Integrations

Connecting Claude to Lead Recorder (MCP server)

How the Lead Recorder MCP server works: the five tools it exposes, how the connection and OAuth flow work, and exactly what account data Claude can read.

Lead Recorder runs a remote MCP (Model Context Protocol) server at mcp.leadrecorder.com so you can ask Claude for lead reports directly, without logging into the dashboard: "write me this month's report for Bob's Plumbing" or "which of my sites have gone quiet this week." This page documents the server for IT/security reviewers and for anyone connecting it directly: what it can access, how authentication works, and what each tool does.

What data it can access

Four of its five tools are read-only: they can't create, modify, or delete anything in a Lead Recorder account. The fifth, add_site, is the one exception. It can create a new site, but nothing else: it can't modify or delete an existing site, and it's restricted to account admins. Access is scoped by the same role-based permissions as the dashboard: an account admin or team member can see every site on that account; a client role only sees the sites they've explicitly been given access to. Connecting Claude never grants access beyond what the connecting user could already see by logging in.

None of the five tools return an individual lead's name, email address, or phone number. They return site metadata (name, domain) and aggregated counts and breakdowns (totals, percentages, top sources), a materially narrower scope of data than the Zapier/Make integration, which does expose per-lead contact details for its New Lead trigger.

Connecting

Two ways to connect, depending on the client:

claude.ai (web): click Connect on the Lead Recorder connector. You're redirected to leadrecorder.com to sign in (if not already) and see a consent screen naming the account you're about to connect; approving redirects back to claude.ai with an authorization code, which is exchanged for an access token. This is a standard OAuth 2.1 authorization-code flow with PKCE; no client secret is ever exposed to the browser.
Claude Desktop / Claude Code: generate a personal key from Account → API access → Claude/MCP, and add it as a bearer token in the client's MCP server configuration (.mcp.json). This is the same kind of key used by the Zapier/Make integration, just issued from its own slot so revoking one never affects the others.

Endpoints

https://mcp.leadrecorder.com: the MCP endpoint itself (Streamable HTTP transport)
https://mcp.leadrecorder.com/.well-known/oauth-protected-resource: RFC 9728 protected resource metadata
https://mcp.leadrecorder.com/.well-known/oauth-authorization-server: RFC 8414 authorization server metadata
https://www.leadrecorder.com/oauth/authorize: the interactive login/consent screen
https://www.leadrecorder.com/api/oauth/token: token exchange (authorization_code grant, PKCE required)
https://www.leadrecorder.com/api/oauth/register: Dynamic Client Registration (RFC 7591), so clients like claude.ai can register themselves automatically

The five tools

list_sites

No parameters. Lists the sites (client websites) the connected account can see reports for: id, name, and domain only.

get_monthly_report

Parameters: siteId (required, from list_sites) and month (optional, YYYY-MM, defaults to the current month). Returns total leads, new vs. returning visitor counts, a phone/form/email/booking split, a paid/organic/direct channel breakdown, the top individual sources and campaigns by count, and the percentage of leads that arrived outside business hours. All figures are aggregated: no individual lead's contact details are included.

get_quiet_sites

Parameters: days (optional, defaults to 7). Lists sites on the account with zero leads in that window, along with how many days it's been since each one's last lead, useful for an agency spotting a client site that's gone quiet.

add_site

Parameters: name (required), domain (required), leadTypes (optional, one or more of form, phone, calendly, booking, defaults to form), thankYouUrl (optional, only used when leadTypes includes calendly or booking). Creates a new site on the account and returns its tracking snippet. Restricted to account admins: a team member or client role gets an error instead of a new site. Subject to the same plan site-limit and domain checks as adding a site from the dashboard.

check_snippet

Parameters: siteId (required, from list_sites or add_site). Reports whether that site's tracking snippet has ever fired: a boolean, and the timestamp of the last time it was seen if so.

list_sites, get_monthly_report, get_quiet_sites, and check_snippet are read-only, idempotent, and only ever touch the connected account's own data (readOnlyHint, idempotentHint, and openWorldHint: false). add_site is the one exception: it creates data (readOnlyHint: false) and isn't idempotent. Calling it twice with the same details creates two separate sites. It also performs a DNS lookup on the domain provided, confirming it resolves, before creating the site; that lookup doesn't send any account data to the domain or fetch anything from it.

Rate limiting

Requests are rate-limited per account to 60 per minute, the same limit applied to the Zapier/Make integration. Returns a JSON-RPC error if exceeded, expected only under misconfigured, unusually fast polling.

Revoking access

A key generated manually from Account → API access → Claude/MCP can be revoked from that same page at any time, which immediately invalidates it. A connection made through the claude.ai OAuth flow is a separate credential from that manual key, so revoking the manual key doesn't affect an active OAuth connection: to revoke one today, disconnect the connector from claude.ai's own connector settings, or email hello@leadrecorder.com and we'll invalidate it on our end.

This server is also listed on Smithery, a public directory of MCP servers.