The Klaviyo MCP, Tested: What Works, What Breaks, and What's Missing

October 2026 update: Klaviyo has shipped a lot since I ran this test in May: more than 260 tools, the ability to send campaigns, and a way to read flow email content. I have not re-run the test. I corrected the errors I found in the original and marked the May findings that no longer hold. The next section has the short version.

TL;DR: On May 7, Klaviyo expanded its Anthropic integration. Cowork can run unattended marketing workflows against the native Klaviyo Connector, and a new Query Metric Aggregates tool exposes the raw revenue and engagement data behind Klaviyo's in-app reports. I connected it to a real Klaviyo account and ran the new flow audit mode end-to-end. The integration works. Two things stood out that nobody else was reporting: a metric semantics gotcha that can produce a confident, wrong audit finding if you trust metric names without verifying them, and a tool gap that limited compliance review for supplement, health, and CBD brands. Klaviyo has since added a tool for that gap. The gotcha still applies. This post is the hands-on review every existing piece of coverage skipped.

Three MCPs landed in nine days. Meta on April 29. Higgsfield on April 30. Klaviyo on May 7. Different surfaces, same direction: the tools DTC brands use to ship ads, generate creative, and run email are no longer locked behind dashboards. They are addressable from inside a Claude chat or a Cowork session that can run unattended.

I have been writing the Meta MCP series and the compliance follow-up for the last week. Klaviyo's update is the third pillar of the same wave. Klaviyo's announcement framed the integration as Claude shifting from "analyst who tells you what to do" to teammate who actually does the work. Giri Sreenivas went further on Klaviyo's blog, in their infrastructure post. He borrowed a question Parker Harris asked about Salesforce - "Why should you ever log into Salesforce again?" - and called it the question every platform company is now being asked.

That is a strong claim. So I tested it. Here is the part of the story you have not read in the press release.

What changed since May

I have not re-run the full audit since May. Everything in this section comes from Klaviyo's and Anthropic's own documentation as it stood on October 12, 2026, plus the tool list my own connector shows. Where it replaces something I said in May, the passage below carries a note.

• The server went from read-and-draft toward full account control. On August 11, Klaviyo added 260+ MCP tools "to read data, build segments, run campaigns, author flows, and manage catalogs." The tool reference now lists over 260. The listed connector in my own Claude account, as it loads in Claude Code, shows fewer: 111 tools on October 12. They cover campaigns, templates, lists, profiles, and reporting, with nothing for building flows or segments. Check what your own connector lists before you plan around the larger number.
• It can send. The tool list includes send_campaign and cancel_campaign_send. In my connector, the send tool's own description says the action needs explicit user confirmation and that a send cannot be undone once recipients start receiving it. In May the connector stopped at a draft.
• Flow email content is readable. get_flow_message and get_flow_action are in the tool list, and the API reference shows a flow message can be requested with its template attached. This is the gap that returned a 404 for me in May.
• Read-only mode exists. Add read-only=true to the server URL and only the tools that do not modify Klaviyo data are enabled, per the connection docs. You set that URL yourself on a custom connector. For a regulated brand, this is the setting to start with.
• Multi-account has a documented route. One custom connector per account, each pointed at https://mcp.klaviyo.com/mcp?company=your-company. Klaviyo's agency guide says connecting several accounts this way needs a paid Claude plan.
• Free Claude plans get connectors. Anthropic's help center says web connectors are available for all users. I said otherwise in May.
• Templates and scale. Drag-and-drop template tools arrived on May 29. At its September K:BOS launch, Klaviyo described "260+ MCP tools and capabilities and 490+ APIs" as open to Claude, ChatGPT, or any other AI system a team uses.

The practical read: the "what is missing" list got shorter, and the advice to keep a human on the send got more important, because the agent can now do the sending.

What Klaviyo and Anthropic actually shipped on May 7

Most of the coverage of the announcement is a rewrite of the Klaviyo blog post. The substance is real, but the press cycle smoothed over what changed mechanically. Here is the unvarnished list.

1. The one-click Klaviyo Connector is the front door. The connector has been in Claude's directory since January 2026, and the May 7 release is what widened what it can do. Before the directory listing, you connected Klaviyo to Claude Code or Claude Desktop with a remote MCP URL plus an OAuth flow. Now you search for Klaviyo, click connect, approve the OAuth scopes, and you are done. No CLI, no API keys, no copy-pasted config. Setup is two minutes for anyone, where the manual route was closer to 30 minutes for a technical user.

2. Claude Cowork now sees Klaviyo data. Cowork is the unattended-execution surface Anthropic shipped earlier this year. It has filesystem access, multi-step tool chaining, and the ability to keep working while you are not at the keyboard. Klaviyo's May 7 release extended the server across Claude, Cowork included. The pitch for this is the one Klaviyo is leaning on hardest: describe an outcome ("audit my flows," "build my weekly report," "draft a re-engagement campaign for at-risk subscribers"), step away, come back to a finished document.

3. Query Metric Aggregates is the most important new tool. This is the one most coverage is glossing over. The existing Klaviyo MCP exposed read tools for campaigns, flows, profiles, lists, segments, and templates. What it did not expose was the raw event/revenue data that powers Klaviyo's in-app Metric Reporting. Without that, an MCP run could pull "this campaign opened at 38%" but could not answer "what is my total Klaviyo-attributed revenue from email this month, broken down by flow vs campaign, week over week." Query Metric Aggregates closes that gap. You can now group by attributed flow, attributed message, campaign, or send cohort, and run a sum_value aggregation against the Placed Order metric for any time window up to a year. It is essentially a SQL-style query layer on top of Klaviyo events.

4. MCP Apps support means inline charts and dashboards. This is for builders. Anthropic's ext-apps SDK plus Claude Code now lets developers build interactive surfaces that render directly inside a Claude conversation. A revenue-by-flow bar chart that updates as you drill in. A flow-audit dashboard with a sortable table. Klaviyo and Anthropic are positioning this as the path for partners and agencies to build domain-specific tools on top of the connector.

That is the actual May 7 update. Everything else in the announcement is reframing existing capabilities for a wider audience.

How to connect it in two minutes

If you are coming to this fresh, here is the path:

1. Go to claude.ai/directory/connectors.
2. Search "Klaviyo." Click Connect.
3. Approve the Claude scopes. Klaviyo will redirect you to its OAuth screen.
4. Approve the Klaviyo permissions. You need to be an Owner, Admin, or Manager on the Klaviyo account.
5. You are done.

Plan requirement: none for the listed connector. Anthropic's help center says web connectors are available for all users, free plans included. On Team and Enterprise, an Owner has to enable the connector first. (In May I wrote that the free tier does not get connectors. That was wrong, or has changed since.) If you are running this on Claude Code instead of claude.ai, the same connector works through the IDE.

For multi-account agencies, each connector instance binds to one Klaviyo account, and there is no built-in account switcher inside Claude. Klaviyo's documented route is one custom connector per account: add the server URL with the account name as a query parameter (https://mcp.klaviyo.com/mcp?company=your-company), approve OAuth for each, and enable only the relevant one in a given chat. Before you approve each one, check which Klaviyo account your browser is logged into: Klaviyo's guide warns that the authorization is tied to that account. Then ask the new connector for its account details and confirm it names the right client. Klaviyo says connecting several accounts this way needs Claude Pro, Max, Team, or Enterprise. We will come back to this in the Native Connector vs Composio section.

The same route gets you read-only mode. Klaviyo's docs say URL parameters cannot be set on the listed connector, so add Klaviyo as a custom connector in Claude's connector settings and give it https://mcp.klaviyo.com/mcp?read-only=true as the server URL. That turns off every write tool on that connector. It does nothing to the listed connector: if you connected that one first, disconnect it or switch it off in the chat, then ask Claude to list its Klaviyo tools and confirm send_campaign is gone. On plans, the two sources differ: Klaviyo's page says the custom connector is for Pro, Max, Team, and Enterprise, and Anthropic's help center says free plans get one custom connector.

I tested the audit mode against a real account

The week of the release I shipped a v1.1 update to the klaviyo-flow-architect skill that runs in what I called Live Data Mode. When the Connector is detected, the skill pulls real flow performance via get_flow_report, compares per-message metrics against the benchmarks the skill already had, generates a prioritized fix-it list, and saves a markdown audit report. Then I ran it against an actual Klaviyo account.

Most of it worked exactly the way the press release would lead you to expect. The skill listed flows. It pulled per-message performance. It compared opens, clicks, and revenue per recipient against the benchmark table. It computed dollar-impact estimates for closing each gap and saved the entire audit to a markdown file in under a minute. This is the part most existing coverage gets right, and it is the part that earns the integration its weight: a 30-minute deliverable that used to be a half-day analyst job.

Here is the part you will not read in any existing piece on the May 7 announcement.

The metric semantics gotcha nobody is reporting

Klaviyo's MCP exposes hundreds of metrics. Some are core platform events like "Subscribed to List" and "Placed Order." Some are integration-specific like "Fulfilled Order" (Shopify) or "Viewed Product" (custom API). Some are page-level interaction events that fire on signup-form click activity.

Those last ones are dangerous if you treat them as evidence without verifying what they represent.

During the audit run, I almost shipped a finding built on a metric named subscribe_page_submit. The metric name reads like "successful form submission." Klaviyo categorizes it as an Internal metric, which I initially interpreted as a Klaviyo-native subscription confirmation. Cross-referencing its monthly counts against Subscribed to Email Marketing produced an alarming gap that, taken at face value, looked like a broken acquisition pipeline.

It was not a broken pipeline. It was a misread metric.

When I pulled raw events for subscribe_page_submit using get_events, every event had a null profile attached. The events clustered three at a time within ten-second windows from the same browser fingerprint - a pattern consistent with bot or scraper activity, not human submissions. The metric does not track successful subscriptions. It tracks page-level submit-button click activity, including from non-humans.

If the audit had run autonomously through Cowork without a second-pass check, it would have produced a confident, professional-looking report with a wrong diagnosis. The brand operator would have spent the next week chasing a problem that did not exist. The risk is highest in unattended runs precisely because the operator is not in the loop to catch the inference.

The rule I added to the audit skill itself, in short form. It now applies to every account the skill runs against. (Tool names in this post follow Klaviyo's current tool reference. The skill file still writes them with a klaviyo_ prefix.)

Verify metric semantics by sampling raw events before treating counts as evidence. Standard Klaviyo metrics use Title Case ("Subscribed to List", "Placed Order"). Custom and page-tracking events tend to use snake_case ("subscribe_page_submit", "form_view"). The naming convention is a tell. When the metric name is non-standard, pull a few raw events with get_events, check whether profiles are attached, look at event_properties, and confirm the semantics before building a finding on the count.

This applies to any brand running an audit through the new MCP, regardless of account size. It is the kind of thing you only find by running the integration end-to-end against real data. Press-release rewrites and feature lists do not.

The bigger pattern is worth naming. The whole appeal of agentic workflows is that the agent does the work without your supervision. The whole risk of agentic workflows is that the agent can produce confident output built on misread inputs without your supervision. Verifying metric semantics is one specific instance of the broader rule: the agent is only as right as its data layer, and the data layer needs the same skepticism you would bring to a human analyst handing you a chart.

What works today

Here is what the connector does well, ranked by usefulness for a DTC brand.

Flow audits. The skill pulls every active flow, computes per-message gaps against the benchmark table, and writes a prioritized fix-it list with revenue-impact estimates. For most established DTC brands - twenty flows, six months of campaigns, real recipient volume - this is a 30-minute deliverable that used to be a half-day analyst job. It is the use case that earns the integration its weight.

Weekly performance digests. Set this up once. On Monday, Cowork pulls last week's campaign and flow performance, writes a plain-English summary with wins, underperformers, and recommended next steps, and saves the file to a folder you specify. The skill I shipped includes a digest mode with a recurring-run pattern. The first time it runs against a real account, you suddenly stop fighting Klaviyo's reporting UI to assemble the same numbers manually.

Segment-grounded email copy. This is the use case that needed live data access the most. Pulling a representative sample from a target segment, identifying actual purchase patterns (top product, AOV range, replenishment cycle, engagement decay), and grounding copy in those patterns is the difference between an AI-generated re-engagement email that says "we miss you" and one that opens with "if your last order of [Product] ran out around 60 days ago, you have been overdue for 50." The connector now exposes the data needed to do this without exporting CSVs.

Multi-account agency reporting. Klaviyo now documents the route for this: one custom connector per client account, the ?company= setup described above. I am going from their agency guide here, not from a run of my own. An agency managing ten Klaviyo accounts runs it one client at a time: enable that client's connector, pull flow and campaign metrics, write the client-specific performance brief, save it to the client's folder, then move to the next. This is the use case Klaviyo's blog post talks about. If it works as documented, it is the one most likely to pay for itself quickly.

Light-touch campaign drafting. Cowork plus the connector can pull a segment, propose three subject line variants, draft body copy grounded in segment characteristics, and save it as a markdown file ready for review. In May the connector could not push a campaign live. It can now: the tool list includes send_campaign. I still treat this as a draft generator and keep the send in human hands. It generates the artifact a marketer would otherwise build from scratch and shortens the cycle from segment definition to first draft from hours to minutes.

Native Connector vs Composio: which path for your stack

Both vendors have public pages. Klaviyo wants you on their official connector. Composio wants you on theirs. Neither is wrong, and neither writes the neutral comparison. So here is the decision tree.

Use the native Klaviyo Connector if:

• You are a single brand using Klaviyo as your primary marketing platform.
• You are not technical, or you do not want to be.
• You want OAuth, not API keys.
• You do not need to combine Klaviyo with five other platforms in the same agent run.

Use Composio if:

• You are an agency or technical operator running cross-platform workflows.
• You need Klaviyo plus Shopify plus Meta plus Google Analytics plus a CRM in the same agent context.
• You are already on Composio for other tools.
• You want one router managing tool routing across many integrations rather than connecting each one separately.

Klaviyo's tool reference now lists over 260 tools, Query Metric Aggregates and MCP Apps support among them. Composio wraps the same Klaviyo API and exposes it alongside the rest of its catalog through its router. I have not compared the two tool lists line by line, so I will not claim they are equivalent. The differentiator that matters is multi-platform aggregation.

For a typical DTC brand with a Klaviyo + Shopify + Meta stack, the native Connector for Klaviyo plus Meta's official MCP plus the Shopify dev tools plugin is the right combination today. For an agency working across ten clients on five platforms each, Composio's router is the cleaner architecture even if it costs more to set up.

There is a middle ground worth flagging. If you are already running Polar's analytics MCP for cross-platform attribution, Polar surfaces blended Klaviyo + Shopify + Meta numbers in one query. Polar plus the native Klaviyo Connector lets you ask blended attribution questions through Polar and drill into Klaviyo specifics through the Connector when needed. This is the pattern I have been recommending to brands building their stack from scratch.

Where this fits in the bigger MCP wave

Three official MCP releases in nine days, all aimed at the same DTC creative-and-execution loop:

• April 29: Meta's official Ads MCP and CLI. Pull Meta performance, push campaigns live, run dashboards. (Coverage here.)
• April 30: Higgsfield's hosted MCP. Generate static and video creative across thirty image and video models, up to 4K and 15 seconds. (Same post.)
• May 7: Klaviyo's expanded Anthropic integration. Cowork support for the native Connector, Query Metric Aggregates, MCP Apps. (This post.)

The pattern is not subtle. The platforms DTC brands rely on are racing to expose themselves as MCP-addressable tools. Anthropic's Claude.ai and Cowork are the consumer-facing surfaces; Claude Code is the technical surface; the connectors plug in everywhere. This is not three independent product launches. It is three legs of the same stool.

The DTC implication is structural. A year ago, "AI marketing" meant "I copied a campaign brief into ChatGPT and it gave me a passable email." Now it means "I described an outcome in Cowork and came back to find the audit, the campaign drafts, the new ad creative, and the launch dashboard built and saved to my repo." The plumbing has caught up to the pitch. The thing that does not catch up automatically is the brand context layer that decides whether the output sounds like your brand or sounds like everybody else's.

That is the through-line for the entire wave. The MCPs make the tools addressable. They do not make the output good. Output quality still depends on what the agent reads before it writes - the brand voice file, the customer personas, the objections, the offers, the regulatory guardrails. That is the actual moat.

Compliance: what supplement, health, and CBD brands need to know

This is the part of the integration nobody is writing about, and the part regulated DTC brands need most.

The Klaviyo MCP plus Cowork can now pull a segment, write a re-engagement email grounded in real customer data, and save the draft. If you sell supplements, that draft can include a phrase the FDA considers a disease claim before you have a chance to review it. The structure/function rule that governs every word of supplement marketing copy does not stop applying because Claude wrote the draft instead of a copywriter.

The rules have not changed. The exposure has.

What you cannot say in any AI-generated email going to your subscribers:

• Direct disease claims (treats, cures, prevents, diagnoses any condition)
• Drug-style efficacy phrasing ("clinically proven to reduce inflammation")
• Specific outcome timeframes without citable substantiation ("feel results in seven days")
• Fabricated statistics or testimonials Claude makes up because the prompt was vague

What you do need:

• A guardrails file in your brand context that lists banned phrases, required disclaimers, and category-specific rules
• A pre-publish review step that compares draft copy against the guardrails before it goes to Klaviyo as a draft, let alone live
• The connector in read-only mode until that review step exists (read-only=true on the server URL of a custom connector, with the listed connector disconnected)
• The FDA structure/function disclaimer in any email that makes any health-adjacent claim: "These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease."

There was also a real tool gap for compliance review that I hit during the May audit. The Klaviyo MCP exposed get_email_template for templates, but existing flow message content was stored as a flow-message-content object that was not retrievable through that tool. When I tried to pull the body of an existing welcome email for an automated compliance pass, I got a 404. Klaviyo has since added get_flow_message and get_flow_action, and the API reference shows a flow message can be requested with its template attached. I have not re-run the compliance pass against them, so confirm on your own account that the email body comes back before you rely on it. If it does not, the fallback is the same as in May: paste the email content into the conversation, or drop to the REST API directly.

The full compliance pattern for AI-generated marketing assets - the same one that applies to the Meta MCP - applies here. The tools changed. The FTC and FDA rules did not.

What is not ready yet

Every other piece of coverage on the May 7 announcement is uniformly positive. Here is the part that should temper your expectations.

Flow message content was not retrievable in May. Klaviyo's tool list now includes get_flow_message. I have not re-tested it. Until you have seen it return an email body on your own account, assume the workaround is manual.

Multi-account switching is still friction. Each Connector instance binds to one Klaviyo account. The documented route is one custom connector per client with the ?company= parameter, enabled one at a time.

Rate limits are real for big accounts. A reporting run that pulls many flows and campaigns on a large account can hit Klaviyo's rate limits before it completes. The MCP docs do not publish limits of their own. Klaviyo's API reference lists 1 request per second, 2 per minute, and 225 per day on its flow reporting endpoint, so plan as if the report tools share them. The mitigation is splitting the run across sessions or using an intermediary like Porter that handles rate limiting and pagination.

Several accounts need a paid Claude plan. The listed connector works on a free plan. The multi-account custom-connector setup does not, per Klaviyo's agency guide. If your agency is testing this on personal Claude accounts, plan for that.

Cowork context windows are finite. Long reporting runs will hit Claude's context limits. The fix is one run per account or per task type, which the one-connector-per-client setup pushes you toward anyway. This applies to any Cowork workflow, not specifically to Klaviyo.

The "step away and come back to finished work" pitch needs supervision. Cowork is good. It is not magic. For high-stakes decisions (a campaign going live, a segment about to receive a re-engagement push, anything compliance-sensitive), keep a human in the loop on the final review step. The right pattern is "Cowork drafts, a human approves and sends." The pure-autonomous version of this is not where the technology sits today and probably should not be where it sits for marketing decisions you cannot easily reverse.

Should you use it

If you are a DTC brand on Shopify using Klaviyo as your primary email and SMS platform, yes. Setup is two minutes. The weekly digest mode alone pays for itself in saved analyst time. The segment-grounded copy mode is the most defensible new use case for AI-generated marketing copy I have seen ship.

If you are an agency, yes, but plan the multi-account architecture deliberately. Pick one custom connector per client or Composio depending on your existing stack. Multi-client reporting is where I would expect this to pay for itself fastest.

If you are a compliance-regulated brand (supplements, health, CBD, anything FDA-adjacent), yes, but treat the connector like a draft generator, not a publisher. Build the guardrails file. Keep a human review step. Do not let Cowork ship copy unattended for regulated claims.

If you are a technical team already on Composio or a custom MCP setup, the new tool surface (Query Metric Aggregates especially) is the part you want regardless of how you connect. Check that your route exposes it.

The question Sreenivas borrowed - why should you ever log into the platform again? - is provocative on purpose. The honest answer is "you still will, for a while." But the work that used to require logging in - assembling reports, reading flow performance, drafting campaigns from segment data - now happens in a conversation with Claude that ends with a finished file in your repo. That is the part that is real. Not magic, not finished, not without limits. But real.

If you want the rest of the DTC stack wired this way, that is what the DTC Stack is doing - one Brand Brain plus twenty-one execution skills, the Klaviyo skills running in Live Data Mode through the Connector. The integration is the easy part. The brand context that decides what the AI says when it has live access to your data is the part that compounds.

Frequently asked questions

What plan do I need to use the Klaviyo Connector in Claude?

The listed connector works on any Claude plan: Anthropic's help center says web connectors are available for all users. A custom connector, which you need for read-only mode or for several accounts, is where the sources differ. Klaviyo's page says it needs Pro, Max, Team, or Enterprise, and Anthropic's help center says free plans get one custom connector. You also need to be an Owner, Admin, or Manager on your Klaviyo account.

Can I use the Klaviyo MCP with ChatGPT instead of Claude?

Klaviyo has an official ChatGPT app for Klaviyo that exposes a similar but not identical tool surface. ChatGPT is fast for ad-hoc queries; Claude with Cowork is stronger for deeper analysis and unattended document generation. Many teams use both for different jobs.

What is Query Metric Aggregates and why does it matter?

It is a new tool in the May 7 release that exposes the raw event and revenue data behind Klaviyo's Metric Reporting. It lets the AI compute things like "campaign vs flow revenue split for the last 30 days" without exporting CSVs or rebuilding dashboards. It is the most important new capability in the update.

Is the Klaviyo MCP safe for compliance-regulated brands like supplement, health, or CBD?

Yes, with discipline. Build a guardrails file with banned phrases and required disclaimers. Keep a human review step before any AI-drafted copy goes live. Do not let Cowork ship copy unattended for FDA-regulated claims. The structure/function rule applies to AI-written copy exactly the same as to human-written copy.

Klaviyo MCP vs Composio: which should I pick?

Native Connector for single brands using Klaviyo as their main platform. Composio for agencies running cross-platform workflows where Klaviyo is one of many integrations. The differentiator is whether you need multi-platform routing.

Can the Klaviyo MCP send campaigns?

Yes. It could not when I tested in May, but Klaviyo's current tool list includes send_campaign and cancel_campaign_send. The send tool's description in my connector says it needs explicit user confirmation. I keep the send in human hands anyway: let the agent draft, review it yourself, then send.

Can I connect the Klaviyo MCP in read-only mode?

Yes. Klaviyo's connection docs say adding read-only=true to the server URL enables only the tools that do not modify Klaviyo data. The listed connector does not take URL parameters, so add Klaviyo as a custom connector with https://mcp.klaviyo.com/mcp?read-only=true as the server URL. Disconnect the listed connector first, or its write tools stay available. The plan question above covers which Claude plans can add a custom connector.

How do I run a flow audit using the Klaviyo MCP?

Connect the Klaviyo Connector in Claude. Ask Claude to audit your flows and save the report. With our klaviyo-flow-architect skill in Live Data Mode, the audit pulls 90-day performance per message, compares against benchmarks, generates a prioritized fix-it list, and saves the markdown report. Without the skill, you can ask Claude in plain English; the output will be less structured but still useful.

What is the "metric semantics" gotcha you mentioned?

Some Klaviyo metrics have names that read like one thing but track another. subscribe_page_submit sounds like a successful subscription event but is actually a page-level click-tracking event that fires on submit-button activity, including from bots and scrapers. If you trust the metric name without sampling raw events, you can build a finding on a foundation that does not support it. The fix is checking the raw events with get_events before treating any count as evidence, especially for snake_case metric names. Title-case metrics like "Subscribed to List" and "Placed Order" are safer defaults. The risk is highest when running unattended Cowork audits where the operator is not in the loop to catch the wrong inference.