spend you entered in the app is never touched. Like every write, a delete is a batch you can undo.
undo_batch
Write tool. Undoes one write by its batch ID, including a delete: it restores what that batch replaced or deleted and removes what it added. If a later write changed the same days, undo that one first, and undo is refused if it would land on days you've since entered by hand. No time limit. The same Undo is under Ad spend on Sources & costs, in the list titled “Synced by your AI agent”.
create_marker
Write tool. Marks a release, price change or campaign start on a product's charts. Labels are plain text, up to 120 characters, with no links, and the same label on the same day isn't added twice. Each synced campaign also gets one marker, not one per day.
list_markers
Markers for one product or all of them, optionally within a date range.

Sources and products, set up by your AI agent

With a key you create with “Allow adding and organising revenue sources”, your agent can connect a revenue source and put its apps on the right products. It connects exactly the way the app does, with the same checks, and stores what you hand it encrypted. Credentials are never returned or logged; results show only a masked id. A key you give an AI agent also passes through the AI provider and the agent's own logs, which Plask doesn't control, so use a dedicated, read-only key you can revoke. You are responsible for the keys you give your agent. Names that come from your sources are returned to the agent marked as untrusted data, not instructions. Sources it adds show “Added by your AI agent via MCP” in Sources, and every change except creating a product or disconnecting can be undone with undo_batch.

list_connections
Your revenue sources with status, last synced day, a masked key id (never the key) and which products each one feeds.
list_unmapped
Apps, products, packages or properties on your connections that no product uses yet.
create_product
Write tool. Creates a product, within your plan's product limit.
add_source
Write tool. Connects Stripe, RevenueCat, Google Play or App Store Connect exactly as the app does: the same checks, stored encrypted, first sync started. Stripe takes only a restricted read-only key (rk_live_…), never a secret key; Google Play only a service account JSON key; App Store Connect only while you have accepted its terms in Sources (withdrawing them there stops your agent adding App Store Connect, while sources already connected keep syncing; a new terms version needs accepting again). Credentials you pass are stored encrypted and never returned. With a product, clear matches are mapped to it and the rest come back as choices; a product that already has an account of the same source gets a second one only if the agent explicitly allows a duplicate. At most 10 per hour per key.
map_to_product
Write tool. Puts an unmapped app, product or property on a product.
move_to_product
Write tool. Moves a mapped app, product or property to another product, history included.
disconnect_source
Write tool, only for sources your agent added; anything you set up in the app is disconnected in the app. It takes two steps: the first call returns a warning that it deletes the stored key irreversibly, and a confirming call within 5 minutes does it. Syncing stops and history stays. It can't be undone because the key is gone.

GA4 and alerts

list_properties
Lists your connected GA4 properties with their id, display name, platform (web, iOS, Android), and whether monitoring is enabled.
get_metrics
Daily rows for one property over the last 1 to 90 days: active users, sessions, new users, page views, revenue, transactions, session duration, engagement rate. Includes period totals and percentage change versus the preceding period.
get_alerts
Recent anomaly alerts with metric, date, expected vs actual value, modified Z-score, severity, direction, priority score, and the AI root-cause explanation when available. Filter by property and read state.
get_digest
The latest digest: the summary plus the metric snapshot it was generated from.
get_insights
Latest proactive insights: trends, milestones, personal bests, and pattern shifts.
get_portfolio_summary
Every enabled property with last-7-day totals, change versus the previous 7 days, and unread alert count, sorted by sessions.

Things to ask

  • > Which of my products needs me this week, and why?
  • > Compare Inkwell and Tallyho over the last 90 days. Which one earns more per visitor?
  • > Any unread critical alerts? Summarise the root causes.
  • > Pull yesterday's spend for Pebblestack from Meta and Apple Search Ads and sync it.

Security

  • Keys are random 256-bit secrets. Only a SHA-256 hash is stored; the plaintext is shown once.
  • Every request is scoped to the key's account. You cannot query another user's products.
  • Keys are read-only unless you create one with write access. Read tools carry MCP readOnlyHint annotations; write tools on a read-only key are refused.
  • Write tools only add or remove your own ad spend and markers, at most 60 writes a minute per key. Keys are created only in the signed-in app; no MCP tool can create or upgrade a key.
  • Source tools need their own permission, “Allow adding and organising revenue sources”. Keys and credentials your agent passes are stored encrypted, never returned and never logged; Stripe accepts only restricted read-only keys, and App Store Connect needs its terms accepted in the app first. An agent can never accept terms. A key you hand an agent also passes through the AI provider and the agent's logs, outside Plask's control: use a dedicated, read-only key you can revoke.
  • Synced spend and markers are labelled “via MCP” in the app, and synced rows are managed by the agent: you undo them per batch rather than editing them.
  • Revoke a key at any time from Settings. Revocation takes effect immediately.

Questions

Which plan includes the MCP server?
Pro. The MCP server and API keys are part of Pro ($5/mo or $48/yr, or Founding Pro at $36/yr for the first 50 makers). Every tool works across all your products.
Is it read-only?
By default, yes. A new API key can only read, and read tools carry MCP read-only annotations so clients can auto-approve them. The write tools (sync_ad_spend, delete_ad_spend, undo_batch and create_marker) work only with a key you create with "Allow write access (ad spend and markers)", and the source tools (add_source, map_to_product, move_to_product, disconnect_source and create_product) only with a key you create with "Allow adding and organising revenue sources". Each is off by default and can only be turned on in the app. Even then, nothing in the MCP server can change your Stripe, RevenueCat, App Store Connect, Google Play or GA4 accounts.
Does it connect to Meta, Apple Search Ads, Google Ads or TikTok?
No. Plask doesn't connect to any ad platform. Ad spend is synced by your AI agent via MCP: the agent reads your spend with your own access to those platforms and sends the daily totals to Plask. You're responsible for following those platforms' terms. Synced spend stays private and never appears on the public board or profiles.
What if my agent syncs the wrong numbers?
Undo the batch: every write, including a delete, is a batch you can undo under Ad spend on Sources & costs, in the list titled “Synced by your AI agent”, or with undo_batch. You can also run the sync again with the right numbers, because it replaces only the dates it sends and never double counts. Markers can be deleted in the app. Spend you typed in yourself is never changed: the sync refuses those days. It works the other way too: you can't enter spend by hand on days your agent already synced until you undo or delete that batch.
Which clients are supported?
Any MCP client that supports the Streamable HTTP transport with custom headers: Claude Code, Cursor, Claude Desktop and claude.ai (as a custom connector), Windsurf, VS Code with GitHub Copilot, and the official MCP SDKs. The server is stateless, so no long-lived connection is required.
Are there rate limits?
Each key can make 120 calls a minute, up to 60 of them writes, a key can add at most 10 revenue sources an hour, and every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers. Reads are served from Plask's own database rather than the Stripe, RevenueCat or GA4 APIs, so a normal IDE session is cheap. You can hold at most 10 active API keys per account.
How fresh is the data?
Plask refreshes each source four times a day. Stores and GA4 report by day, so totals usually run through yesterday. Every P&L response says which date the data runs through.
How do I revoke a key?
Open Settings, then API Keys, in your Plask dashboard and delete the key. Revocation is immediate; any client still using that key receives a 401 response.

Connect your portfolio to your editor.

Free for one product. Founding Pro $36/yr for the first 50.