FullStory

@FullStory show me all active extraction rules capturing form field data in our checkout flow

Here are the 4 active extraction rules targeting checkout elements: 'checkout_email_capture' (extracts email from #email-input, created 2024-01-15), 'payment_method_type' (captures card vs. PayPal selection from .payment-selector, created 2024-02-03), 'promo_code_applied' (extracts coupon field value, created 2024-02-10), and 'shipping_tier_selected' (maps radio button state from form[name='shipping'], created 2024-03-01). All four are live and writing to your data warehouse connector. Note that extraction rules capture raw field values—review each rule's mapping to confirm no PII is being logged unintentionally.

This read-heavy example demonstrates FullStory's extraction rule introspection, useful for auditing what user input your team is capturing. Before relying on this workflow, confirm your API key has read access to extraction rules. Extraction rules are privacy-critical: they can log sensitive form data (passwords, SSNs, credit cards) if misconfigured, so treat the output as a compliance checklist, not just a feature inventory.

@FullStory create an element block to mask all input fields with class 'ssn-field' across web and mobile, effective immediately

Element block created successfully (ID: eb_9x7k2m). This rule now masks all elements matching the CSS selector 'input.ssn-field' on web platforms and the equivalent native selector on iOS and Android. The masking is live in production: any session recorded after this moment will show redacted content for matching fields. FullStory applies this rule retroactively to new playback requests, but existing cached sessions may still show unmasked data for up to 24 hours. Verify the selector in a test session before assuming full coverage—incorrect selectors can leave sensitive fields exposed or over-mask legitimate UI.

This write example shows FullStory's privacy-critical element blocking in action. The MCP requires an Admin API key for this mutation. The side-effect is immediate and production-impacting: a wrong selector can break session replay UX or fail to mask PII. Always test the selector in a staging environment first. FullStory provides no undo for element blocks created via API—you must delete and recreate if the rule is wrong.

@FullStory review the last 7 days of timeline annotations and draft a summary of user-reported issues for our sprint retro

I found 12 annotations in the past week tagged with 'user-report' or 'bug'. Key themes: 5 annotations cite checkout timeout errors (mostly 2024-03-18 to 2024-03-20, coinciding with your payment gateway migration), 3 mention broken image thumbnails in the product gallery (reported by mobile users on iOS 17.4+), 2 flag confusion around the new 'Save for Later' button placement (both from the same user cohort), and 2 are one-off issues (a localization string missing in French, a broken deep link from email). The checkout timeout cluster suggests your migration introduced a latency regression; the image issue may be a WebP compatibility gap. Consider prioritizing the checkout fix and auditing your image CDN's mobile delivery.

This synthesis example pairs FullStory's annotation retrieval with AI reasoning to surface patterns across qualitative user feedback. The MCP reads annotations but doesn't interpret them—the AI does the clustering and prioritization. Annotations are write-only in FullStory's API (no delete endpoint), so this workflow assumes your team has been disciplined about tagging. Rate limits apply: fetching annotations for high-traffic accounts may require pagination.

When FullStory MCP makes compliance prep faster than manual checks

A 6-person SaaS team has a GDPR audit in three weeks and needs to verify which form fields are masked in FullStory recordings. The compliance lead uses this MCP to pull every element block rule, check selectors against the live DOM, and flag gaps where PII might leak. The MCP's Get Element Block and Create Element Block tools let you script the entire audit loop in Switchy: query existing rules, compare to a checklist, push new masks for credit-card inputs or email fields. This works because FullStory's 30 tools cover the full privacy surface—blocks, extractions, user deletion. The threshold: if your team runs more than two audits a year, build the script once and reuse it. If it's a one-time check, the FullStory dashboard is faster.

Why this MCP isn't the right call for live customer troubleshooting

A 12-person support team wants to pull FullStory session replays during Slack escalations to see what the customer clicked before the error. The MCP has 30 tools, but none fetch or embed session replay URLs directly—those live in FullStory's search UI, not the API. You can create annotations to mark the timeline or delete user data after resolution, but the core workflow (search sessions, watch replay, share link) stays in the FullStory dashboard. The MCP shines for privacy mutations and export orchestration, not real-time session lookup. If your support flow is 'find the session, watch it, close the ticket,' skip this integration. If you're scripting bulk annotation or post-incident user-data deletion across 50 sessions, the MCP saves hours.

When extraction rules justify the API-key setup cost

A 9-person growth team tracks 40 funnel events (signup clicks, onboarding steps, paywall hits) and wants to pipe FullStory data into their warehouse without manual CSV exports. The MCP's Create Extraction Rule and Get Extraction Rule tools let you define and version-control every extraction in code: which DOM selectors to capture, which URL patterns to match, which custom properties to map. You script the full pipeline in Switchy—create rules, confirm they're live, cancel stale exports if the schema changes. This pays off when you're managing more than 10 extraction rules or rotating them weekly for A/B tests. Below that threshold, FullStory's UI is less overhead. The API key is admin-scoped, so lock it down and audit who can mutate extraction configs.