redash-mcp (seob717/redash-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 24 tools. No publisher has claimed this listing.

C
Emerging
74/100

redash-mcp

MCP server that connects Redash to Claude AI, enabling natural language data queries, dashboard management, and SQL execution.

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

seob717

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: REDASH_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 2 credentials: ANTHROPIC_API_KEY, REDASH_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes24 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_data_sources

List connected data sources (id, name, type). Call this first to get data_source_id.

list_tables

List tables in a data source. Use keyword to filter by name. Verify table names here before writing SQL.

get_table_columns

Get the column names and data types for one or more tables in a data source. Accepts a single table or a comma-separated list of tables. Use this to confirm exact column names and types before writing SQL with run_query or smart_query. Returns each table's columns; if a table name is not found, it s

run_query

Execute an ad-hoc SQL query against a data source and return the resulting rows. Every query passes through the SQL safety guard, which blocks destructive statements (DROP/TRUNCATE/ALTER, DELETE/UPDATE without WHERE) and flags PII columns and expensive full scans; results are cached in memory. Behav

list_queries

List saved (named) queries in Redash, most recently updated first. Behavior: returns a paginated array where each item has id, name, description, data_source_id, and updated_at. Usage: use this to discover query_ids, then call get_query for a query's full SQL and visualizations, or get_query_result

get_query_result

Run an existing saved query by its ID and return the latest results. Behavior: executes the query as stored in Redash and returns up to max_rows rows as a markdown table or JSON, with the column list and a truncation note. Usage: find the query_id with list_queries or get_query. Unlike run_query, th

get_query

Get the full definition of a saved query. Behavior: returns the query's SQL text, data_source_id, tags, owner, update time, and its visualizations (each with id, name, type). Usage: find the query_id with list_queries. The returned visualization ids can be placed on a dashboard with add_widget; to a

create_query

Save a new named SQL query to Redash so it can be reused, scheduled, visualized, or added to a dashboard. Behavior: creates the query and returns its new id, name, and created_at. Usage: get the data_source_id from list_data_sources and verify the SQL runs with run_query first; to change an existing

update_query

Update fields of an existing saved query. Behavior: only the fields you pass are changed (name, SQL, description, or tags); any omitted field is left untouched. Returns the query's id, name, and updated_at. Usage: find the query_id with list_queries or get_query; to create a brand-new query instead,

fork_query

Fork (duplicate) an existing saved query into a new, independently editable copy, leaving the original unchanged. Behavior: creates the copy and returns its new id and name. Usage: find the query_id to fork with list_queries; use this when you want to experiment with or adapt a query without modifyi

archive_query

Archive a saved query, removing it from active query lists. This is Redash's form of deletion and cannot be undone through the API, so confirm with the user before calling it. Behavior: archives the query and returns a confirmation message. Usage: find the query_id with list_queries.

list_dashboards

List dashboards in Redash, most recently updated first. Behavior: returns a paginated array where each item has id, name, slug, and created/updated timestamps. Usage: use this to discover a dashboard's id or slug, then call get_dashboard to inspect its widgets and visualizations, or create_dashboard

get_dashboard

Get a dashboard's full layout. Behavior: returns the dashboard's id, name, slug, and every widget, each with its linked visualization (id, name, type) and the query behind it (id, name). Usage: find the dashboard id or slug with list_dashboards; use the returned visualization/query ids to understand

create_dashboard

Create a new, empty dashboard. Behavior: creates the dashboard and returns its id, name, and slug. Usage: after creating it, populate it with charts using add_widget, passing visualization ids obtained from get_query. To list or inspect existing dashboards instead, use list_dashboards / get_dashboar

add_widget

Add a saved query's visualization onto a dashboard as a widget. Behavior: places the widget and returns its id and dashboard_id. Usage: get the dashboard_id from list_dashboards or create_dashboard, and the visualization_id from get_query (each saved query exposes its visualizations). This is how yo

list_alerts

List all alerts configured in Redash. Behavior: returns an array where each alert has id, name, current state (ok / triggered / unknown), last_triggered_at, its linked query (id, name), and threshold options. Usage: use this to discover alert_ids, then call get_alert for one alert's full detail, or

get_alert

Get the full detail of a single alert. Behavior: returns the alert's id, name, current state, last_triggered_at, threshold options (column, operator, value), and the query it monitors (id, name, description, data_source_id). Usage: find the alert_id with list_alerts.

create_alert

Create an alert that watches a saved query and fires when a chosen result column crosses a threshold (e.g., daily_signups less than 10). Behavior: creates the alert and returns its id and name. Usage: get the query_id from list_queries and confirm the exact column name with get_query / get_query_res

smart_query

BIRD SQL-based intelligent query tool. Analyzes natural-language questions to (1) extract relevant schema, (2) match similar few-shot examples, (3) assess complexity, (4) request clarification for ambiguous questions. Call this tool before run_query. For a new data source, first inspect the schema w

manage_few_shot_examples

Manage the few-shot examples that smart_query uses to generate more accurate SQL. Behavior: action 'list' returns all stored examples with their ids; 'add' saves a new example (requires the example object); 'remove' deletes one (requires example_id). Each example pairs a natural-language question wi

submit_query_feedback

Record whether the SQL produced for a question was correct, so smart_query improves over time. Behavior: stores an up/down rating; when you rate 'down' and supply the correct SQL, the error is classified and, if the same kind of mistake recurs, automatically promoted into a few-shot example. Returns

evaluate_queries

Build and run an accuracy test suite for SQL generation on a data source. Behavior: action 'add_test' stores a question paired with ground-truth SQL; 'list_tests' shows them; 'remove_test' deletes one; 'run' scores generated SQL against the test cases; 'results' shows the latest run. Usage: use this

manage_keyword_map

Manage keyword-to-table-name mappings. After inspecting the schema with list_tables, register domain-specific mappings to improve smart_query table-matching accuracy. e.g., {"revenue": ["payment"], "creator": ["creator"]}

get_bird_config

View BIRD SQL configuration and status.

// known CVEs in dependencies2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowesbuild@0.27.7GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows

lowvitest@4.1.6GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretANTHROPIC_API_KEYIf set, BIRD smart_query falls back to Claude Haiku for table selection when keyword scoring fails
🔐 secretREDASH_API_KEYRedash user API key
configREDASH_AUTO_LIMITAuto-LIMIT: Automatically appends LIMIT N when is set
configREDASH_DEFAULT_MAX_AGERedash cache TTL in seconds
configREDASH_HTTP_TIMEOUT_SECSPer-request HTTP timeout against the Redash API
configREDASH_MCP_CACHE_MAX_MBMax memory: configurable via (default: 50MB)
configREDASH_MCP_CACHE_TTLTTL: configurable via (default: 300s)
configREDASH_MCP_CONFIG_DIRDirectory for BIRD few-shot, feedback, eval, keyword-map data
configREDASH_SAFETY_DISABLE_COSTDisable cost warnings
configREDASH_SAFETY_DISABLE_PIIDisable PII detection
configREDASH_SAFETY_MODESQL safety level: off / warn / strict
configREDASH_URLRedash instance URL (e.g. https://redash.example.com)
// quality suggestions

Tool annotations

20/24 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

24/24 tools missing one or more hints — list_data_sources (missing: destructiveHint, idempotentHint, openWorldHint); list_tables (missing: destructiveHint, idempotentHint, openWorldHint); get_table_columns (missing: destructiveHint, idempotentHint, openWorldHint), +21 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 0/24 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

1 call in production code run through a shell (src/setup.ts:10)

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/seob717/redash-mcp)](https://m8ven.ai/mcp/seob717/redash-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 0d285aba5071b802d792e50b41396041472b8973
code hash: b7e9dbe7b79e603421b1330e58eb47d9b3e44f711ff84b00a6e0b9f4738b67ee
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client