Klaviyo, Claude and MCP: Auditing an Account Read-Only

Short answer. MCP is an open standard that lets an AI client such as Claude query an external system through tools declared by a server. Klaviyo publishes its own MCP server, and that server accepts a read-only=true parameter that disables every write tool. In read-only mode, you get the full inventory of an account (flows, segments, lists, metrics, campaign and flow reports) with no action able to touch the database or trigger a send.

It is the only configuration we agree to connect to a client account. The rest of this article explains what it actually delivers, where it stops, and why the restriction is an operating choice rather than a technical constraint.

What MCP is, without the varnish

The Model Context Protocol is described by its documentation as an open source standard for connecting AI applications to external systems: data sources, tools, workflows.

The architecture distinguishes three roles. The host is the AI application. The client is the component that maintains a connection to a server, one client per server. The server is the program that exposes context and tools. Communication runs through a data layer based on JSON-RPC 2.0 and a transport layer, with two documented transports: STDIO for servers running locally on the same machine, Streamable HTTP for remote servers.

The point that matters for a CRM practitioner sits elsewhere. MCP tools are, per the specification, model-controlled: the model discovers and invokes them on its own, based on context and the request. The same page carries an explicit warning: for safety and security reasons, there should always be a human in the loop able to refuse a tool invocation.

In other words, connecting an MCP server to a marketing tool amounts to handing a model a list of functions it will choose to call by itself. What that list contains therefore becomes the real configuration question.

Klaviyo's official MCP server

Klaviyo documents its own server in two variants.

The remote variant, presented as the recommended one, is reached at https://mcp.klaviyo.com/mcp, over OAuth with dynamic client registration and Streamable HTTP transport. Klaviyo specifies that the feature is only available to users with an Owner, Admin or Manager role on the account.

The local variant launches via uvx klaviyo-mcp-server@latest and authenticates with a private key passed through the PRIVATE_API_KEY environment variable. Klaviyo provides the table of scopes to tick on that key to get every tool: Accounts read, Campaigns full, Catalogs read, Events full, Flows read, and so on.

On the Claude side, the wiring is the same as for any remote server: the Claude Code documentation describes claude mcp add --transport http <name> <url> for HTTP servers. The same page carries a warning worth reading before connecting anything to a client account: make sure you trust the server, because a server that fetches external content exposes you to prompt injection risk.

The setting that changes everything: read-only=true

The remote server accepts query parameters that control its behaviour. The most important one, as Klaviyo documents it: read-only defaults to false, and setting it to true disables every tool capable of performing a write action on the account. On the local server, the equivalent is the READ_ONLY environment variable.

Three other parameters are worth knowing:

• disable-tools-with-user-generated-content disables tools that read content written by the account's users. Klaviyo pairs the default setting with an instruction to review each tool call carefully, so the client does not act on malicious instructions.
• core-tools-only limits the server to roughly 40 so-called core tools, which reduces the number of tools loaded into the client.
• toolsets restricts exposure to tools whose required scopes all appear in the list you provide, in resource:access format, for example toolsets=profiles:read,campaigns:read.

Combining read-only=true with a toolsets list limited to read scopes yields a server whose action surface is reduced to what you explicitly allowed. That is the audit configuration.

What a read-only MCP actually lets you audit

The tools table Klaviyo publishes flags the non-mutating ones with a Read Only column. That perimeter covers most of an account diagnostic.

The inventory. get_flows lists the flows, get_flow returns the detail, get_flow_action goes down to the level of a single action. get_segments and get_lists do the same work on groups, with get_flows_triggered_by_segment and get_flows_triggered_by_list to connect a group to the flows it triggers. This is exactly the map you rebuild by hand in a classic Klaviyo audit.

The reporting. get_campaign_report and get_flow_report return campaign and flow performance reports. query_segment_values and query_segment_series query segment membership, as a value and over time. query_form_values and query_form_series do the equivalent on signup forms.

Events and metrics. get_metrics lists the metrics, query_metric_aggregates aggregates the event data attached to a metric, get_events and get_profiles go down to the unit level.

In practice, this is enough to answer the questions that structure an audit: which flows are live and which no longer are, which segments trigger what, how revenue splits between flows and campaigns, which exclusion segments exist and are actually wired in, what the capture structure looks like. It is an accelerator for the survey work, not a replacement for judgement.

What it does not allow

Three limits worth stating plainly.

No modification. In read-only mode, every write tool is out of circuit: the create_, update_, delete_, bulk_ tools and campaign sending disappear from the exposed list. That is the point, but it means an MCP audit produces findings and a fix list, never a fixed account.

No access to what the API does not expose. The MCP server is a facade over the endpoints of Klaviyo's API reference. What is not in there will not come out of the server, however the request is phrased.

No exemption from rate limits. Klaviyo documents a fixed-window algorithm with two windows, a 1-second burst and a 1-minute steady, with tiers running from XS (1 request per second burst, 15 per minute steady) to XL (350 per second, 3500 per minute). Exceeding a limit returns HTTP 429, and non-limited responses carry the RateLimit-Limit and RateLimit-Remaining headers. A detail that matters in an agency: OAuth apps get their own quota per installed instance, while private key integrations share a single quota per account. An audit that sweeps a large account through a private key therefore competes with your other integrations.

Why read-only is a security choice

The restriction is not a technical limit of the protocol. The write tools exist, Klaviyo documents them, and they work: create a segment, update a flow's status, delete a list, bulk suppress profiles, send a campaign to its configured audience.

The reasoning is blast radius. A tool that calls get_flow_report produces, at worst, a wrong answer that a human reviews. A tool that calls send_campaign or bulk_suppress_profiles produces an irreversible effect on a database and on a sender reputation. The MCP specification recommends a human able to refuse each invocation, but a specification recommendation is not an operating guardrail: it depends on the attention of the person approving, at the twentieth confirmation in a row.

The read-only parameter moves the guardrail from the operator's goodwill to the server's configuration. A tool that is not loaded cannot be called, even by a model that judged it relevant, even under an instruction slipped into content read along the way. It is the same logic as a read-only service account on a production database.

Then there is the content question. Klaviyo's guidance on disable-tools-with-user-generated-content says exactly what to retain: the data in a CRM account contains text written by third parties (profile names, custom properties, form contents), and that text lands in the model's context. On a client account, that is an input surface you reduce by default.

Our audit protocol, as it runs

What follows is our method, not a vendor-documented procedure.

1. Server set to read-only=true, with a toolsets list limited to the read scopes needed for the agreed perimeter.
2. Automated survey of the inventory (flows, segments, lists, forms, metrics) and of the reports over a fixed window.
3. Human interpretation. The model surveys, it does not decide: the trade-offs on segmentation, list hygiene or cutting dead contacts remain decisions.
4. Fixes applied by hand in the interface, never by the agent.

The gain is not in producing recommendations, which the survey does not provide. It is in the collection phase, the one where you used to open forty screens to rebuild a diagram. On the nature of the data feeding all of this, see the events API.

FAQ

Do you need a specific Klaviyo plan to use the MCP server?

Klaviyo does not document a plan condition on this page. It documents a role condition: the remote server is only available to users with an Owner, Admin or Manager role on the account.

Can you prevent the agent from modifying the account?

Yes. The read-only=true query parameter on the remote server, or the READ_ONLY environment variable on the local server, disable the tools capable of writing. Disabled tools are not exposed to the client.

What is the difference between the local and remote MCP server?

Transport and authentication. The local server runs on your machine and authenticates with a Klaviyo private key; the remote server is reached over Streamable HTTP at https://mcp.klaviyo.com/mcp and authenticates over OAuth with dynamic client registration.

Does this replace a human audit?

No. The read-only perimeter produces an inventory survey and reports. Arbitration, fix prioritisation and their application remain outside the tools' scope.

How many requests can you make?

It depends on the endpoint. Klaviyo applies tiers from XS (1 per second burst, 15 per minute) to XL (350 per second, 3500 per minute), documented endpoint by endpoint in the API reference, with HTTP 429 on overrun.

Going further

The full framework of an account diagnostic is detailed on our Klaviyo agency page. Book a Klaviyo and CRM diagnostic.