Connect your stack
27 native integrations. 3,200+ tools via managed connectors. Most are one-click OAuth, some use API keys - Viktor handles auth and starts working. No webhooks, no Zapier zaps.
Loading
Viktor is an AI employee that connects to PostHog natively and helps you track product usage and feature adoption, running 300 PostHog actions for you like Role get, User get, and Query run. Ask in plain English in Slack or Microsoft Teams; Viktor does the work in PostHog and reports back. Setup takes about two minutes.
Free to start · No credit card · SOC 2 Type 1 · Works in Slack & Microsoft Teams
Messages you'd actually send. Paste one into Slack or Microsoft Teams, swap in your specifics, and Viktor takes it from there.
“Pull this week's activation funnel from PostHog and flag the biggest drop-off.”
— you, in Slack or Teams
“Investigate why a key metric dropped in PostHog last week and report what you find.”
— you, in Slack or Teams
“Build a report on the new feature's adoption in PostHog and post it every Monday.”
— you, in Slack or Teams
“Watch PostHog for a spike in a key metric and alert me with context.”
— you, in Slack or Teams
Ask in plain English in Slack or Microsoft Teams. Viktor picks the right PostHog actions, runs the work, and reports back. No workflows to build.
Get actions in the project. Actions are reusable event definitions that can combine multiple trigger conditions (page views, clicks, form submissions) into a single trackable event for use in insights and funnels. Supports pagination with limit and offset, case-insensitive name filtering with search, filtering by creator with createdby (comma-separated user ids), filtering by tag with tags (a JSON-encoded array of tag names), and sorting with ordering. Projects can have thousands of actions, so pass limit plus the relevant filters rather than fetching every action at once.
List dashboards in the project. The optional search parameter runs a fuzzy match against name and description using Postgres trigram word similarity (handles typos, transpositions, and prefix-as-you-type) and returns results ranked by relevance — use it to find a specific dashboard by name rather than paging through every dashboard. search is capped at 200 characters; longer queries return a 400 error. Optional filters by tag and pinned status are also supported. Returns name, description, pinned status, tags, and creation metadata. Tiles and insights are not included — use dashboard-get to fetch a dashboard's tiles, then dashboard-insights-run to fetch the actual data for each insight.
List all members of the current organization with their names, emails, membership levels (member, admin, owner), and last login times.
List surveys in the project. Use search for fuzzy match against survey name and description (handles typos and prefix-as-you-type). Use type to filter by survey kind (popover, widget, externalsurvey, api). Use archived to filter archived state. Combine with pagination via limit/offset.
Create a review queue for routing traces that still need review. Queue names must be unique among active queues in the current project.
Move a pending trace review assignment to a different review queue by updating queueid. Fails if the trace has already been reviewed and can no longer stay queued.
Switch the active PostHog organization for subsequent tool calls. Call this proactively whenever the user names an organization they want to operate on. Use organizations-list to resolve an organization name to an id. Default to the active organization when no specific organization is mentioned.
DEPRECATED: renamed to skill-duplicate. This alias forwards to skill-duplicate and will be removed. Call skill-duplicate directly with the same arguments.
Return a support ticket's message thread, ordered chronologically. The response is paginated (default 50, max 200 per page) — use the limit and offset query params to page through long threads, and read count/next from the response envelope. Includes all messages from the customer, team members, and AI, as well as private internal notes. Each message contains authortype, authorname, content, and an isprivate flag indicating internal notes.
Get the full thread of replies for a parent comment. Useful for reading complete discussions on a resource.
Get a specific comment by ID including its content, rich content with mentions, and metadata.
Get the count of comments, optionally filtered by scope and itemid.
The thinned CI failure logs for a pull request, grouped by failed job — reach for this to answer "why did this PR's CI fail". Each failed job returns its failure region (the error lines plus surrounding context, with "... N lines omitted ..." markers) as ordered lines, and every line carries its original 1-based line number in the full pre-thinning log so you can locate it in the raw GitHub log. The PR is resolved to ALL its workflow runs across every push (via the pullrequests association, not the latest commit), so earlier pushes' failures are included too. logsavailable is false when CI hasn't failed, the logs aged out of the short Logs retention, or a fork PR has no run association to resolve. Use pr-runs or workflow-jobs for the run/job metadata behind these logs.
Create a feature flag in the current project.
Get details of a specific role including its name, creation date, and creator.
List recent activity logs for the project. Shows who changed what and when — includes feature flag updates, insight creations, dashboard modifications, experiment launches, and other project changes. Use scope parameter to filter by resource type (e.g. "FeatureFlag", "Insight", "Dashboard", "Experiment", "Survey", "Cohort"). Use itemid to filter changes for a specific resource. Returns results ordered by most recent first. Each result includes: user (who performed the action with firstname and email), activity (e.g. "created", "updated", "deleted"), scope (entity type like "FeatureFlag"), itemid (ID of the affected resource), detail (structured JSON with name, shortid, and a changes array where each change has type, action, field, before, and after values), and createdat timestamp.
Load a connected MCP server's live tool catalog by connection id (from mcp-connections-list). Returns each tool's toolname, description, inputschema, and approvalstate. ALWAYS call this to load a connection's REAL tool names before curating per-agent MCP tool permissions (an agent's spec.mcps[].tools[] with level / defaulttoolapproval) — never invent or guess tool names from past sessions or skill prose.
Delete a function by ID (soft delete). The function will no longer appear in lists or process events, but historical data is preserved.
Query LLM traces to inspect AI/LLM usage. Returns a list of traces with their events, latency, token usage, and other metadata. Use dateRange, properties, and limit to filter results.
Break down the events that COUNT toward a conversion goal by their own utmsource, utmcampaign, and matched integration. Returns recent sample events for inspection. This is a flat per-event breakdown of the conversion events themselves — NOT an analysis of the user's prior journey, and NOT the dashboard's attribution calculation (first-touch / last-touch / multi-touch weighting is applied by the dashboard, not here). Use when the user asks "what utmsources are behind my N conversions?" or "where do these conversions come from?". Only EventsNode and ActionsNode goals are explained at the event level; DataWarehouseNode goals short-circuit with a note.
Query error tracking issues to find, filter, and inspect errors in the project. Returns aggregated metrics per issue including occurrence count, affected users, sessions, and volume data.
List the MCP servers connected to this project (the "connections"). Each entry returns its id (the connection id you pass to mcp-connection-tools-list), displayname, url, and status fields (isenabled, needsreauth, pendingoauth) plus toolcount. Use this to discover which connections exist before loading a connection's live tool catalog with mcp-connection-tools-list.
USE THIS TOOL — DO NOT FALL BACK TO SQL — whenever the user asks about utmsource mappings, customsourcemappings, unmatched / non-integrated UTM values, or the question "what utmsources do I have and which ad platform do they belong to?". Returns fullutmsourcecatalogue (every utmsource value seen on events in the window, matched + unmatched, with event count and the integration it resolves to), sourcesuggestions (mapping recommendations where a value's token matches a known alias, e.g. raw facebookpaid → MetaAds), rawunmatchedsamples (every unmatched value, including likely-not-an-ad values like organic/newsletter/partner), and currentmappings (every alias already in effect — canonical + teamcustom — so duplicates aren't suggested). Read-only — applying mappings is a separate write tool.
DEPRECATED: renamed to skill-get. This alias forwards to skill-get and will be removed. Call skill-get directly with the same arguments.
List available function templates. Templates are pre-built function configurations for common integrations (Slack, webhooks, email, etc.) and transformations (GeoIP, etc.). Filter by type (destination, sitedestination, siteapp, transformation, etc.) via the 'type' query parameter. Results are sorted by popularity (number of active functions using each template).
Add a markdown text tile to a dashboard. Text tiles render as markdown blocks — useful as section headings, dividers, or annotations between insight tiles to give a dashboard structure. The desktop grid is 12 columns wide; a typical heading uses a thin full-width banner (e.g. layouts.sm = {x: 0, y: 0, w: 12, h: 1}). If layouts is omitted, the tile is placed using the default layout — use dashboard-reorder-tiles afterwards if you need precise placement.
List saved trace reviews. Supports filtering by traceid, definitionid, search, and ordering. Returns comments, scores, reviewers, and timestamps.
Test Hog evaluation source code against a sample of recent $aigeneration events without saving. Returns per-event results (pass/fail/N/A), reasoning, and input/output previews. Use this to validate Hog code before creating or updating a 'hog' type evaluation.
Add or replace a semantic description for a data-modelling view (saved query) or one of its columns. Use this ONLY for views — rows where tabletype = 'view' in system.informationschema.tables. For imported/physical warehouse tables (tabletype = 'datawarehouse') use warehouse-column-annotations-create instead. Core PostHog tables (events, persons, groups, sessions; tabletype = 'posthog') cannot be described. Provide the savedquery id, the columnname (empty string for a view-level description), and the description. The annotation is recorded as user-edited, which prevents automatic enrichment from overwriting it. Calling this again for the same column replaces the existing description.
Delete an alert by ID. This permanently removes the alert and all its check history. Subscribed users will no longer receive notifications.
List semantic descriptions of data-modelling views (saved queries) and their columns. Use this for views (tabletype = 'view' in system.informationschema.tables); for physical warehouse tables use warehouse-column-annotations-list. Pass ?savedqueryid=<uuid> to scope to one view. Each entry has the columnname (empty string = view-level description), the description, and its source (aigenerated or useredited). Use this to see what a view's columns mean before writing SQL against it.
Get a specific cohort by ID. Returns the cohort name, description, filters (for dynamic cohorts), count of matching users, and calculation status.
Create a new scorer (a.k.a. score definition) used by trace reviews. Pass name, kind (categorical, numeric, or boolean), and config matching the kind. kind is immutable after creation. Categorical scorers need an options array with unique keys and optional selectionmode/minselections/maxselections (for multiple). Numeric scorers can set min, max, step. Boolean scorers can override truelabel/falselabel. Scorers always start active (not archived) and at version 1.
Run a paths query to analyze the most common sequences of events or pages that users navigate through. Paths insights visualize user flows as a directed graph, showing how users move between steps and where they drop off.
Create an annotation to mark an important change (for example, a deployment) on charts and trends. Provide a note in content, when it happened in datemarker (ISO 8601), and whether it is scoped to the current project or the whole organization. Optionally set an emoji to show in place of the default badge on the chart.
Get a specific session recording playlist by shortid. Returns full playlist metadata including name, description, filters, type, and recording counts.
Get a single reminder by ID.
Delete a reminder by ID. This stops it from firing.
Search for PostHog entities by name or description. Can search across multiple entity types including insights, dashboards, experiments, feature flags, notebooks, actions, cohorts, event definitions, and surveys. Use this to find entities when you know part of their name. Returns matching entities with their IDs and URLs.
Dry-run a HogQL query: parse and type-check it without executing, so there is no ClickHouse cost and no 202 polling. Returns structured errors (with character positions), warnings, notices, and the list of tables the query references. Use this before 'query-run' on any non-trivial HogQL to catch column typos, missing tables, and syntax issues up front instead of iterating on opaque execution errors. Accepts the same language values as the HogQL editor: 'hogQL' (default, full SELECT), 'hogQLExpr' (bare expression), 'hog', or 'hogTemplate'. Pass 'connectionId' to validate against a Postgres or DuckDB direct-query data warehouse source instead of the ClickHouse catalog (use external-data-sources-list to find ids).
Move a pending trace review assignment to a different review queue by updating queueid. Fails if the trace has already been reviewed and can no longer stay queued.
Classify sentiment of LLM trace or generation user messages as positive, neutral, or negative. Pass a list of trace or generation IDs and an analysislevel ("trace" or "generation"). Returns per-ID sentiment labels with confidence scores and per-message breakdowns. Results are cached — use forcerefresh to recompute. Rate-limited.
Update the authenticated user's profile and settings using PATCH semantics — only the fields included in the request body are changed. Pass @me as the UUID; non-staff callers may only update their own account. Use user-get first to inspect current settings. notificationsettings merges key-by-key; changing email triggers a verification flow; changing password also requires currentpassword. Always confirm changes with the user before applying.
Return the HogQL catalog for the active project: every queryable table (PostHog, system, warehouse, view, materialized view, batch export, endpoint) keyed by name, with each table's fields, plus the join graph between data-warehouse tables. Call this once up front when building a HogQL query from scratch so you pick real table and column names on the first attempt instead of guessing. Cheap — no ClickHouse cost. Pass 'connectionId' to introspect a Postgres or DuckDB direct-query data warehouse source instead of the ClickHouse catalog (use external-data-sources-list to find ids).
You should use this to answer questions that a user has about their data and for when you want to create a new insight. You can use 'event-definitions-list' to get events to use in the query, and 'event-properties-list' to get properties for those events. It can run a trend, funnel, paths or HogQL query. For existing PostHog-created data, use system tables with the system. prefix; for example, count SQL insight variables with SELECT count() AS total FROM system.insightvariables. Where possible, use a trend, funnel or paths query rather than a HogQL query, unless you know the HogQL is correct (e.g. it came from a previous insight.). Use PathsQuery to visualize user flows and navigation patterns — set includeEventTypes to ['hogql'] with a pathsHogQLExpression for custom path steps. To target a Postgres or DuckDB direct-query data warehouse source instead of ClickHouse, set 'connectionId' on a HogQLQuery (call external-data-sources-list to discover ids).
List all event definitions in the project with optional filtering. Can filter by search term.
Start an on-demand batch export that prepares downloadable files for events, persons, or sessions. Provide dataintervalstart and dataintervalend as ISO 8601 datetimes; the interval must be at most one week. For events, include and exclude filter event names. Use file-download-batch-exports-retrieve with the returned id to poll until status is Completed, then follow the downloading-batch-export-files skill to download the files through the existing REST download endpoint.
Fetch a single subscription delivery attempt by id. Returns status, triggertype, targettype, targetvalue, timestamps, workflow/idempotency metadata, and exportedassetids. contentsnapshot (the frozen dashboard/insight state at send time) is not returned — use the insight/dashboard tools for current state. recipientresults and error are also excluded to avoid leaking recipient identifiers or upstream response bodies that may contain tokens / PII. Unlike the list tool, aireport (the full report markdown for AI-prompt subscriptions) is returned here, alongside aireportprompt (the prompt it was generated from). aireportdiagnostics (per-query generated HogQL + failure types) is excluded to keep the response focused on the report itself.
Retrieve the team's evaluation configuration, including the active LLM provider key used to run llmjudge evaluations and remaining trial credits. Call this before creating an llmjudge evaluation to verify the team has either trial credits available or an active provider key configured — without one, llmjudge runs will fail. Returns trial limits, the active provider key (or null if on trial credits), and timestamps.
Assign the LLM provider key used to run llmjudge evaluations team-wide. Pass keyid (UUID of an existing provider key whose state is 'ok'). Switching the active key affects every llmjudge evaluation that doesn't pin its own key. The key must already be in the 'ok' state — if it isn't, ask the user to validate it from the PostHog UI before retrying.
Add an existing insight to a dashboard. Requires insight ID and dashboard ID. Optionally supports layout and color customization.
Create a new LLM evaluation. For 'llmjudge' type, provide evaluationconfig.prompt and modelconfiguration (provider + model). For 'hog' type, provide evaluationconfig.source (Hog code returning a boolean). When enabled, the evaluation runs automatically on new $aigeneration events. Results appear as '$aievaluation' events.
Update an existing LLM evaluation (partial update). Toggle enabled/disabled, update the evaluation config (prompt or Hog source), or change the model configuration.
Create an insight from a query that you have previously tested with 'query-run'. You should check the query runs, before creating an insight. Do not create an insight before running the query, unless you know already that it is correct (e.g. you are making a minor modification to an existing query you have seen).
Create a new LLM prompt for the current team. Requires a unique name and prompt content (string or JSON object).
Get possible values for a specific log attribute. Use this to discover what values exist for a given attribute key, which helps when building log queries with filters.
Generate an AI-powered summary of LLM evaluation results for a given evaluation config. Pass an evaluationid and an optional filter ("all", "pass", "fail", or "na") to scope which runs are analyzed. Returns an overall assessment, pattern groups for passing, failing, and N/A runs (each with title, description, frequency, and example generation IDs), actionable recommendations, and run statistics. Optionally pass generationids to restrict the analysis to specific runs. Results are cached for one hour — use forcerefresh to recompute. Rate-limited; requires AI data processing approval for the organization.
Update an existing data warehouse saved query (view). Can change the name, HogQL query, or sync frequency. Changing the query triggers column re-inference and sets the status to 'modified'. Use syncfrequency to control materialization schedule: '24hour', '12hour', '6hour', '1hour', '30min', or 'never'. IMPORTANT: when updating the query field, you must first retrieve the view to get its latesthistoryid, then pass that value as editedhistoryid for conflict detection.
Soft-delete an LLM evaluation. The evaluation stops running and is hidden from list views. Historical evaluation results ($aievaluation events) are preserved.
Generate an AI-powered summary of an LLM trace or generation. Pass a traceid or generationid with a datefrom — the backend fetches the data and returns a structured summary with title, flow diagram, summary bullets, and interesting notes. Results are cached. Use mode "minimal" (default) for 3-5 points or "detailed" for 5-10 points. Rate-limited; requires AI data processing approval for the organization.
Search and query logs in the project. Supports filtering by severity levels (trace, debug, info, warn, error, fatal), service names, date range, and free text search. Returns log entries with their attributes, timestamps, and trace information. Supports pagination via cursor.
Demo tool for testing MCP Apps SDK integration. Returns sample data that is displayed in an interactive UI app. Use this to verify that MCP Apps are working correctly.
Get all insights in the project with optional filtering. Can filter by saved status, favorited status, or search term.
List available log attributes in the project. Use this to discover what attributes you can filter on when querying logs. Supports filtering by attribute type (log or resource) and searching by attribute name.
Partially update an evaluation report configuration. Toggle enabled/disabled, update delivery targets (email or Slack), or switch frequency between 'everyn' and 'scheduled'. For 'everyn' mode set triggerthreshold (10–10000) and optionally cooldownminutes (60–1440); for 'scheduled' mode set rrule and startsat. Set deleted=true to soft-delete the config.
Get the details of the active organization.
Get the organizations the user has access to.
Create an evaluation report configuration. Reports summarize recent evaluation runs (using AI).
Soft-delete an evaluation report configuration. The report stops firing and is hidden from list views; historical report runs are preserved. Equivalent to calling evaluation-report-update with deleted=true — that update path is the canonical way to soft-delete and is the only option when you also want to change other fields in the same call.
List all data warehouse saved queries (views) in the project. Returns each view's name, materialization status, sync frequency, column schema, latest error, and last run timestamp. Use this to discover available views before querying them in HogQL.
Get a specific data warehouse saved query (view) by ID. Returns the full view definition including the HogQL query, column schema, materialization status, sync frequency, and run history metadata.
Get the 5 most recent materialization run statuses for a saved query. Each entry includes the run status and timestamp. Use this to monitor whether materialization is running successfully.
Use this tool to update the status of an error tracking issue. Valid statuses are: active, resolved, archived, suppressed, or pendingrelease.
Add a trace to a review queue as a pending trace review assignment. Requires queueid and traceid. Fails if the trace already has an active review or is already pending in any review queue.
Remove a pending trace review assignment from review queues. This soft-deletes the queue item so the trace can be queued again later if needed.
Use this tool to get the details of an error in the project.
Use this tool to list errors in the project.
List pending trace review assignments across review queues. Supports filtering by queueid, traceid, traceidin, search, and ordering so agents can find traces that are still queued for review.
Retrieve a single pending trace review assignment by ID. Returns the owning queue, traceid, creator, and timestamps for the pending review task.
Delete a review queue by ID. This soft-deletes the queue and soft-deletes all active pending assignments that still belong to it.
Retrieve a specific clustering job configuration by ID. Returns the job name, analysis level (trace or generation), event filters, enabled status, and timestamps.
List review queues used for trace reviews. Returns queue names, pendingitemcount, creator info, and timestamps. Supports queue-name search and ordering.
Rename an existing review queue. The updated name must stay unique among active queues in the project.
Retrieve a review queue by ID. Returns its name, current pendingitemcount, creator, and timestamps.
Save a trace review. Supports an optional comment, an optional scores array, and an optional queueid to clear a matching pending review-queue item after the review is saved.
Delete a trace review by ID. This soft-deletes the review so the same trace can be reviewed again later if needed.
List saved trace reviews. Supports filtering by traceid, definitionid, search, and ordering. Returns comments, scores, reviewers, and timestamps.
Update a trace review. Pass comment and/or the full desired scores array. You can also pass queueid to clear only a matching pending queue item after the review is saved.
Retrieve a saved trace review by ID. Returns the traceid, comment, scores, creator, reviewer, and timestamps.
Create a new data warehouse saved query (view). If a view with the same name already exists, it will be updated instead (upsert behavior). The query must be valid HogQL. After creation, the view can be referenced by name in other HogQL queries.
Delete a data warehouse saved query (view) by ID. This is a soft delete — the view is marked as deleted and will no longer appear in lists or be queryable in HogQL. Any materialization schedule is also removed. Cannot delete views that have downstream dependencies or views from managed viewsets.
Trigger a manual materialization run for a saved query. This immediately refreshes the materialized table with the latest data. The view must already be materialized. Use 'warehouse-saved-queries-run-history-retrieve' to check run status.
Undo materialization for a saved query. Deletes the materialized table and removes the sync schedule, reverting the view back to a virtual query that runs on each access. The view definition itself is preserved. Rate limited.
Enable materialization for a saved query. This creates a physical table from the view's query and sets up a 24-hour sync schedule to keep it refreshed. Materialized views are faster to query but use storage. Use 'warehouse-saved-queries-revert-materialization-create' to undo. Rate limited.
Duplicate an existing LLM prompt under a new name. Copies the latest version's content to create a new prompt at version 1. Useful for forking a prompt or as a way to rename since names are immutable after creation.
Publish a new version of an existing LLM prompt by name. Name is immutable after creation.
List all clustering job configurations for the current team (max 5 per team). Each job defines an analysis level (trace or generation) and event filters that scope which traces are included in clustering runs. Cluster results are stored as $aitraceclusters and $aigenerationclusters events — use docs-search or execute-sql to query them.
List all error tracking issues in the project. Returns issues with id, status, name, first seen timestamp, and assignee info.
Get a specific LLM evaluation by its UUID. Returns the full evaluation configuration including type, config, output type, enabled status, and model configuration.
Unregister the webhook with the external service and delete the PostHog HogFunction that was handling it. Any webhook-type schemas under the source will stop receiving real-time events. The source and its schemas are preserved — only the webhook is removed. After deletion, schemas can be switched to a polling synctype (incremental/fullrefresh) via external-data-schemas-partial-update, or a new webhook can be created with create-webhook.
Get a specific LLM prompt by name. Uses the cached endpoint for fast retrieval.
List all LLM prompts stored for the current team. Optionally filter by name. Returns paginated prompt summaries. By default, only prompt metadata is returned, not full prompt content. Every result also includes outline, a flat list of markdown headings parsed from the prompt — use it as a lightweight table of contents, and pair with content=none to keep responses small.
List all LLM evaluations for the current project. Optionally filter by name/description search or enabled status. Evaluations automatically score $aigeneration events for quality, relevance, safety, and other criteria. Two types are supported: 'llmjudge' (LLM scores outputs against a prompt) and 'hog' (deterministic Hog code). Results are stored as '$aievaluation' events.
Manually trigger an evaluation run for a specific $aigeneration event. Enqueues a Temporal workflow that asynchronously executes the evaluation and stores the result as a '$aievaluation' event. Returns a workflowid and status "started". Pair with execute-sql to query results: SELECT FROM events WHERE event = '$aievaluation'.
List all evaluation report configurations for the current project. Optionally filter by evaluation UUID using the 'evaluation' query param. Each report config controls how and when evaluation summary reports are generated and delivered (email or Slack).
Get a specific evaluation report configuration by UUID. Returns the full config including frequency, delivery targets, trigger thresholds, and schedule settings.
Immediately trigger an AI-generated evaluation report for this report config. Enqueues a Temporal workflow that analyzes recent evaluation runs and delivers the report to configured targets (email or Slack). Returns 202 on success. Duplicate requests within the same minute are coalesced — only one report is generated. Rate-limited by dailyruncap.
List the run history for a specific evaluation report config. Each run record includes the generated report content, the evaluation period covered, delivery status ('pending', 'delivered', 'failed'), and any delivery error details.
Get a specific error tracking issue by ID. Returns full issue details including status, description, volume, and metadata. After retrieving an issue, consider using query-session-recordings-list with an event filter for $exception to find session recordings of users who hit this error.
Remove a bundled file from an agent skill by path. Fails with 404 if the file is not in the latest version. Publishes a new skill version and returns 200 with the updated skill body (not 204) — read its 'version' field to chain further edits via baseversion. Supply baseversion for optimistic concurrency.
List the provider+model combinations supported for llmjudge evaluations. Pass a provider query parameter (one of openai, anthropic, gemini, openrouter, fireworks, azureopenai) and optionally keyid to scope the list to deployments reachable with a specific provider key (mainly relevant for azureopenai). Each entry returns the model id and whether it is available on PostHog trial credits. Call this before creating an llmjudge evaluation when the user has not specified a model, so a valid provider+model combination is chosen.
Classify sentiment of LLM trace or generation user messages as positive, neutral, or negative. Pass a list of trace or generation IDs and an analysislevel ("trace" or "generation"). Returns per-ID sentiment labels with confidence scores and per-message breakdowns. Results are cached — use forcerefresh to recompute. Rate-limited.
Update the execution order of transformation functions. Send an 'orders' object mapping function UUIDs to their new executionorder integer values. Only applies to functions with type=transformation. Returns the updated list of transformations.
Trigger a sync for a single table schema using its configured sync method (incremental, full refresh, append, or CDC). Use this to manually sync a specific table without triggering all tables in the source.
Transition many signal reports to the same state in one call — the bulk form of inbox-reports-set-state, for clearing or snoozing a batch of inbox reports without one request per report. Pass ids (1–100 report ids) and a state ('suppressed' to dismiss, 'potential' to snooze/restore); the optional dismissalreason (same canonical codes as the single-report tool), dismissalnote, and snoozefor apply to every id. Each id is processed independently, so the whole call returns 200 even on partial failure: inspect results (one entry per id, in request order) and the transitionedcount / skippedcount / failedcount / notfoundcount summary. An id whose transition isn't allowed from its current status comes back as skipped (the single-report 409) while the rest still go through.
List properties for events or persons. If fetching event properties, you must provide an event name.
Update an existing endpoint by name. Can update the query (auto-creates a new version), description, data freshness, active status, and materialization. Pass version in body to target a specific version for non-query updates.
List active scorers for the current project. By default only active rows are returned — pass archived=true to see only archived scorers. Other filters: kind (categorical, numeric, boolean) and search over name/description. Returns metadata plus the current config snapshot.
List early access features in the current project. Returns name, stage, description, linked feature flag, and creation date for each feature.
Delete a trace review by ID. This soft-deletes the review so the same trace can be reviewed again later if needed.
Update an existing session recording playlist by shortid. Can update name, description, pinned status, and filters. Set deleted to true to soft-delete. The type field cannot be changed after creation. When updating a filters-type playlist, you must include the existing filters alongside other field changes, otherwise the update will fail.
Run a retention query to analyze how many users return over time after performing an initial action. Retention insights show you how many users return during subsequent periods. They're useful for understanding user engagement and stickiness.
Replace an existing signal source config by ID (full update — sourceproduct and sourcetype are required; enabled and config are optional and keep their current values if omitted). Prefer inbox-source-configs-partial-update when you only need to flip enabled or tweak config. Enabling the sessionanalysiscluster source requires the organization to have approved AI data processing.
Partially update an existing signal source config by ID — typically to flip its enabled flag on or off, or to adjust its config. Only the fields you pass are changed. To turn the Signals scout source off for a project, set enabled=false on its signalsscout / crosssourceissue config. Enabling the sessionanalysiscluster source requires the organization to have approved AI data processing.
List support tickets in the project. Supports filtering by status (new, open, pending, onhold, resolved), priority (low, medium, high), channelsource (widget, email, slack), assignee, date range, and search. Results are paginated and ordered by updatedat descending by default. Returns ticket metadata including status, priority, message counts, and timestamps.
Check for additional tools whenever your task might benefit from specialized capabilities - even if existing tools could work as a fallback.
Disable / deactivate a live workflow and stop processing events. Confirm with the user before invoking.
Test-invoke a saved workflow. Pass test event data via globals (typically {event, person, groups}). Async actions (HTTP/email/SMS) are mocked by default; set mockasyncfunctions=false to fire real side effects. Optional currentactionid starts from a specific node. Returns the execution trace.
Low-level create for a data warehouse import source when you need to hand-pick tables and sync types. For most cases prefer 'data-warehouse-source-setup', which validates credentials, discovers tables, applies sensible sync defaults, and creates the source in one call. Use this advanced path only for fine-grained control. The 'schemas' array is NOT a top-level argument — it goes INSIDE 'payload', alongside the credential fields: payload = {<credential fields…>, "schemas": [...]}. Each schemas entry has: name, shouldsync (bool), synctype (incremental/fullrefresh/append), and optionally incrementalfield, incrementalfieldtype, and primarykeycolumns. Build the entries from the rows returned by 'external-data-sources-db-schema' first. Sources back queryable warehouse tables for revenue (Stripe), CRM (Hubspot, Salesforce), support (Zendesk), and your own databases (Postgres, MySQL, BigQuery).
This is a slow tool, and you should only use it once you have tried to create a query using the 'query-run' tool, or the query is too complicated to create a trend / funnel. Queries project's PostHog data based on a provided natural language question - don't provide SQL query as input but describe the output you want. When giving the results back to the user, first show the SQL query that was used, then provide results in easily readable format. You should also offer to save the query as an insight if the user wants to.
Update a project's settings using PATCH semantics — only the fields included in the request body are changed. Use project-get first to inspect current settings. Always confirm changes with the user before applying.
Retrieve a single annotation by ID from the current project. Use this when you already know the annotation ID and want complete details.
List the Slack channels available for a Slack integration. Slack-only — non-Slack integration ids return an error (400 if the integration is otherwise visible, 404 if it isn't). Returns each channel's id, name, isprivate, ismember, isextshared, and isprivatewithoutaccess flags; use ismember to avoid picking channels the bot can't post to. Results are cached for 1 hour (no force-refresh exposed via MCP). Use this to find a channelid when wiring up Slack delivery for an alert — pass the channel id into the cdp-functions-create inputs.channel.value field. Requires the Slack integration's id; use integrations-list (filter by kind=slack) to find it.
Get a specific LLM prompt by name. Uses the cached endpoint for fast retrieval.
Get a log alert configuration by ID. Returns full details including current state, threshold settings, filters, and scheduling information.
Partially update a shared metric. Only name, description, and query are mutable. Edits propagate to every experiment the metric is attached to — REQUIRES EXPLICIT USER CONFIRMATION before changing query or name on a metric attached to running experiments.
Delete a notebook by shortid. The notebook will be soft-deleted and no longer appear in lists.
Return the top-25 services by log volume in the window, each with logcount, errorcount, and errorrate, plus a per-service sparkline. Use this as the entry point when triaging which services are worth alerting on — high volume × non-zero errorrate is the natural alert candidate. Far cheaper than walking attribute-values + per-service counts.
Update an existing notebook by shortid. Can update title, content, and deleted status. IMPORTANT: when updating the content field, you must provide the current version number for optimistic concurrency control. Retrieve the notebook first to get the latest version. If the notebook content is a single ph-markdown-notebook node, preserve that structure and update attrs.markdown with valid markdown instead of replacing it with legacy rich-text blocks.
Create a new usage metric for the project. The metric surfaces on both group and person Customer Analytics profile pages — usage metrics are not scoped to a specific group type. filters accepts two shapes.
List delivery history for a subscription — one row per send attempt. Each entry includes status (starting, completed, failed, skipped), triggertype (scheduled, manual, targetchange), and timestamps (createdat, finishedat). Filter with status=failed to quickly surface failed deliveries. Results are cursor-paginated newest first. contentsnapshot, recipientresults, and error are excluded to avoid leaking recipient identifiers or upstream response bodies that may contain tokens / PII. aireport (the full report markdown) and aireportdiagnostics (per-query debug detail) are also excluded here to keep list responses small — fetch a single delivery with subscriptions-deliveries-retrieve to read the report.
Register the config for a freshly authored signals-scout- skill immediately, without waiting for the coordinator to auto-register it — optionally setting its schedule (runintervalminutes, 30–43200), enabled, and emit (false = dry-run) in the same call. The skill must already exist on the project (author it via the skills store first). Upsert: if a config already exists for the skill, the provided fields are applied to it. Creating an enabled config is activity-logged, since running a scout drives spend.
Tune one scout by its config id: change its schedule (runintervalminutes, 30–43200), enabled, or emit (false = dry-run: the scout runs and logs but writes nothing to the inbox). skillname is fixed. Enabling records who flipped it on and is activity-logged, since running a scout drives spend.
Requires an experiment ID. If you don't have the ID, load the finding-experiments skill to resolve the user's reference first. Load the managing-experiment-lifecycle skill for preconditions and side effects.
Retrieve execution metrics for a specific CDP function by ID. Returns time-series data showing success and failure counts over a configurable interval (hour, day, or week). Use to understand function health, identify failure spikes, and monitor delivery reliability. Supports breakdown by metric kind (success/failure) or name, and time range filtering.
Undo materialization for a saved query. Deletes the materialized table and removes the sync schedule, reverting the view back to a virtual query that runs on each access. The view definition itself is preserved. Rate limited.
Return webhook state for a source: supportswebhooks (is this source type webhook-capable), exists (has a webhook been created), webhookurl (the PostHog endpoint the external service should POST to), schemamapping (external event type → PostHog schema id), and externalstatus (what the remote service reports about the webhook — enabledevents, status, createdat, error). Use this to check whether a webhook is healthy and whether the external registration is still valid.
Use this tool to retrieve the core data warehouse schemas for PostHog tables (events, groups, persons, sessions) and the available data warehouse tables, views, and system tables. Use this to understand the data model before writing HogQL queries.
List signal reports for the current project. A signal report is a cluster of related observations (signals) that PostHog has aggregated into a single issue or trend. Reports surface in the Inbox. Supports filtering by status (potential, candidate, inprogress, pendinginput, ready, resolved, failed, suppressed), free-text search across title and summary, sourceproduct (e.g. errortracking, sessionreplay), suggestedreviewers (PostHog user UUIDs), and taskid (only reports associated with that task — pass your own task id to see which reports you are already working against). For picking up work, filter to ready — earlier statuses are still moving through the pipeline, and pendinginput reports are waiting on a human. Each report's full work log — signal findings (evidence), judgments, and log entries — is readable via inbox-report-artefacts-list; read it before acting on a report. Results are paginated and ordered by '-issuggestedreviewer,status,-updatedat' by default.
Fetch a single LLM trace by its trace ID for deep inspection. Returns the complete trace with all nested events and their full properties — including inputs, outputs, model parameters, costs, and errors. Use after finding a trace via query-llm-traces-list to inspect the complete event tree.
Retrieve a single person by numeric ID or UUID. Returns the person's properties, distinct IDs, and metadata.
Create a new notebook. Provide a title and content. Content is a JSON object representing the notebook's rich text document structure (ProseMirror-based). Returns the created notebook with its shortid.
Get the available filter options for activity logs — scopes, activity types, and users that have logged activity. Useful for building filter UIs or understanding what kinds of activity are tracked.
Run a deep diagnostic on a reverse proxy that's stuck or erroring. Inspects the customer's CNAME, the certificate provider's hostname state, CAA records walked up the DNS tree (the most common stuck-validation cause), HTTP-01 challenge reachability, a live event probe, and certificate expiry. Returns a structured report with each check's status and concrete remediation steps — including the exact DNS records the customer should add when CAA blocks issuance. Use this when proxy-get returns an erroring or timedout status, or whenever a user asks why their proxy isn't working.
Create a new session recording playlist. Set type to 'collection' for a manually curated list or 'filters' for a saved filter view. Collections cannot have filters, and filter playlists must include at least one filter criterion.
Immediately trigger an AI-generated evaluation report for this report config. Enqueues a Temporal workflow that analyzes recent evaluation runs and delivers the report to configured targets (email or Slack). Returns 202 on success. Duplicate requests within the same minute are coalesced — only one report is generated. Rate-limited by dailyruncap.
DEPRECATED: renamed to experiment-list. This alias forwards to experiment-list and will be removed. Call experiment-list directly with the same arguments.
Get a source map symbol set by ID. If you only have a symbol set reference, call error-tracking-symbol-sets-list with the exact ref first.
Run a draft alert configuration against historical logs and return per-bucket results from the full state machine — count, thresholdbreached, state, notification (none/fire/resolve), reason. Use to validate threshold + N-of-M settings before creating an alert. Read-only; no alert records are written. Aim for firecount between 0 and 3 over a -7d lookback for a healthy threshold.
Add a semantic description for a data warehouse table or column. Provide the table id, the columnname (empty string for a table-level description), and the description. The new annotation is recorded as user-edited, which prevents automatic enrichment from overwriting it.
List semantic descriptions of data warehouse tables and columns. Pass ?tableid=<uuid> to scope to one table. Each entry has the columnname (empty string = table-level description), the description, and its source (canonical from the source's API documentation, aigenerated, or useredited). Use this to see what the imported data means before writing SQL against it.
Query log entries with filtering by severity, service name, date range, search term, and structured attribute filters. Supports cursor-based pagination. The response schema (see the tool's typed output) lists every returned field — prefer severitytext over severitynumber / level, and be aware that traceid and spanid return zero-padded strings rather than null when unset.
Use this tool to explore the user's data schema. The user implements PostHog SDKs to collect events, properties, and property values. They are used by users to create insights with visualizations, SQL queries, watch session recordings, filter data, target particular users or groups by traits or behavior, etc. Each event, action, and entity has its own data schema. You must verify that specific combinations exist before using it anywhere else. Events or properties starting from "$" are system properties automatically captured by SDKs. Do not rely on your training data or PostHog defaults for events or properties. Always use this tool to confirm what actually exists in the user's project before referencing any event, property, or property value.
Get feature flags in the current project. Supports list filters including search by feature flag key or name (case-insensitive), then use the returned ID for get/update/delete tools.
Create a new early access feature. A feature flag is automatically created unless featureflagid is provided. Stage determines whether opted-in users get the feature enabled.
Create a new action in the project. Actions define reusable event triggers based on page views, clicks, form submissions, or custom events. Each action can have multiple steps (OR conditions). Use actions to create composite events for insights and funnels. Example: Create a 'Sign Up Click' action with steps matching button clicks on the signup page.
Update a saved heatmap by its shortid. Send only the fields to change — rename via name, change widths, or soft-delete by setting deleted: true (deletion goes through this update, not a destroy call). Changing the url of a 'screenshot' heatmap triggers a fresh render.
Remove a pending trace review assignment from review queues. This soft-deletes the queue item so the trace can be queued again later if needed.
Add persons to a static cohort by their UUIDs. Only works for static cohorts (isstatic: true).
Query trace spans with filtering by service name, status code, date range, and structured attribute filters. Supports cursor-based pagination. Returns spans with uuid, traceid, spanid, parentspanid, name, kind, servicename, statuscode, timestamp, endtime, durationnano, isrootspan, matchedfilter, and attributes (the span-level OTel attribute map, e.g. db.statement, http.url).
Aggregate trace span statistics as a call tree — one row per (parentservice, parentname) → (servicename, name) edge.
Get a single shared metric by ID. Returns the full query JSON (metrictype, source, math, filters, etc.). If you don't have the ID, call experiment-saved-metrics-list first.
Fetch a saved insight by its numeric id or 8-character shortid. Returns the insight metadata and query definition, but NOT the query results. To retrieve the actual data, call the insight-query tool with the same identifier. Optionally accepts variablesoverride and filtersoverride to apply one-off overrides to the returned query definition without mutating the saved insight.
List saved insights in the project with optional filtering by favorited status or search term. Returns metadata only (name, description, tags, dashboards, ownership) — NOT the query results. To retrieve the actual data for any insight in the list, call the insight-query tool with its shortid or numeric id.
Edit the human-facing title and/or summary (description) of a signal report, addressed by id. Both fields are optional — pass only the ones you want to change, but supply at least one. Use this to clarify a report's title or rewrite its summary when you understand the underlying issue better than the auto-generated text does. Every other field (status, weights, priority/actionability judgments) is managed by the signals pipeline and cannot be set here — change a report's state with inbox-reports-set-state and its judgments by appending artefacts with inbox-report-artefacts-create. Returns the full updated report.
Span counts over time — a zero-filled time series for trend and spike analysis.
Returns a pre-digested health report for the PostHog SDKs this project is using. Covers which SDKs are current vs outdated (smart-semver rules with grace periods and traffic-percentage thresholds), per-version breakdowns, and a human-readable reason for each assessment. Use when the user asks about PostHog SDK versions, outdated SDKs, SDK health, version upgrade recommendations, or why events may not be captured due to SDK issues.
Soft-delete a batch export. Stops all future scheduled runs and hides the export from list and get operations. Historic run records remain attached to the deleted export in the database.
Get a specific dashboard by ID. Returns the full dashboard including all tiles with their insights, widget configurations, and layout information. Widget tiles include a widget object with widgettype and config but no live data — use dashboard-widgets-run with tile IDs from this response. Insight results, filters, and query metadata are omitted to save context — use dashboard-insights-run to fetch the actual data for every insight on the dashboard in one call, or insight-query for a single insight. Supports variablesoverride and filtersoverride query params; on this endpoint they affect only the merged filters and variables fields in the response (preview). To execute insights with the same overrides, pass the same query params to dashboard-insights-run.
Retrieve a single subscription by ID.
List the team's subscriptions. Use search to filter by title, insight name (including the auto-generated name of an unnamed insight), or dashboard name. Prompt subscriptions are only matched on their title — the prompt text is not searchable.
Soft-delete a subscription. Stops all future deliveries and returns the subscription with deleted: true. One-way via MCP — there is no restore tool, so re-create the subscription if you need it back. Deleting an prompt subscription additionally requires the query:read scope (the backend gates every write touching a prompt subscription on query access).
Test Hog tagger source code against recent $aigeneration events without saving a tagger. The source should return a tag name string, a list of tag name strings, or null. Optionally pass tags as a whitelist; returned tags outside the whitelist are filtered out. Results include input/output previews, selected tags, stdout reasoning, and any execution error for each sampled event.
Return the full SignalScoutRun row for the given runid, including the agent's end-of-run summary, emittedcount, and emittedfindingids. Status, timestamps, error (full TaskRun error message), and the derived failurereason flow from the linked tasks.TaskRun; emitted findings live as Signal rows queryable by sourceid = run:<runid>:finding:<findingid> (one per id in emittedfindingids). Strictly team-scoped — a UUID belonging to another team returns 404.
Get all cohorts that a specific person belongs to. Requires the personid query parameter.
Create an error tracking alert that fires when an issue is created, reopened, or starts spiking. An alert is a HogFunction with type=internaldestination whose filters.events references one of the three error-tracking lifecycle events. The events themselves are the trigger — there is no threshold or evaluation window to configure.
List registered dashboard widget types with labels, descriptions, and per-type configschema. Use before dashboard-widgets-batch-add to pick a widgettype and shape config. Each type documents its own config keys under configschema (shared keys include limit, orderBy, orderDirection, dateRange, filterTestAccounts, and optional widgetFilters).
DEPRECATED: renamed to skill-update. This alias forwards to skill-update and will be removed. Call skill-update directly with the same arguments.
Delete an error tracking alert by ID (soft delete). The alert stops firing immediately, but the HogFunction row and its execution history are preserved. To re-enable a deleted alert, the user must re-create it; partial-update with enabled=true will not resurrect a soft-deleted alert.
Rename an existing review queue. The updated name must stay unique among active queues in the project.
Requires an experiment ID. If you don't have the ID, load the finding-experiments skill to resolve the user's reference first. Load the managing-experiment-lifecycle skill for preconditions and side effects.
List comments across the project. Filter by scope (Dashboard, FeatureFlag, Insight, etc.) and itemid to find discussions on specific resources. Returns comment content, author, and threading info.
Aggregate trace span statistics grouped by (servicename, name) over a date window.
Creates a new survey in the project. Use this for both in-app surveys and hosted forms. Prefer draft creation by default and do not set startdate unless the user explicitly asks to launch immediately. For in-app surveys, popover is the default unless the user asks for widget or api. For hosted forms, use externalsurvey. Keep surveys short unless the user asks for a longer flow.
Permanently delete a usage metric by id. Pass grouptypeindex: 0 — usage metrics apply to both groups and persons regardless of this value.
Get adaptive-interval bucket counts for a filtered log stream. Returns a flat list of {datefrom, dateto, count} buckets covering the requested window. Modeled on Elasticsearch's autodatehistogram — caller specifies a target bucket count, the engine picks the interval.
Returns aggregated counts of active, non-dismissed health issues for the project, broken down by severity and by kind. Use for a quick overall health check before drilling into specifics with the list tool.
Fetch all spans for a specific trace by its hex trace ID. Returns the full span tree for the trace including parent-child relationships, timing, status information, and each span's attributes map. Each span carries selftimenano — its duration not covered by child spans — so "where did the wall-clock go" is answered by sorting on it: a large selftimenano on a parent span is an uninstrumented gap, not time in any child. Use this to inspect a specific trace in detail after discovering it via the query tool. Set excludeAttributes to true to drop the per-span attributes map (which can hold multi-KB values like db.statement) and keep the payload compact.
List all notebooks in the project. Supports filtering by search term, createdby, lastmodifiedby, datefrom, dateto, and contains. Returns title, shortid, and creation/modification metadata.
Update an error tracking grouping rule's filters by ID. Omit filters to leave them unchanged. Editing the rule also clears any auto-disable state so the rule is re-enabled.
Create an error tracking grouping rule for the current project. Provide required filters, and optionally set assignee and description for the issues this rule creates.
Update the error tracking ingestion settings for the current project. Only the fields you include are applied; omitted fields keep their existing values. Use this to set the project-wide rate limit (projectratelimitvalue events per projectratelimitbucketsizeminutes) and the per-issue rate limit (perissueratelimitvalue events per perissueratelimitbucketsizeminutes). Set a ratelimitvalue to null to remove that limit. WARNING: exception events above a rate limit are dropped at ingestion and cannot be recovered. Lowering a limit silently discards volume — confirm the threshold with the user before reducing it.
Create a reusable shared metric. Requires name (unique per project, case-insensitive) and query (kind='ExperimentMetric', metrictype one of 'mean', 'funnel', 'ratio', 'retention'). Optional: description, tags.
Load the managing-experiment-lifecycle skill for preconditions and side effects.
Requires an experiment ID. If you don't have the ID, load the finding-experiments skill to resolve the user's reference first. Load the managing-experiment-lifecycle skill for preconditions and side effects.
List the persons behind one step of a funnel insight — either those who converted through it or those who dropped off at it.
Get compact details for one Error tracking issue.
Check the health and evaluation status of a feature flag by ID. Returns a status (active, stale, deleted, or unknown) and a human-readable reason explaining the status. The status reflects recent evaluation (whether the flag was called), NOT rollout completeness. To determine whether a flag is fully rolled out / GA, use the returned rollout object: effectivelyfullrollout (true when targeted to everyone with no conditions), hastargetingconditions, maxrolloutpercentage, and ismultivariate.
Return the findings a SignalScoutRun emitted to the inbox, newest first — one row per emit with its description (the finding text as surfaced), weight, confidence, severity, tags, and the deterministic sourceid (run:<runid>:finding:<findingid>) that joins back to the underlying signal. Use this to see what a run actually surfaced, not just how many (emittedcount) or which ids (emittedfindingids). Strictly team-scoped — a run UUID belonging to another team returns 404.
Get a feature flag by ID.
Get day-by-day experiment results for a specific metric. Requires metricuuid and fingerprint as query parameters (both available from the experiment's metrics array — each metric has a uuid and the fingerprint is computed from its configuration).
For a SignalScoutRun, return each emitted finding paired with the inbox report its signal grouped into — the reverse lookup from a scout's emission to the SignalReport it actually produced. One row per emission with its findingid, the deterministic sourceid (run:<runid>:finding:<findingid>), and the linked report (id, title, status) or null when the finding never matched a report (or the report was deleted/suppressed). Use this to see which findings turned into actionable reports, not just what a run surfaced (signals-scout-runs-emissions-list). Requires task:read on top of signalscout:read because it exposes report titles. Strictly team-scoped — a run UUID belonging to another team returns 404.
List pending trace review assignments across review queues. Supports filtering by queueid, traceid, traceidin, search, and ordering so agents can find traces that are still queued for review.
Soft-delete a feature flag by ID in the current project.
Test how a feature flag evaluates for a specific user at an optional point in time. Provides detailed reasoning about why the flag matched or didn't match, including condition analysis and person properties used in evaluation.
Schedule a future change to a feature flag. Supported operations: 'updatestatus' (enable/disable), 'addreleasecondition', and 'updatevariants'. Provide the flag ID as recordid, modelname as "FeatureFlag", a payload with the operation and value, and a scheduledat datetime.
Get a specific function by ID. Returns the full configuration including source code, inputs schema, input values (secrets are masked), filters, mappings, masking config, and runtime status.
Retrieve the authenticated user's own profile and settings — identity (id, uuid, distinctid, email, name), security/auth state, preferences, and notification settings. Pass @me as the UUID to fetch the authenticated user; non-staff callers may only access their own account. This tool deliberately does NOT return organization or project configuration: the nested organization, team, and organizations objects are trimmed to just id and name (no API tokens, members, available features, or project settings). Use project-get for full project details, and the organization-scoped tools for organization details.
Publish a new immutable config version for an existing scorer. Use this whenever the scoring rules change (add/remove categorical options, tweak numeric bounds, rename boolean labels). Existing trace reviews keep their snapshot of the previous version, so historical scores remain stable. The config shape must match the scorer's kind. Each call increments currentversion by one. Pass baseversion (the version number you observed before bumping) for optimistic concurrency — the request returns 409 if another writer already advanced the scorer.
Resolve feature flag IDs to their string keys in one call. Pass ids as a list of integer flag IDs. Returns keys as a mapping of stringified ID to key for the IDs that exist in this project. Useful when you have IDs from another tool (e.g., dependent flags, scheduled changes) and need the keys for downstream calls.
Execution stats for a single workflow by ID: time-series success/failure counts over a configurable interval (hour, day, or week). Use to inspect one workflow's health — failure spikes and reliability trends. For an at-a-glance view across ALL workflows, call workflows-global-stats first, then drill in here. Supports breakdown by metric kind (success/failure) or name, and time range filtering.
Get a single workflow invocation by invocationid, including invocationglobals — the raw triggering payload (event/person/groups) that the run executed against. Use after workflows-list-invocations to inspect exactly what input produced a failure.
At-a-glance health across ALL workflows in one call: per-workflow succeeded/failed counts over a window (after/before, default last 7 days), sorted most-failing first. Start here when debugging — find which workflows are failing, then drill into those with workflows-list-invocations (who it failed for) → workflows-get-invocation (the triggering payload) → workflows-logs (the failing step). Avoids scanning every workflow one at a time. For a single workflow's time-series, use workflows-stats.
List a workflow's individual invocations (one execution per person/event), each collapsed to its final outcome — status, errorkind/errormessage, distinctid, personid, timings. This is the per-recipient failure view: filter status=failed to see who it failed for and why. Filter by distinctid and time range. Distinct from workflows-list-batch-jobs (the dispatch ledger, which has no per-person outcome) — drill from a failed invocation into workflows-logs for the step-by-step trace.
Get a specific workflow by ID. Returns the full workflow definition including trigger, edges, actions, exit condition, variables, and any recurring 'schedules' (read-only here). For a batch workflow, check status=='active' plus an active entry in 'schedules' to confirm it will actually fire.
Delete a review queue by ID. This soft-deletes the queue and soft-deletes all active pending assignments that still belong to it.
Generate an AI-powered summary of boolean AI observability evaluation results for a given evaluation config. Pass an evaluationid and an optional filter ("all", "pass", "fail", or "na") to scope which runs are analyzed. Returns an overall assessment, pattern groups for passing, failing, and N/A runs (each with title, description, frequency, and example generation IDs), actionable recommendations, and run statistics. Optionally pass generationids to restrict the analysis to specific runs. Results are cached for one hour — use forcerefresh to recompute. Rate-limited; requires AI data processing approval for the organization.
Soft-delete multiple feature flags in one call. Provide either ids (explicit list of flag IDs) OR filters (same shape as the list endpoint, e.g., search, active, type, tags), but not both. WARNING: filters can match an unbounded number of flags. Preview matches via the list endpoint before calling this with filters, and prefer explicit ids whenever the user has named specific flags. Flags linked to active experiments, early access features, or that other flags depend on are skipped and reported in errors. Returns deleted (with each flag's rollout state at deletion time) and errors arrays.
Get the latest markdown instructions for a channel (desktop folder).
List all agent skills stored for the current team. Returns skill names and descriptions for discovery — use descriptions to determine which skill to fetch for a given task. Does not return skill body content (use skill-get to fetch full content). To link a user to a skill in the PostHog app, build the URL from the skill name, not its id: /llm-analytics/skills/<name> (e.g. /llm-analytics/skills/pr-shepherd). The id (UUID) is not a valid route segment and will 404.
Retrieve a review queue by ID. Returns its name, current pendingitemcount, creator, and timestamps.
Update an existing annotation by ID. You can change its text (content), when it happened (datemarker, ISO 8601), its visibility scope (project or organization), or its emoji. Only the fields you provide are updated.
Save a trace review. Supports an optional comment, an optional scores array, and an optional queueid to clear a matching pending review-queue item after the review is saved.
Remove a person from a static cohort by their UUID. Only works for static cohorts (isstatic: true). The person must exist in the project. Idempotent: removing a person who exists but is not a member of the cohort succeeds silently.
Update a support ticket. Can change status (new, open, pending, onhold, resolved), priority (low, medium, high), assignee, SLA deadline, escalation reason, and tags. Assignee should be an object with type ('user' or 'role') and id, or null to unassign.
Update the webhook-specific inputs on an already-created webhook — for example when a signing secret has been rotated on the source side, or when the webhook was registered manually and the signingsecret needs to be supplied. Only accepts keys defined in the source type's webhookFields (e.g. Stripe's signingsecret). Fails if no webhook has been created for this source yet — call create-webhook first.
Retrieve execution logs for a specific CDP function by ID. Returns log entries with timestamp, level (DEBUG, LOG, INFO, WARN, ERROR), and message. Use to debug why a destination or transformation is failing or not producing expected results. Supports filtering by log level, text search, time range (after/before), and pagination via limit.
Generate an AI-powered summary of an LLM trace or generation. Pass a traceid or generationid with a datefrom — the backend fetches the data and returns a structured summary with title, flow diagram, summary bullets, and interesting notes. Results are cached. Use mode "minimal" (default) for 3-5 points or "detailed" for 5-10 points. Rate-limited; requires AI data processing approval for the organization.
Manually trigger an evaluation run for a specific $aigeneration event. Enqueues a Temporal workflow that asynchronously executes the evaluation and stores the result as a '$aievaluation' event. Returns a workflowid and status "started". Pair with execute-sql to query results: SELECT FROM events WHERE event = '$aievaluation'.
Retrieve a single channel or item on the desktop surface by id.
Get a specific alert by ID. Returns the full alert configuration including check results, threshold settings, detectorconfig (for anomaly detection alerts), and subscribed users. Check results include anomalyscores, triggeredpoints, and triggereddates for detector-based alerts. By default returns the last 5 checks. Use checksdatefrom and checksdateto (e.g. '-24h', '-7d') to get checks within a time window, and checkslimit to control the maximum returned (default 5, max 500). When date filters are provided without checkslimit, up to 500 checks are returned. Check history is retained for 14 days.
Get the product key the team selected as their primary product during onboarding (e.g. sessionreplay, webanalytics, productanalytics), or null if no primary onboarding product intent has been captured. Use this to bias disambiguation when the user's request is ambiguous about which PostHog product they mean — for example, if their primary product is sessionreplay, treat a vague reference to "watch a session" as referring to a session recording rather than a survey response.
List the repositories accessible to a GitHub integration (by integration ID). Serves the cached repository list from the GitHub App installation. Supports search (case-insensitive name match), limit (default 100, max 500), and offset query parameters. Returns repository id, name, and fullname (owner/repo) plus a hasmore flag. Use this to validate that a repository is accessible to the integration before referencing it (e.g. when creating a GitHub data warehouse source).
Estimated CI dollar cost of one pull request, summed over the jobs of all its workflow runs, with breakdowns per workflow (byworkflow) and per run (byrun). Reach for this instead of summing runner minutes by hand: the estimate already classifies runners (billable self-hosted Linux vs free GitHub-hosted), applies the per-vCPU price ladder, and excludes non-Linux and provider-hosted jobs. jobsavailable is false when the job-level source isn't synced yet — every figure is then zero/null, so check it before trusting a $0.00. estimatedcostusd is null (not zero) when nothing was costable, and unsettledjobs counts billable jobs still running that are left out of the estimate.
Update the markdown body, layout, or color of an existing text tile on a dashboard. Pass the DashboardTile id as tileid (use dashboard-get to look up tile IDs). Only the fields you provide are updated; omitted fields are left unchanged.
The jobs of a single workflow run attempt, each with its status, conclusion, wall-clock durationseconds, runner tier (runnerprovider / runnerlabel), and estimatedcostusd. Use this to see where a run spent its time and money job-by-job, or to find the slow or expensive job in a run. Scoped to one runattempt (the latest unless you pass runattempt) so a re-run's attempts don't merge. estimatedcostusd is null for free GitHub-hosted, non-Linux, or unfinished jobs. Returns an empty list when the job-level source isn't synced yet.
Soft-delete an insight by ID. The insight will be marked as deleted and no longer appear in lists.
Create a new saved insight from a name and query definition. Test queries with query-trends / query-funnel / query-retention / query-paths / query-stickiness / query-lifecycle first to confirm the shape, then save. Returns insight metadata only — after creating, call the insight-query tool with the returned shortid if you want to see the computed results.
Create a holdout group — a reserved slice of users excluded from experiment exposure, used as a held-back baseline. Requires name and a non-empty filters array. Link experiments to it afterwards by passing the returned id as holdoutid on experiment-create or experiment-update. Note that you can't change which holdout an experiment points to once that experiment is running; the holdout itself stays editable (see experiment-holdouts-partial-update, whose edits cascade to all linked experiments).
Update a holdout group's name, description, or filters by ID. Use experiment-holdouts-list first if you don't have the ID.
List your reminders in the current project, including their schedule, status (active/completed/errored), and next fire time.
Soft-delete an AI observability evaluation. The evaluation stops running and is hidden from list views. Historical evaluation results ($aievaluation events) are preserved.
List the persons in one retention acquisition cohort and show, for each, which subsequent intervals they came back in.
Get the latest stored AI summary for a single session by sessionid (any $sessionid from an event). Returns the full summary JSON — segments with a named timeline, per-action abandonment / confusion / exception flags, segment outcomes, the headline sessionoutcome, and optional sentiment — plus exceptioneventids, the extrasummarycontext used at generation time, and runmetadata (LLM model, whether visual confirmation was applied). 404 if no summary has been generated for the session yet. This reads the legacy session-summary store, which is being retired — to create a new summary, use a Replay Vision summarizer scanner via vision-scanners-scan-session rather than this read endpoint.
Update an existing survey by ID. Omitted top-level fields are preserved, but nested objects and arrays you provide may replace existing values. Before changing questions, conditions, appearance, targeting, translations, or hosted-form content, retrieve the survey first and preserve fields that should remain. Do not send null to clear a field unless the user explicitly asked to remove it.
Group spans by one attribute's value — the "what is different about the bad spans?" tool.
Return a secure browser link to connect a data warehouse source WITHOUT the user pasting secrets into the chat. The link opens a minimal page rendering the source's full connection form — the user authorizes via OAuth or enters credentials there, whichever the source offers — and the page stores the connection details encrypted and temporarily; it does NOT create the source. This is the preferred, secure way to collect credentials: share the returned connecturl with the user, wait for them to confirm they're done, then find the stored credential via 'data-warehouse-stored-credentials-list' (filter by sourcetype, newest first) and call 'data-warehouse-source-setup' with {'credentialid': '<uuid>'} in the payload. Stored credentials are single-use and expire after 24 hours. Never ask the user to paste raw database passwords, API keys, or OAuth tokens into the chat.
List credentials the user stored via the 'data-warehouse-source-connect-link' page that haven't been consumed yet. Returns metadata only (credentialid, sourcetype, createdat, expiresat) — never the secrets themselves. Newest first; filter by sourcetype. After the user confirms they've finished the connect page, take the newest credentialid for the source type and call 'data-warehouse-source-setup' with {'credentialid': '<uuid>'} in the payload. Stored credentials are single-use — they are deleted as soon as setup consumes them — and expire after 24 hours if never used.
Summarizes a project's web analytics over a lookback window (default 7 days): unique visitors, pageviews, sessions, bounce rate, and average session duration with period-over-period comparisons, plus the top 5 pages, top 5 traffic sources, and goal conversions. Accepts optional days (1–90, default 7) and compare (bool, default true) query params — pass days=30 to summarize the last month, or compare=false to skip the period-over-period comparison for a faster response. Use this to answer questions like "how are my web analytics?", "how did the site do last week?", or "what's my traffic looking like this month?".
Get a specific survey by ID. Returns the survey configuration including questions, targeting, and scheduling details.
List saved heatmaps for the project. A saved heatmap pins a page URL plus a set of viewport widths and (for type 'screenshot') renders the page so heatmap data can be overlaid on it. Filter by type, status, createdby, or a search substring on URL/name. The rendered page (screenshot with data overlaid) is viewable by the user in the PostHog UI.
List all workflows in the project. Returns workflows with their name, description, status (draft/active/archived), version, trigger configuration, and timestamps.
List the persons behind a paths insight — either everyone who traversed the path, or those at one specific node/edge.
Create a new data warehouse saved query (view). If a view with the same name already exists, it will be updated instead (upsert behavior). The query must be valid HogQL. After creation, the view can be referenced by name in other HogQL queries. Set description to record what the view represents (a semantic description surfaced to agents); per-column descriptions are set via the saved-query column annotation tools.
Create a threshold-based alert on log streams. The alert periodically counts log entries matching the given filters and fires when the count crosses the threshold. Maximum 20 alerts per project.
Create a new external issue in GitHub, GitLab, Linear, or Jira, then link it to a PostHog error tracking issue as an external reference. This tool does not link an existing external issue by URL or key. Provide the error tracking issue id as issue, the connected integration as integrationid, and a config object with provider-specific fields. Examples: Jira config {"projectkey":"ENG","title":"Checkout TypeError","description":"Stack trace and reproduction details"}; Linear config {"teamid":"team-id","title":"Checkout TypeError","description":"Stack trace and reproduction details"}; GitHub config {"repository":"posthog","title":"Checkout TypeError","body":"Stack trace and reproduction details"}; GitLab config {"title":"Checkout TypeError","body":"Stack trace and reproduction details"}. Required config keys by integration kind: github -> {repository, title, body}; gitlab -> {title, body}; linear -> {teamid, title, description}; jira -> {projectkey, title, description}. Use integrations-list first to find the integrationid and kind; use integrations-jira-projects-retrieve, integrations-linear-teams-retrieve, or integrations-github-repos-retrieve when you need provider-specific IDs.
Create a new dashboard. Provide a name and optional description, tags, and pinned status. Can also create from a template or duplicate an existing dashboard. The returned tiles omit insight results to save context — use dashboard-insights-run to fetch the actual data for each insight. To add widget tiles after creation, see dashboard-widget-catalog-list for available widget types and dashboard-widgets-batch-add to add them.
Update a reminder's title, message, schedule, timezone, end date, or attached resource. Changing the schedule recomputes the next fire time.
Trigger a full resync for a table schema, discarding all previously synced data and re-importing from the source. This cancels any running sync first, then resets the pipeline state. Use this when data is corrupt or out of sync.
Enable / activate a draft workflow and start processing events. One-way door: a live workflow can't be edited over MCP (to change it you recreate it as a new draft), so test it first and get the user's explicit approval before invoking. Don't enable on your own initiative.
Publish a new version of an existing agent skill by name. Any field not provided.
Delete a survey by ID (soft delete - marks as archived).
Test-invoke a workflow one node at a time; it does NOT traverse the full graph in one call. The result includes nextActionId. To verify a path end to end, chain calls: start at the trigger (omit currentactionid), then pass the returned nextActionId as currentactionid on the next call, and repeat. To test a specific branch, set currentactionid to that node. Skip delay nodes by jumping to the action after them, since delays are not simulated. Pass test data via globals (typically {event, person, groups}). Async actions (HTTP/email/SMS) are mocked by default; set mockasyncfunctions=false to fire real side effects. Returns the step's execution trace.
Delete one scout config by its id, removing the per-scout schedule/emit row outright. Use it to clean up an orphaned config whose signals-scout- skill was archived or deleted — it lingers in signals-scout-config-list with an empty description and never runs, but can't otherwise be removed. Deletion is activity-logged. Note: if the skill still exists the coordinator re-creates a default-schedule config on its next tick — to retire a live scout, archive its skill (or set enabled=false via signals-scout-config-update to make it inert) rather than deleting the config.
Update an existing action by ID. Can update name, description, steps, tags, and Slack notification settings.
List individual responses for a specific survey. Question text is already resolved server-side — callers do not need to map opaque $surveyresponse<id> property keys. Each row carries distinctid, sessionid, and submittedat so agents can pivot to recordings, persons, or paths in one follow-up call. Use this instead of executing raw SQL against survey sent events.
Create a cohort (a saved group of persons). Two kinds.
Update an existing cohort's name, description, or filters. Changing filters on a dynamic cohort triggers recalculation. To soft-delete a cohort, set 'deleted: true'.
Create an error tracking assignment rule for the current project. Provide filters to match incoming errors and an assignee with type (user or role) plus the matching user ID or role UUID.
Validate credentials against a remote source and return the list of tables available to sync (works for database sources like Postgres/MySQL and SaaS sources like Stripe/Hubspot alike). Pass sourcetype and credential fields in the payload object. Each table entry includes: table name, incrementalavailable, appendavailable, cdcavailable, supportswebhooks, detectedprimarykeys, availablecolumns (name/type/nullable), rows estimate, and incrementalfields (candidate timestamp/integer columns for incremental sync). Use this BEFORE external-data-sources-create so the user can pick a synctype per table. Returns 400 with a message if credentials are invalid.
Reorder tiles on a dashboard by providing an array of tile IDs in the desired display order. First, use dashboard-get to see current tile IDs. By default existing tile widths and heights are preserved; see the layout parameter to force a 2-column or full-width grid instead.
Read a small live sample of rows for one resource (table) of a Custom REST source, so you can verify the manifest's dataselector, primarykey, and incremental cursorpath against real data BEFORE creating the source. Only sourcetype 'Custom' is supported. Pass sourcetype, a payload object ({manifestjson, plus the credential for the manifest's auth type — authtoken | authapikey | authpassword}), the resourcename to sample, and an optional limit (1–50, default 10). Returns {rows, rowcount, columns (name + inferred JSON type), error}. Manifest, validation, and SSRF problems return 400; a live fetch failure returns 200 with error set and empty rows. Use external-data-sources-db-schema first to list the resource names and detected cursors.
Fetches a single health issue by id so you can drill into what's wrong AND explain how to fix it. Alongside the issue's kind, severity, status, and check-specific payload, the detail view adds a human-readable title, a one-line summary of the problem, a link to the relevant page in PostHog, and remediation — fix-it guidance with two fields: remediation.human (how to fix it in the PostHog UI) and remediation.agent (how you should investigate it — often via other tools like execute-sql or docs-search — and, when the fix lives in the user's codebase, how to apply it directly, e.g. bump a PostHog SDK dependency, change a posthog.init option, or add a reverse-proxy route).
Lists health issues detected across all of this project's PostHog health checks — outdated SDKs, data warehouse sync failures, missing web analytics events, ingestion warnings, reverse-proxy and web-vitals problems, and more. Each issue has a kind (which check found it), a severity (critical/warning/info), a status (active/resolved), and a check-specific payload with the detail. Filter by status, severity, kind, or dismissed state. Use when the user asks what's wrong with their PostHog setup, what alerts are firing, why data might be missing, or to drill into one category of problem.
Per-workflow CI health over a window: run count, success rate, p50/p95 duration, and last failure time. Use this for "is CI getting faster or slower", "which GitHub Actions workflow is the slow or flaky long pole", and CI duration trends. Rates and percentiles are over completed runs only and are null for a window with no completed runs; to get a trend, call this over two adjacent windows and compare.
One workflow's estimated CI cost broken down by runner tier over a window (datefrom default -30d), highest spend first. Each row is a tier (provider + runnerlabel) with its jobcount, billableminutes, and estimatedcostusd. Use this for "which runner tier drives this workflow's CI bill" and to spot oversized runners. Billable self-hosted Linux tiers carry a cost; github-hosted and non-Linux rows are null. Returns an empty list when the job-level source isn't synced yet.
Create a new agent skill. Requires a unique kebab-case name (lowercase letters, numbers, hyphens), a description explaining when to use it, and the skill body (SKILL.md instruction content as markdown). Optionally include license, compatibility, allowedtools, metadata, and bundled files.
Re-inspect the source for a single table schema and return the currently available incremental fields, detected primary keys, column list, and which sync methods (incremental/append/cdc/webhook) are available. Use this when the source schema has changed, an incremental field has been dropped, or the user wants to switch to a different incrementalfield/synctype on an existing schema. The operationid is externaldataschemasincrementalfieldscreate but semantically this is a read-only refresh.
List source map symbol sets for the current project. Supports pagination plus filtering by exact ref or upload status (valid, invalid, or all) and sorting with orderby. Each result includes hasuploadedfile so you can tell whether the download tool will work.
Add a new bundled file to an agent skill. Fails with 409 if a file at the given path already exists — use skill-update with files to replace, or skill-file-delete followed by skill-file-create to overwrite. Publishes a new skill version and returns the updated skill (read its 'version' field to chain further edits via baseversion). Supply baseversion for optimistic concurrency.
Create a saved heatmap for a page URL. For type 'screenshot' (the default) this enqueues a headless render of the page at each target width — poll heatmaps-saved-get until status is 'completed'; the rendered page (with data overlaid) is then viewable by the user in the PostHog UI. Provide widths (CSS px, 100-3000) to control which viewports are rendered, or omit it for sensible defaults. The URL must be exact — wildcards are not allowed.
Publish a new version of a channel's markdown instructions, describing what the channel contains. The id is the channel (folder) id. Each call creates a new version. To erase a channel's instructions, publish empty content — this clears the text while keeping the instruction set in place (the instruction set itself cannot be deleted).
Returns a pre-digested health report for the PostHog SDKs this project is using. Covers which SDKs are current vs outdated (smart-semver rules with grace periods and traffic-percentage thresholds), per-version breakdowns, and a human-readable reason for each assessment. Use when the user asks about PostHog SDK versions, outdated SDKs, SDK health, version upgrade recommendations, or why events may not be captured due to SDK issues.
Return SignalScratchpad entries for this project, newest first. Pass text for a case-insensitive substring match on the entry's content and key. Pass datefrom / dateto (ISO-8601, inclusive lower / exclusive upper bound on updatedat) to scope to a window — set dateto to the updatedat of the oldest entry from the prior page to walk past the cap. Pass keysonly=true to scan which memories exist without pulling their (potentially large) bodies, or contentmaxchars to cap each content to a preview — both keep a wide orientation/dedupe scan from returning every entry's full prose. Results capped at 500.
Soft-delete an evaluation report configuration. The report stops firing and is hidden from list views; historical report runs are preserved. Equivalent to calling llma-evaluation-report-update with deleted=true — that update path is the canonical way to soft-delete and is the only option when you also want to change other fields in the same call.
Broadcast a batch workflow to its matching users NOW — sends real messages/webhooks, not a test. Workflow must be enabled. STOP before calling: show the user the audience size from workflows-blast-radius and get their explicit confirmation in a separate turn — never size and fire in one step. Requires acknowledgedaffectedcount from workflows-blast-radius; rejects on drift or over the cap.
Fallback editor. Prefer workflows-patch-graph for graph changes: it sends only the delta, is structurally validated, and returns the full updated graph. Reach for workflows-update for top-level metadata a patch can't express (name, description, exitcondition), or as an escape hatch to replace the whole workflow when you can't get workflows-patch-graph to land a change. Draft only: active workflows are read-only via MCP (editing risks breaking already-scheduled runs), so create a new draft to change a live one. Status changes go through workflows-enable / workflows-archive.
Update a recurring schedule's RRULE, start time, timezone, or variable overrides. Changing the cadence reschedules the next run. Each firing re-broadcasts to the workflow's current trigger audience.
Get a specific change request by ID, including the full intent, policy snapshot, approval votes, and current state.
Retrieve execution logs for an endpoint by name. Each run emits one entry with a timestamp, level (INFO or ERROR), and a message whose extra data is in key=value tokens (path=materialized|inline|ducklake, cache=hit|miss, durationms=, rows=, version=, error=). Filter by level (e.g. "ERROR"), text search (e.g. "cache=miss"), time range (after/before), a specific execution (instanceid), and limit (max 500). Use to debug why an endpoint failed, timed out, missed cache, or returned unexpected row counts.
27 native integrations. 3,200+ tools via managed connectors. Most are one-click OAuth, some use API keys - Viktor handles auth and starts working. No webhooks, no Zapier zaps.
Message Viktor in Slack like you'd message a teammate. "Pull this week's activation funnel from PostHog and flag the biggest drop-off." "Investigate why a key metric dropped in PostHog last week and report what you find." Plain English, any tool.
Viktor opens PostHog, runs the work, and posts back what changed. Sensitive actions wait for your approval. Everything is logged. You stop doing the work and start reviewing it.
A PostHog AI agent is an AI that connects to your PostHog account and completes work in it - it doesn't just answer questions about PostHog, it takes the actions. Viktor is that agent: an AI employee that works in PostHog on your behalf and delivers the finished result in Slack or Microsoft Teams.
Unlike workflow builders such as Zapier or Make, there is nothing to configure - no triggers to map, no workflows to maintain. You describe the outcome in plain English, and Viktor picks the right PostHog actions, chains them with the other 3,200+ tools it connects to, and asks for approval before anything sensitive runs.
Product analytics and feature flags (US cloud)
Native integration - Viktor handles authorization itself, never sees your password, and you can revoke access at any time.
Review-first approvals: sensitive PostHog actions wait for your sign-off before they run.
Isolated compute per team, encrypted in transit and at rest - and your data is never used to train models.
SOC 2 Type 1 compliant, with Type 2 and ISO 27001 in progress.
Yes. PostHog is one of the 3,200+ tools Viktor connects to, as one of Viktor's native, deepest integrations. Once connected, anyone on your team can put Viktor to work in PostHog from Slack or Microsoft Teams - no workflow builder, no code.
Ask for outcomes that span tools — Viktor pulls from PostHog, cross-references the rest of your stack, and delivers one finished result.
Viktor connects to 3,200+ tools and works across them in a single run.
