redash-mcp (seob717/redash-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 24 tools. No publisher has claimed this listing.
MCP server that connects Redash to Claude AI, enabling natural language data queries, dashboard management, and SQL execution.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
seob717
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_data_sourcesList connected data sources (id, name, type). Call this first to get data_source_id.
list_tablesList tables in a data source. Use keyword to filter by name. Verify table names here before writing SQL.
get_table_columnsGet the column names and data types for one or more tables in a data source. Accepts a single table or a comma-separated list of tables. Use this to confirm exact column names and types before writing SQL with run_query or smart_query. Returns each table's columns; if a table name is not found, it s…
run_queryExecute an ad-hoc SQL query against a data source and return the resulting rows. Every query passes through the SQL safety guard, which blocks destructive statements (DROP/TRUNCATE/ALTER, DELETE/UPDATE without WHERE) and flags PII columns and expensive full scans; results are cached in memory. Behav…
list_queriesList saved (named) queries in Redash, most recently updated first. Behavior: returns a paginated array where each item has id, name, description, data_source_id, and updated_at. Usage: use this to discover query_ids, then call get_query for a query's full SQL and visualizations, or get_query_result …
get_query_resultRun an existing saved query by its ID and return the latest results. Behavior: executes the query as stored in Redash and returns up to max_rows rows as a markdown table or JSON, with the column list and a truncation note. Usage: find the query_id with list_queries or get_query. Unlike run_query, th…
get_queryGet the full definition of a saved query. Behavior: returns the query's SQL text, data_source_id, tags, owner, update time, and its visualizations (each with id, name, type). Usage: find the query_id with list_queries. The returned visualization ids can be placed on a dashboard with add_widget; to a…
create_querySave a new named SQL query to Redash so it can be reused, scheduled, visualized, or added to a dashboard. Behavior: creates the query and returns its new id, name, and created_at. Usage: get the data_source_id from list_data_sources and verify the SQL runs with run_query first; to change an existing…
update_queryUpdate fields of an existing saved query. Behavior: only the fields you pass are changed (name, SQL, description, or tags); any omitted field is left untouched. Returns the query's id, name, and updated_at. Usage: find the query_id with list_queries or get_query; to create a brand-new query instead,…
fork_queryFork (duplicate) an existing saved query into a new, independently editable copy, leaving the original unchanged. Behavior: creates the copy and returns its new id and name. Usage: find the query_id to fork with list_queries; use this when you want to experiment with or adapt a query without modifyi…
archive_queryArchive a saved query, removing it from active query lists. This is Redash's form of deletion and cannot be undone through the API, so confirm with the user before calling it. Behavior: archives the query and returns a confirmation message. Usage: find the query_id with list_queries.
list_dashboardsList dashboards in Redash, most recently updated first. Behavior: returns a paginated array where each item has id, name, slug, and created/updated timestamps. Usage: use this to discover a dashboard's id or slug, then call get_dashboard to inspect its widgets and visualizations, or create_dashboard…
get_dashboardGet a dashboard's full layout. Behavior: returns the dashboard's id, name, slug, and every widget, each with its linked visualization (id, name, type) and the query behind it (id, name). Usage: find the dashboard id or slug with list_dashboards; use the returned visualization/query ids to understand…
create_dashboardCreate a new, empty dashboard. Behavior: creates the dashboard and returns its id, name, and slug. Usage: after creating it, populate it with charts using add_widget, passing visualization ids obtained from get_query. To list or inspect existing dashboards instead, use list_dashboards / get_dashboar…
add_widgetAdd a saved query's visualization onto a dashboard as a widget. Behavior: places the widget and returns its id and dashboard_id. Usage: get the dashboard_id from list_dashboards or create_dashboard, and the visualization_id from get_query (each saved query exposes its visualizations). This is how yo…
list_alertsList all alerts configured in Redash. Behavior: returns an array where each alert has id, name, current state (ok / triggered / unknown), last_triggered_at, its linked query (id, name), and threshold options. Usage: use this to discover alert_ids, then call get_alert for one alert's full detail, or …
get_alertGet the full detail of a single alert. Behavior: returns the alert's id, name, current state, last_triggered_at, threshold options (column, operator, value), and the query it monitors (id, name, description, data_source_id). Usage: find the alert_id with list_alerts.
create_alertCreate an alert that watches a saved query and fires when a chosen result column crosses a threshold (e.g., daily_signups less than 10). Behavior: creates the alert and returns its id and name. Usage: get the query_id from list_queries and confirm the exact column name with get_query / get_query_res…
smart_queryBIRD SQL-based intelligent query tool. Analyzes natural-language questions to (1) extract relevant schema, (2) match similar few-shot examples, (3) assess complexity, (4) request clarification for ambiguous questions. Call this tool before run_query. For a new data source, first inspect the schema w…
manage_few_shot_examplesManage the few-shot examples that smart_query uses to generate more accurate SQL. Behavior: action 'list' returns all stored examples with their ids; 'add' saves a new example (requires the example object); 'remove' deletes one (requires example_id). Each example pairs a natural-language question wi…
submit_query_feedbackRecord whether the SQL produced for a question was correct, so smart_query improves over time. Behavior: stores an up/down rating; when you rate 'down' and supply the correct SQL, the error is classified and, if the same kind of mistake recurs, automatically promoted into a few-shot example. Returns…
evaluate_queriesBuild and run an accuracy test suite for SQL generation on a data source. Behavior: action 'add_test' stores a question paired with ground-truth SQL; 'list_tests' shows them; 'remove_test' deletes one; 'run' scores generated SQL against the test cases; 'results' shows the latest run. Usage: use this…
manage_keyword_mapManage keyword-to-table-name mappings. After inspecting the schema with list_tables, register domain-specific mappings to improve smart_query table-matching accuracy. e.g., {"revenue": ["payment"], "creator": ["creator"]}
get_bird_configView BIRD SQL configuration and status.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
esbuild allows arbitrary file read when running the development server on Windows
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
ANTHROPIC_API_KEYIf set, BIRD smart_query falls back to Claude Haiku for table selection when keyword scoring failsREDASH_API_KEYRedash user API keyREDASH_AUTO_LIMITAuto-LIMIT: Automatically appends LIMIT N when is setREDASH_DEFAULT_MAX_AGERedash cache TTL in secondsREDASH_HTTP_TIMEOUT_SECSPer-request HTTP timeout against the Redash APIREDASH_MCP_CACHE_MAX_MBMax memory: configurable via (default: 50MB)REDASH_MCP_CACHE_TTLTTL: configurable via (default: 300s)REDASH_MCP_CONFIG_DIRDirectory for BIRD few-shot, feedback, eval, keyword-map dataREDASH_SAFETY_DISABLE_COSTDisable cost warningsREDASH_SAFETY_DISABLE_PIIDisable PII detectionREDASH_SAFETY_MODESQL safety level: off / warn / strictREDASH_URLRedash instance URL (e.g. https://redash.example.com)Tool annotations
20/24 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
24/24 tools missing one or more hints — list_data_sources (missing: destructiveHint, idempotentHint, openWorldHint); list_tables (missing: destructiveHint, idempotentHint, openWorldHint); get_table_columns (missing: destructiveHint, idempotentHint, openWorldHint), +21 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 0/24 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
1 call in production code run through a shell (src/setup.ts:10)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/seob717/redash-mcp)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check