Metabase MCP Server (thangnm93/metabase-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 42 out of 100, grade D. It declares 87 tools. No publisher has claimed this listing.

D
Caution
42/100

Metabase MCP Server

Provides AI assistants with full access to Metabase analytics platform, enabling dashboard and card management, database queries, and schema operations through natural language.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

thangnm93

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 12 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: METABASE_API_KEY, METABASE_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes87 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_collection_items

Retrieve all items (cards, dashboards) within a Metabase collection - use this to explore collection contents, organize analytical assets, or understand content structure

move_to_collection

Move a Metabase card or dashboard to a different collection - use this to reorganize content, implement governance policies, or clean up analytical assets

search_content

Search across all Metabase content including cards, dashboards, collections, and models - use this to find specific content, discover assets, or explore analytical resources

list_collections

Retrieve all Metabase collections for organizing analytical content - use this to understand content structure, find collections, or explore organizational hierarchy

create_collection

Create a new Metabase collection for organizing analytical content - use this to establish organizational containers for cards, dashboards, and reports

update_collection

Update collection properties including name, description, and organization - use this to maintain metadata, reorganize hierarchies, or update structure

delete_collection

Permanently delete a Metabase collection - use with caution as this affects contained content and cannot be undone

list_users

Retrieve all Metabase users with their roles and permissions - use this to understand user access, manage permissions, or audit accounts

get_metabase_playground_link

Generate a Metabase playground link for interactive query exploration - allows users to see results and experiment with data in a user-friendly interface

list_cards

Retrieve all Metabase cards with optional filtering by source type (e.g., 'models') or model relationships - use this to discover available cards, find specific cards by type, or get an overview of all analytical content

get_card

Get complete metadata and configuration for a specific Metabase card including query definition, visualization settings, collection location, and permissions - use this when you need to examine or understand how a particular card is built

create_card

Create a new Metabase card with custom query, visualization type, and settings - use this to programmatically build new analytical cards, dashboards charts, or data exploration queries

update_card

Modify an existing Metabase card's name, description, query definition, visualization type, or settings - use this to fix broken cards, change chart types, update queries, or move cards between collections

delete_card

Remove a Metabase card either by archiving (soft delete, preserves history) or permanent deletion - use this to clean up unused cards, remove broken cards, or organize analytical content

execute_card

Run a Metabase card query and return the actual data results - use this to get current data from existing cards, refresh analytical insights, or programmatically access query results for further processing

export_card_result

Execute a Metabase card and export the results in a specific format (CSV, Excel, JSON, etc.) - use this to download data for external analysis, create reports for stakeholders, or integrate query results with other systems

copy_card

Create a duplicate copy of an existing Metabase card with identical query and settings - use this to create variations of existing cards, build templates for similar analyses, or backup important queries before modifications

get_card_dashboards

Find all dashboards that include a specific Metabase card - use this to understand where a card is being used, track dependencies before making changes, or find related analytical content

list_embeddable_cards

Retrieve all Metabase cards configured for embedding in external applications (requires admin privileges) - use this to audit embedded content, manage external integrations, or review public-facing analytics

create_card_public_link

Generate a publicly accessible URL for a Metabase card that can be viewed without authentication (requires admin privileges) - use this to share analytical insights with external stakeholders, create public reports, or embed charts in websites

delete_card_public_link

Remove public access to a Metabase card by deleting its public URL (requires admin privileges) - use this to revoke external access to sensitive data, clean up unused public links, or update security permissions

list_public_cards

Retrieve all Metabase cards that have public URLs enabled (requires admin privileges) - use this to audit publicly accessible content, review security settings, or manage external data sharing

move_cards

Relocate multiple Metabase cards to a different collection or dashboard for better organization - use this to reorganize analytical content, group related cards, or clean up workspace structure

move_cards_to_collection

Bulk transfer multiple Metabase cards to a specific collection for organizational purposes - use this to categorize cards by team, project, or topic, or to implement content governance policies

execute_pivot_card_query

Run a Metabase card with pivot table formatting to cross-tabulate data with rows and columns - use this to create summary tables, analyze data relationships, or generate matrix-style reports from existing cards

get_card_param_values

Retrieve all available values for a specific parameter in a Metabase card - use this to populate dropdown filters, validate parameter inputs, or understand what data options are available for interactive cards

search_card_param_values

Search and filter available parameter values for a Metabase card using a text query - use this to find specific parameter options in large datasets, help users locate filter values, or implement autocomplete functionality

get_card_param_remapping

Retrieve how parameter values are remapped or transformed for display in a Metabase card - use this to understand data transformations, debug parameter issues, or see how raw values are presented to users

get_card_query_metadata

Retrieve structural metadata about a Metabase card's underlying query including column types, field information, and data schema - use this to understand card structure, validate data types, or build dynamic interfaces

get_card_series

Retrieve time series data or related card suggestions for a Metabase card - use this to get chronological data trends, find similar cards, or discover related analytical content for dashboard building

list_dashboards

Retrieve all Metabase dashboards - use this to discover available dashboards, get an overview of analytical content, or find specific dashboards

get_dashboard

Retrieve detailed information about a specific Metabase dashboard including cards, layout, and settings - use this to examine dashboard structure or get configuration details

get_dashboard_cards

Retrieve all cards within a specific Metabase dashboard - use this to analyze dashboard content, understand data sources, or examine card configurations

get_dashboard_related

Retrieve entities related to a Metabase dashboard - use this to discover related content, find similar analytical views, or understand dashboard relationships

get_dashboard_revisions

Retrieve revision history for a Metabase dashboard - use this to track dashboard evolution, review past changes, or restore previous versions

list_embeddable_dashboards

Retrieve all Metabase dashboards configured for embedding (requires superuser) - use this to audit embedded content or manage external integrations

list_public_dashboards

Retrieve all Metabase dashboards with public URLs enabled (requires superuser) - use this to audit publicly accessible content or review security settings

create_dashboard

Create a new Metabase dashboard - use this to build new analytical views, organize related cards, or establish monitoring interfaces

create_public_link

Generate publicly accessible URL for a dashboard (requires superuser) - use this for external reporting, client dashboards, or public data sharing

copy_dashboard

Create a copy of an existing dashboard with all cards and layout - use this to create templates, backups, or variations of analytical views

add_card_to_dashboard

Add an existing card to a dashboard with optional parameter mappings - use this to build comprehensive dashboards by combining multiple visualizations

add_text_block

Add a text block or heading to a dashboard - use this for explanatory text, titles, or instructions

favorite_dashboard

Mark a dashboard as favorite for quick access - use this to bookmark frequently accessed analytical views

revert_dashboard

Restore a dashboard to a specific previous revision - use this to undo changes, restore deleted content, or return to known good configuration

save_dashboard

Save a complete dashboard object with nested data - use this for bulk operations or complex dashboard structures

save_dashboard_to_collection

Save a dashboard object directly into a specific collection - use this for organized dashboard creation or bulk imports

update_dashboard

Update dashboard properties including name, description, parameters, and settings - use this to maintain metadata, reorganize content, or configure sharing

update_dashboard_cards

⚠️ DANGER: REPLACES ALL dashboard cards - any cards not in the array will be DELETED. To update a single card, first get_dashboard to fetch ALL cards, then include ALL of them with your modifications. This affects ALL tabs.

delete_dashboard

Delete or archive a dashboard (soft or hard delete) - use with caution as permanent deletion cannot be undone

delete_public_link

Remove public URL access for a dashboard (requires superuser) - use this to revoke external access for security or privacy reasons

remove_cards_from_dashboard

Remove specific dashcards from a dashboard by their dashcard IDs (not card_id) - use this to clean up dashboards or reorganize content

unfavorite_dashboard

Remove a dashboard from the user's favorites list - use this to clean up bookmarked dashboards

execute_dashboard_card

Execute a specific card from a dashboard and retrieve fresh data - use this to get current results from dashboard components or test card functionality

search_dashboards

Search dashboards by name or description text - use this to find specific dashboards or discover related analytical content

update_dashcard

Update a specific dashcard's properties without affecting other cards - use for parameter_mappings, visualization_settings, position, or size changes. Much safer than update_dashboard_cards.

get_dashboard_queries

Extract all queries from a dashboard with IDs resolved to actual table/column names - use this to understand dashboard data sources, audit queries, or plan migrations

audit_dashboard_filters

Analyze dashboard filter connections to find unconnected or misconfigured cards - use this to diagnose filter issues and ensure all cards are properly connected

list_databases

Retrieve all database connections in Metabase - use this to discover available data sources, check connection status, or get an overview of connected databases

get_database

Retrieve detailed information about a specific Metabase database including connection details and schema - use this to examine database properties or troubleshoot connections

create_database

Add a new database connection to Metabase - use this to connect new data sources, establish analytical pipelines, or expand data access

update_database

Update database configuration including name, connection details, and sync settings - use this to maintain connections, update credentials, or modify sync behavior

delete_database

Permanently remove a database from Metabase - use with caution as this will break dependent content and cannot be undone

validate_database

Test database connection parameters before creating - use this to verify credentials, connectivity, and accessibility

add_sample_database

Add the built-in Metabase sample database with demo data - use this for testing, learning, or exploring Metabase features

check_database_health

Perform health check on database connection - use this to diagnose issues, monitor status, or troubleshoot sync problems

get_database_metadata

Retrieve comprehensive database metadata including tables, fields, and relationships - use this to understand structure or build dynamic queries

list_database_schemas

Retrieve all schema names in a database - use this to explore database organization or navigate multi-schema databases

get_database_schema

Retrieve detailed information about a specific schema including tables and objects - use this to explore schema contents or understand organization

execute_query

Execute a native SQL query against a Metabase database - use this for custom data analysis, complex queries, or extracting specific data not available through existing cards

sync_database_schema

Initiate schema sync to update Metabase metadata cache - use this after database changes to recognize new tables, columns, or relationships

list_tables

Retrieve all Metabase tables with optional ID filtering - use this to discover available tables, explore database schema, or get metadata about specific tables

update_tables

Bulk update multiple Metabase tables with same configuration - use this to apply consistent settings, update metadata, or modify table properties efficiently

get_table

Retrieve comprehensive table information including schema, fields, and metadata - use this to understand structure, explore fields, or get configuration details

update_table

Update table configuration including display name, description, and field settings - use this to customize presentation, update metadata, or configure data model

get_table_fks

Retrieve foreign key relationships for a table - use this to understand data connections, build joins, or explore table dependencies

get_table_query_metadata

Retrieve query-optimized table metadata for building dynamic queries - use this when constructing queries or building query interfaces

get_table_related

Find tables and entities related through relationships or schemas - use this to discover connected data, find related content, or understand context

get_card_table_fks

Retrieve foreign keys for a card's virtual table - use this to understand relationships in card-based queries or saved question tables

get_card_table_query_metadata

Retrieve query metadata for a card's virtual table - use this to build queries on top of saved questions or treat cards as queryable tables

append_csv_to_table

Add new rows from CSV content to existing table - use this for incremental data loading, updates, or importing additional records

discard_table_field_values

Clear cached field values to force fresh data loading - use this when table data has changed or cached values are stale

reorder_table_fields

Change display order of table fields for better organization - use this to arrange fields logically, group columns, or improve presentation

replace_table_csv

Completely replace table data with new CSV content - use this for full data refreshes, model updates, or complete table replacements

rescan_table_field_values

Trigger rescan to refresh field values cache with current data - use this to update dropdown options, statistics, or filter values

sync_table_schema

Initiate schema sync for specific table to update metadata - use this when table structure has changed and needs recognition

get_table_data

Retrieve sample data from table for preview and analysis - use this to examine content, verify quality, or understand data patterns

get_field_id

Look up a field's ID and metadata by table and column name - essential for building parameter mappings. Returns field_id, base_type, and other metadata needed for filter connections.

// known CVEs in dependencies12 high6 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@0.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.13.2GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.2GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.2GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.13.2GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretMETABASE_API_KEY1. Set METABASE_URL and
🔐 secretMETABASE_PASSWORD2. Set METABASE_URL, METABASE_USERNAME,
configMETABASE_URL1. Set and METABASE_API_KEY
configMETABASE_USERNAME2. Set METABASE_URL, , METABASE_PASSWORD
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

87/87 tools missing one or more hints — get_collection_items (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); move_to_collection (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_content (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +84 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Secrets never reach shell commands

1 secret value passed to a subprocess as an argument — no shell is invoked, so there is nothing to inject into

Never pass secrets through shell commands. Use library APIs that accept credentials as arguments.

Production dependencies are patched

0 critical, 12 high severity in production deps — @modelcontextprotocol/sdk@0.6.1 (high), axios@1.13.2 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/6 production deps stale: abort-controller@2023-07-12 (3.1y)

Domain consistency

npm scope @cognitionai doesn't match GitHub owner thangnm93

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/thangnm93/metabase-mcp-server?variant=verified)](https://m8ven.ai/mcp/thangnm93/metabase-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 1c15ff32db18f8690ab95c2d9d956c75eba5a898
code hash: daddb235424b63392483cb41cfb0452fd59b4c22c99121af82714d5787b1b313
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client