FerentinFerentin
PostHog logo

PostHog

Generally Available

Once OAuth2 authorization is granted, an AI agent can run analytics queries, review session replays, and manage feature flags to investigate product behavior.

  • Product Analytics
  • Session Replay
  • Feature Flags
Configure PostHogBrowse the 114 tools
Authentication
OAuth 2.0
Authorization
Enterprise-managed
Hosting
Vendor-hosted endpoint
Required scopes
115

How it works

Every agent request passes through Ferentin policy before it reaches PostHog.

  1. AI agentAsks for something
  2. Ferentin policies
    • OAuth 2.0 consent
    • Granular scope selection
    • Audit logging
  3. PostHog MCP serverAuthorized connection
  4. Governed resultMasked, logged, returned

What agents can do

114 tools · you choose which ones agents may call

Search and browse what exists, without opening the content itself.

  • List tracing attribute values
  • List tracing span attributes
  • List tracing service names
  • List all cohorts
  • List dashboard widget catalog
  • Search documentation
  • List error tracking alerts
  • Get all experiments
  • List shared experiment metrics
  • List heatmap interactions for a page
  • List saved heatmaps
  • Query insight
  • Get all insights
  • List clustering jobs
  • List evaluations
  • List evaluation report configs
  • List prompts
  • List review queue items
  • List taggers
  • List trace reviews
  • List alert events
  • List log alerts
  • List log attribute values
  • List log attributes
  • Query logs sparkline
  • List persons
  • Query tracing spans
  • Query error tracking issue
  • Query error tracking issue events
  • Query error tracking issues list
  • Get LLM trace
  • Query logs
  • List scheduled changes for feature flags
  • List session recording playlists
  • List session summaries
  • List individual survey responses with resolved question text.
  • List usage metrics

Permissions requested

The OAuth 2.0 scopes PostHog asks you to approve when you connect.

ScopeAccess
action:readRead
action:writeElevated
account:readRead
account:writeElevated
activity_log:readRead
agents:readRead
agents:writeElevated
alert:readRead
alert:writeElevated
annotation:readRead
annotation:writeElevated
approvals:readRead
batch_export:readRead
batch_export:writeElevated
business_knowledge:readRead
business_knowledge:writeElevated
cohort:readRead
cohort:writeElevated
comment:readRead
dashboard:readRead
dashboard:writeElevated
early_access_feature:readRead
early_access_feature:writeElevated
endpoint:readRead
endpoint:writeElevated
engineering_analytics:readRead
error_tracking:readRead
error_tracking:writeElevated
evaluation:readRead
evaluation:writeElevated
event_definition:readRead
event_definition:writeElevated
experiment:readRead
experiment:writeElevated
experiment_holdout:readRead
experiment_holdout:writeElevated
experiment_saved_metric:readRead
experiment_saved_metric:writeElevated
external_data_source:readRead
external_data_source:writeElevated
feature_flag:readRead
feature_flag:writeElevated
file_system:readRead
file_system:writeElevated
group:readRead
health_issue:readRead
heatmap:readRead
heatmap:writeElevated
hog_flow:readRead
hog_flow:writeElevated
hog_function:readRead
hog_function:writeElevated
insight:readRead
insight:writeElevated
insight_variable:writeElevated
integration:readRead
integration:writeElevated
llm_analytics:readRead
llm_analytics:writeElevated
llm_prompt:readRead
llm_prompt:writeElevated
llm_provider_key:readRead
llm_skill:readRead
llm_skill:writeElevated
logs:readRead
logs:writeElevated
marketing_analytics:readRead
mcp_analytics:readRead
mcp_analytics:writeElevated
metrics:readRead
notebook:readRead
notebook:writeElevated
organization:readRead
organization:writeElevated
organization_member:readRead
person:readRead
person:writeElevated
project:readRead
project:writeElevated
property_definition:readRead
query:readRead
replay_scanner:readRead
replay_scanner:writeElevated
session_recording:readRead
session_recording:writeElevated
session_recording_playlist:readRead
session_recording_playlist:writeElevated
signal_scout:readRead
signal_scout:writeElevated
subscription:readRead
subscription:writeElevated
survey:readRead
survey:writeElevated
tagger:readRead
tagger:writeElevated
ticket:readRead
ticket:writeElevated
task:readRead
task:writeElevated
tracing:readRead
field_note:readRead
field_note:writeElevated
usage_metric:readRead
usage_metric:writeElevated
user:readRead
user:writeElevated
user_interview:readRead
user_interview:writeElevated
visual_review:readRead
visual_review:writeElevated
warehouse_table:readRead
warehouse_table:writeElevated
warehouse_view:readRead
warehouse_view:writeElevated
web_analytics:readRead

Enterprise-Managed Authorization

PostHog's authorization server accepts an identity assertion from your identity provider (an ID-JAG) in place of a per-user OAuth consent.

That puts access to PostHog in your identity provider: groups and policy there decide who may reach it, rather than each person approving a consent screen.

Seen in PostHog's OAuth authorization-server metadata on 24 Oct 2026. That says the server implements the grant; which identity providers it accepts is set up with PostHog.

See all 13 integrations that support it

Before you connect

  • 27 tools across 7 categories: Insights (HogQL queries), Dashboards, Feature Flags, Experiments (A/B tests), Error Tracking, SQL/Query, and Documentation search.
  • Two authentication modes: OAuth2 (user mode, interactive per-user consent via oauth.posthog.com with dynamic client registration + PKCE S256 + refresh tokens) and Personal API Key (agent mode, Bearer).
  • Scopes are resolved per tool from the granted scopes; the 'MCP Server' Personal API Key preset grants the right set, and the OAuth consent screen requests the equivalent scopes.
  • Self-hosted PostHog instances set a different base URL; this card targets PostHog Cloud (mcp.posthog.com / oauth.posthog.com).
2 more technical notes
  • The tool catalog populates on first live connection (tools/list against the upstream).
  • Upstream tool filtering: append '?features=...' and/or '?tools=...' to the MCP Server URL (see URL options) to limit which tools PostHog exposes. This is enforced by PostHog before tools/list; Ferentin's own MCP policy and PENDING_REVIEW drift gate still apply on top.

About PostHog

PostHog is an all-in-one product analytics platform combining event analytics, session replay, feature flags, and experimentation.

WebsiteDeveloper docs

Frequently asked about PostHog

What can AI agents do with PostHog through Ferentin?
Ferentin exposes 114 PostHog MCP tools to your AI agents, grouped as Discover (37 tools), Access (48 tools) and Manage (8 tools). Every call is checked against your Ferentin policies before it reaches PostHog.
How is PostHog access secured?
Requests through the PostHog integration are covered by OAuth 2.0 consent, granular scope selection and audit logging. These controls are applied by Ferentin, not by PostHog, so they hold across every connected agent.
What permissions does the PostHog integration require?
The PostHog integration requests 115 OAuth 2.0 scopes: action:read (read access); action:write (elevated access); account:read (read access); account:write (elevated access); activity_log:read (read access); agents:read (read access); agents:write (elevated access); alert:read (read access); alert:write (elevated access); annotation:read (read access); annotation:write (elevated access); approvals:read (read access); batch_export:read (read access); batch_export:write (elevated access); business_knowledge:read (read access); business_knowledge:write (elevated access); cohort:read (read access); cohort:write (elevated access); comment:read (read access); dashboard:read (read access); dashboard:write (elevated access); early_access_feature:read (read access); early_access_feature:write (elevated access); endpoint:read (read access); endpoint:write (elevated access); engineering_analytics:read (read access); error_tracking:read (read access); error_tracking:write (elevated access); evaluation:read (read access); evaluation:write (elevated access); event_definition:read (read access); event_definition:write (elevated access); experiment:read (read access); experiment:write (elevated access); experiment_holdout:read (read access); experiment_holdout:write (elevated access); experiment_saved_metric:read (read access); experiment_saved_metric:write (elevated access); external_data_source:read (read access); external_data_source:write (elevated access); feature_flag:read (read access); feature_flag:write (elevated access); file_system:read (read access); file_system:write (elevated access); group:read (read access); health_issue:read (read access); heatmap:read (read access); heatmap:write (elevated access); hog_flow:read (read access); hog_flow:write (elevated access); hog_function:read (read access); hog_function:write (elevated access); insight:read (read access); insight:write (elevated access); insight_variable:write (elevated access); integration:read (read access); integration:write (elevated access); llm_analytics:read (read access); llm_analytics:write (elevated access); llm_prompt:read (read access); llm_prompt:write (elevated access); llm_provider_key:read (read access); llm_skill:read (read access); llm_skill:write (elevated access); logs:read (read access); logs:write (elevated access); marketing_analytics:read (read access); mcp_analytics:read (read access); mcp_analytics:write (elevated access); metrics:read (read access); notebook:read (read access); notebook:write (elevated access); organization:read (read access); organization:write (elevated access); organization_member:read (read access); person:read (read access); person:write (elevated access); project:read (read access); project:write (elevated access); property_definition:read (read access); query:read (read access); replay_scanner:read (read access); replay_scanner:write (elevated access); session_recording:read (read access); session_recording:write (elevated access); session_recording_playlist:read (read access); session_recording_playlist:write (elevated access); signal_scout:read (read access); signal_scout:write (elevated access); subscription:read (read access); subscription:write (elevated access); survey:read (read access); survey:write (elevated access); tagger:read (read access); tagger:write (elevated access); ticket:read (read access); ticket:write (elevated access); task:read (read access); task:write (elevated access); tracing:read (read access); field_note:read (read access); field_note:write (elevated access); usage_metric:read (read access); usage_metric:write (elevated access); user:read (read access); user:write (elevated access); user_interview:read (read access); user_interview:write (elevated access); visual_review:read (read access); visual_review:write (elevated access); warehouse_table:read (read access); warehouse_table:write (elevated access); warehouse_view:read (read access); warehouse_view:write (elevated access); web_analytics:read (read access)
How do I connect PostHog to Ferentin?
Open the Ferentin admin console, add PostHog as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the PostHog integration generally available?
Yes. The PostHog integration is generally available on Ferentin, including the free tier.

Related integrations

3
Amplitude logo
GA

Amplitude

Query product usage, funnels, and behavioral cohorts so agents can surface adoption and retention insights on demand.

MCP ServersEnterprise-managed
View
Mixpanel logo
GA

Mixpanel

Analyze events, funnels, and retention across your product so agents can answer engagement questions conversationally.

MCP Servers
View
Statsig logo
GA

Statsig

Run experiments, manage feature flags, and read product metrics so agents can drive and evaluate feature rollouts.

MCP ServersEnterprise-managed
View