MCPcat lets you export your analytics data to your own Amazon S3 bucket. Once configured, your data is exported as Parquet files: ready for your data warehouse, BI tools, or compliance archives.
Exported data includes events, sessions, users, and agent goals. Sensitive fields are automatically redacted. See Privacy & Security for details on how MCPcat protects your data.
Prerequisites
- Data export enabled for your organization
- An AWS account where you can create IAM roles
- An S3 bucket in your AWS account to receive exports
Setting up a destination
Navigate to Settings > Destinations > Add Destination to start the setup wizard.
Step 1: Choose destination type
Currently S3 is the only supported destination type. Select it and continue.
| Field | Required | Description |
|---|
| Destination name | Yes | A friendly name (e.g., “Production Data Lake”) |
| Bucket name | Yes | Your S3 bucket name |
| AWS region | Yes | The region where your bucket lives |
| AWS account ID | Yes | Your 12-digit AWS account ID |
| IAM role name | Yes | The name of the IAM role MCPcat will assume (e.g., mcpcat-s3-export) |
| Path prefix | No | Optional prefix for the export path. Exports land at s3://bucket/{prefix}/mcpcat/... |
| KMS encryption | No | If your bucket uses SSE-KMS, provide the KMS key ARN |
Step 3: Set up the IAM role in your AWS account
MCPcat uses cross-account IAM role assumption — your data stays in your AWS account and MCPcat never sees your AWS credentials.
MCPcat generates the exact IAM policies you need. The wizard provides setup instructions in five formats:
- AWS Console — step-by-step manual instructions
- AWS CLI — copyable shell commands
- Terraform — HCL code you can add to your infrastructure
- Pulumi — TypeScript code for Pulumi users
- CloudFormation — one-click “Launch Stack” button that creates everything automatically
The generated IAM role includes:
- A trust policy that allows MCPcat’s service role to assume it, with your organization ID as an external ID for security
- A permissions policy granting
s3:PutObject, s3:PutObjectAcl, and s3:DeleteObject on your bucket path (and kms:GenerateDataKey / kms:Decrypt if KMS is configured)
Step 4: Verify the connection
After creating the IAM role in your AWS account, return to MCPcat and click Verify Connection. MCPcat will:
- Assume your IAM role via STS
- Write a test object to your bucket
- Delete the test object
If verification fails, MCPcat shows which step failed with a specific error message (e.g., “Role assumption failed”, “Write denied”, “KMS access denied”) to help you troubleshoot.
Assigning projects to a destination
After your destination is verified and active:
- Navigate to Settings > Projects and select a project
- In the Exports section, click Add Destination
- Select from your verified destinations
- Toggle the export on or off per project
A project can be assigned to multiple destinations, and a destination can receive data from multiple projects.
What gets exported
MCPcat exports your data as Parquet files:
| File | Contents |
|---|
| Events | All captured MCP events (tool calls, resource reads, etc.) |
| Sessions | Session metadata including timing, event counts, and client info |
| Users | Identified user records and metadata |
| Goals | Agent goal definitions discovered by MCPcat |
| Enhanced events | Events denormalized with session, user, and goal data in a single table for easy querying |
Only sessions with at least one action and an assigned agent goal are included in exports. This filters out empty or incomplete sessions to keep your exported data meaningful.
parameters and response fields on events are excluded from exports entirely. They are never loaded or written to the Parquet files. The ip_address field is also excluded. String values in user identification data are redacted and only boolean and numeric values are preserved for analysis. Learn more about server-side redaction.
Export path structure
Exports are written to:
s3://{bucket}/{prefix}/mcpcat/{project_id}/{date}/{filename}.parquet
s3://my-data-lake/analytics/mcpcat/proj_abc123/2026-04-03/proj_abc123_events.parquet
s3://my-data-lake/analytics/mcpcat/proj_abc123/2026-04-03/proj_abc123_sessions.parquet
s3://my-data-lake/analytics/mcpcat/proj_abc123/2026-04-03/proj_abc123_enhanced_single_table.parquet
Managing destinations
- Enable/disable: Toggle a destination on or off without deleting it
- Edit: Update the name or S3 configuration (changing config resets verification — you’ll need to re-verify)
- Delete: Permanently remove a destination (also removes all project assignments)
- Re-verify: Test the connection again anytime from the destination detail page
