Mike Cao d2b4aa174e Rate limit dynamic client registration per source address
Replace the process-wide registration counter used without Redis with a
shared per-key fixed-window limiter, so one requester can no longer
exhaust the registration budget for every other client on the process.
The in-memory fallback is bounded (expired windows are swept, then the
oldest keys are shed) so memory stays constant under key churn.

Also fixes checkMcpRateLimit inverting redis.rateLimit's result: it
resolves true once the counter reaches its threshold, so with Redis the
MCP endpoint was denying requests below the limit and allowing those
above it. Both call sites now share the same limiter and semantics.
2026-09-05 17:57:20 -07:00
2026-08-03 16:51:14 -07:00
2026-05-09 01:06:52 -07:00
2026-07-03 11:56:13 +02:00
2026-07-22 11:54:19 -07:00
2022-12-27 21:38:23 -08:00
2026-05-01 15:34:07 -07:00
…
2026-09-01 21:50:07 -07:00
2025-10-16 02:42:13 -07:00
2025-04-29 14:36:52 -07:00
2025-11-21 21:35:11 -08:00
2025-09-01 16:17:55 -07:00
2025-09-03 17:16:03 -07:00
2026-05-14 22:05:34 -07:00

Umami Logo

Umami

Umami is a privacy-first analytics platform. Traffic, campaigns, behavior, conversions, and revenue in one place — no cookies, no surveillance, self-hosted or in the cloud.

GitHub Release MIT License Build Status Umami Demo


🚀 Getting Started

A detailed getting started guide can be found at umami.is/docs.


🛠 Installing from Source

Requirements

  • A server with Node.js version 18.18+.
  • A PostgreSQL database version v12.14+.

Get the source code and install packages

git clone https://github.com/umami-software/umami.git
cd umami
pnpm install

Configure Umami

Create an .env file with the following:

DATABASE_URL=connection-url

Optional: set API_URL to change the base URL used by internal UI API calls. Relative paths are served under BASE_PATH; absolute URLs are proxied through the local /api route. For example, API_URL=/internal-api or API_URL=https://api.example.com/api.

Optional: set TWO_FACTOR_ENCRYPTION_KEY to a 64-character hex string to enable two-factor authentication. Generate one with openssl rand -hex 32. Two-factor authentication is unavailable and cannot be required until this key is set.

The connection URL format:

postgresql://username:mypassword@localhost:5432/mydb

Build the Application

pnpm run build

The build step will create tables in your database if you are installing for the first time. It will also create a login user with username admin and password umami.

Start the Application

pnpm run start

By default, this will launch the application on http://localhost:3000. You will need to either proxy requests from your web server or change the port to serve the application directly.


🐳 Installing with Docker

Umami provides Docker images as well as a Docker compose file for easy deployment.

Docker image:

docker pull docker.umami.is/umami-software/umami:latest

Docker compose (Runs Umami with a PostgreSQL database):

docker compose up -d

🔄 Getting Updates

To get the latest features, simply do a pull, install any new dependencies, and rebuild:

git pull
pnpm install
pnpm build

To update the Docker image, simply pull the new images and rebuild:

docker compose pull
docker compose up --force-recreate -d

🛟 Support

GitHub Twitter LinkedIn Discord

S
Description
Umami is a privacy-first analytics platform. Traffic, campaigns, behavior, conversions, and revenue in one place — no cookies, no surveillance, self-hosted or in the cloud.
https://umami.is
Readme MIT
33 MiB
0 Stars 1 Watchers 0 Forks
Languages
TypeScript 98.7%
JavaScript 0.9%
CSS 0.3%