Metabase MCP Server (sjcarrillo-bold/mcp-metabase-server) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 95 tools. No publisher has claimed this listing.
Enables AI assistants to access and manage Metabase analytics through 96 tools for dashboards, cards, databases, tables, collections, and query execution.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sjcarrillo-bold
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_cardsList all questions/cards in Metabase
get_cardGet a single Metabase question/card by ID with full details including the SQL query (dataset_query). Returns MBQL 5 by default.
create_cardCreate a new Metabase question (card)
update_cardUpdate an existing Metabase question (card)
delete_cardDelete a Metabase question (card)
execute_cardExecute a Metabase question/card and get results
create_card_public_linkCreate a public sharing link for a card/question. Returns the UUID for the public URL.
delete_card_public_linkRemove the public sharing link for a card/question
list_public_cardsList all cards that have public sharing links enabled
list_embeddable_cardsList all cards that are set up for embedding
export_card_resultExport a card's query results in the specified format (csv, json, xlsx)
copy_cardDuplicate an existing card/question
get_card_query_metadataGet query metadata for a card including column types and display names
get_card_dashboardsList all dashboards that contain a specific card
move_cardsMove one or more cards to a different collection
move_cards_to_collectionMove all cards matching a filter to a specific collection
execute_pivot_card_queryExecute a card query and return results formatted as a pivot table
get_card_param_valuesGet available values for a card parameter (for populating filter dropdowns)
search_card_param_valuesSearch and filter available values for a card parameter
get_card_param_remappingGet how a card parameter's values are remapped for display (e.g. ID to name)
get_card_seriesGet time series data or related card suggestions for a card
list_dashboardsList all dashboards in Metabase
create_dashboardCreate a new Metabase dashboard
update_dashboardUpdate an existing Metabase dashboard
delete_dashboardDelete a Metabase dashboard
get_dashboard_cardsGet all cards in a dashboard
add_card_to_dashboardAdd a card to a dashboard with positioning
remove_card_from_dashboardRemove a card from a dashboard
update_dashboard_cardUpdate card position, size, and settings on a dashboard
create_dashboard_public_linkCreate a public sharing link for a dashboard. Returns the UUID for the public URL.
delete_dashboard_public_linkRemove the public sharing link for a dashboard
list_public_dashboardsList all dashboards that have public sharing links enabled
list_embeddable_dashboardsList all dashboards that are set up for embedding
copy_dashboardDuplicate a dashboard with all its cards
get_dashboard_revisionsGet revision history for a dashboard (audit trail)
revert_dashboardRevert a dashboard to a previous revision
get_dashboard_relatedGet related content suggestions for a dashboard
get_dashboardGet a specific dashboard by ID with full details
search_dashboardsSearch dashboards by name or description
execute_dashboard_cardExecute a specific card on a dashboard and return results
favorite_dashboardMark a dashboard as a favourite
unfavorite_dashboardRemove a dashboard from favourites
add_text_blockAdd a text or heading block to a dashboard
update_dashcardUpdate a specific dashcard's position, size, or settings
update_dashboard_cardsBulk-replace all cards on a dashboard. WARNING: replaces the entire card layout.
save_dashboardSave a complete dashboard object including nested cards and settings
save_dashboard_to_collectionMove a dashboard into a specific collection
get_dashboard_queriesExtract all card queries from a dashboard with their resolved database IDs and SQL. Useful for auditing what data a dashboard queries.
list_databasesList all databases in Metabase
execute_queryExecute a SQL query against a Metabase database
get_database_schemaGet the schema information for a database
get_database_tablesGet all tables in a database
create_database_connectionCreate a new database connection
test_database_connectionTest a database connection
sync_database_schemaSync database schema metadata
get_database_sync_statusGet database schema sync status
check_database_healthCheck the connection health of a database
validate_databaseValidate a database connection before saving
list_database_schemasList all schemas within a database
get_database_metadataGet full metadata for a database including all tables and fields with their IDs. This is the authoritative source for field IDs needed in MBQL queries.
get_databaseGet detailed information about a specific database connection
update_databaseUpdate a database connection's configuration, credentials, or sync settings
delete_databasePermanently remove a database connection from Metabase
add_sample_databaseAdd the built-in Metabase sample database (H2) with demo data for testing
get_schema_cacherefresh_schema_cachelist_tablesList all tables across all databases in Metabase
get_tableGet metadata for a specific table by ID
get_table_metadataGet full query metadata for a table including all fields with their IDs, types, and semantic types. Use this to get field IDs needed for MBQL queries.
get_table_fksGet all foreign key relationships for a table
get_field_idLook up the Metabase field ID for a column by table ID and column name. Essential for building MBQL queries.
update_tableUpdate table metadata (display name, description, visibility)
sync_table_schemaTrigger a schema sync for a specific table
rescan_table_field_valuesRescan field values for a table (updates filter dropdowns)
discard_table_field_valuesDiscard cached field values for a table
update_tablesBulk-update multiple tables with the same configuration (e.g. hide all at once)
get_table_relatedFind tables and entities related to this table through foreign key relationships
get_card_table_fksGet foreign key relationships for a card's virtual table
get_card_table_query_metadataGet query metadata (fields, types) for a card's virtual table
get_table_dataGet a sample data preview from a table
append_csv_to_tableAppend new rows to a table from CSV content (for Metabase-managed tables)
replace_table_csvReplace all data in a table with new CSV content (for Metabase-managed tables)
reorder_table_fieldsChange the display order of fields in a table
list_collectionsList all collections in Metabase
create_collectionCreate a new Metabase collection
get_collectionGet details of a specific collection
update_collectionUpdate a collection's name, description, color, or parent
delete_collectionDelete a collection and all its contents
get_collection_itemsList items (cards, dashboards, sub-collections) inside a collection
list_usersList all users in Metabase
create_userCreate a new Metabase user
list_permission_groupsList all permission groups
create_permission_groupCreate a new permission group
move_to_collectionMove a card or dashboard to a different collection
search_contentSearch across all Metabase content
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
METABASE_API_KEYexport =your_metabase_api_keyMETABASE_AUTH_METHODPrecedence when more than one credential is set: API key > session token > username/password. Pin a strategy explicitly with =api_keysession_tokenpassword.METABASE_MCP_MAX_ROWSMETABASE_PASSWORDyour_passwordMETABASE_SESSION_TOKENyour_metabase_session_cookie_valueMETABASE_URLexport =https://your-metabase-instance.comMETABASE_USERNAMEyour_usernameTOOL_MODE## Tool Filtering ()Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
95/95 tools missing one or more hints — list_cards (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_card (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_card (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +92 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 13 high severity in production deps — @modelcontextprotocol/sdk@0.6.1 (high), axios@1.8.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/3 production deps stale: abort-controller@2023-07-12 (3.1y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sjcarrillo-bold/mcp-metabase-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check