Until now the Mitr MCP server could only read: list your apps, pull a report, check a funnel. Starting with this release, an AI assistant can also make changes, such as creating a funnel, adding a placement to a QR campaign, or pausing a webhook. Every change is a separate permission on the API key you give the assistant, so you decide what it may do.
What the assistant can change
- Funnels: create a funnel from ordered steps, change its name or steps, or delete it.
- QR campaigns: create a campaign that sends scanners to an https destination, change its name or destination, set it to active, paused or archived, and add a code per placement.
- Webhooks: create an endpoint, change its URL or event types, pause it, or delete it.
- Apps: register a new app, as before.
Alerts and team management are not exposed to the assistant at all.
Permissions, one at a time
When you create a key in Settings → API keys & AI assistants, you tick what it may do:
| Permission | Lets the assistant |
|---|---|
| Can register apps | Register a new app |
| Can manage funnels | Create and change funnels |
| Can manage QR campaigns | Create campaigns, change them, add codes |
| Can manage webhooks | Create, change and pause webhook endpoints |
| Can delete | Delete funnels and webhook endpoints. Needs one of the manage permissions as well |
A key with only “Can manage QR campaigns” can’t touch your funnels or webhooks, and can’t delete anything. That’s deliberate: a key should be as narrow as the job you give the assistant.
Deletes ask first
A delete is permanent, so the assistant is set up to confirm with you before it deletes a funnel or a webhook endpoint. The confirmation comes from the assistant’s own behaviour, so the permission is still the real limit: leave “Can delete” off a key unless you need it. Pausing a webhook is usually the better choice.
Secrets stay out of the chat
When you create a webhook, the signing secret isn’t returned to the assistant or shown in the conversation. Copy it from the dashboard, where it belongs. The same is true of a new app’s SDK secret.
Try it
- Create a key in the dashboard with only the permission you need.
- Connect your assistant with the Mitr MCP server, as in the MCP guide.
- Ask for one change, and check it in the dashboard.
Start narrow. You can always create another key with more permissions later.
Frequently asked questions
Can Claude create a QR campaign for me?
Yes, if your API key has the Can manage QR campaigns permission. The assistant can create a campaign, add codes per placement, and archive a campaign. Archiving keeps the history and can be reversed.
Can Claude delete things?
Only with the Can delete permission, which you must tick separately. Deletes can't be undone, and the assistant is set up to confirm with you before it runs one.
Will the webhook signing secret show up in the chat?
No. Creating a webhook returns the endpoint without its signing secret. Copy the secret from the Mitr dashboard.
Who can use these tools?
Any workspace owner who creates an API key with the permissions they want. The key can only act on what that user can already change in the dashboard.