superset-mcp (Winding2020/superset-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 62 tools. No publisher has claimed this listing.
A Model Context Protocol (MCP) server for managing Apache Superset datasets, metrics, and SQL queries.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Winding2020
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_chartsGet list of all charts in Superset with optional filtering, sorting, and pagination. Uses Rison or JSON query parameters for filtering, sorting, pagination and for selecting specific columns and metadata.
create_chartCreate a new chart in Superset. IMPORTANT: You must first call `get_chart_params` with your desired viz_type to get the correct parameter structure before using this tool. Without the proper parameter structure, chart creation will fail.
get_current_chart_configGet complete chart information including metadata, configuration, and relationships. This provides comprehensive details about a chart including its visualization parameters, datasource info, ownership, dashboards, tags, and more.
update_chartUpdate chart properties including metadata, datasource, and visualization settings. This tool replaces the old update_chart_params with a unified interface that accepts object format params and can modify any chart property. IMPORTANT: When updating visualization parameters, first call `get_chart_pa…
get_chart_filtersGet current data filters applied to a chart. This extracts filters from the chart's query context or form data. Use this tool to see what filters are currently applied before modifying them.
set_chart_filtersSet data filters for a chart. This permanently updates the chart's query context with the specified filters. Filters are applied at the data level, affecting what data is retrieved from the datasource.
list_datasetsRetrieves a list of all datasets in Superset. Supports powerful filtering, sorting, and pagination. You can specify which columns to return, making it efficient for fetching just the needed information.
get_datasetFetches detailed information for a single dataset by its ID. For virtual datasets, this tool returns the raw SQL query.
create_datasetCreates a new dataset in Superset. You can create a physical dataset by linking to a table in a database, or a virtual dataset by providing a custom SQL query. For a physical dataset, provide `database_id` and `table_name`. For a virtual dataset, provide `database_id`, a `table_name` (as an alias), …
update_datasetUpdates an existing dataset's properties. You can change its name, description, or underlying SQL query. This is also the tool to adjust settings like cache timeout. Note: To add, remove, or update individual columns in a virtual dataset's SQL, prefer using the more specific tools: `add_dataset_colu…
delete_datasetDeletes a dataset from Superset. This is a permanent operation and cannot be undone. Be cautious, as deleting a dataset will also break any charts and dashboards that depend on it.
refresh_dataset_schemaRefreshes a dataset's schema by syncing it with the latest information from the source database table. This is useful when the underlying table structure has changed (e.g., columns were added or removed) to ensure Superset has the most up-to-date column information.
find_and_replace_in_sqlPerforms a simple text find-and-replace on a virtual dataset's SQL query. This is a powerful but direct tool; be sure to provide the exact text to find and its replacement to maintain valid SQL.
get_dataset_metricsGet all metrics for a specified dataset
create_dataset_metricCreate one or more new metrics for a dataset
update_dataset_metricUpdate one or more metrics in a dataset
delete_dataset_metricDelete one or more metrics from a dataset
get_dataset_columnsGet column information of a dataset, useful for referencing available fields when creating metrics
create_calculated_columnCreate one or more new calculated columns for a dataset
update_calculated_columnUpdate one or more existing calculated columns in a dataset
delete_calculated_columnDelete one or more calculated columns from a dataset
list_databasesGet all databases configured in Superset
execute_sqlExecute SQL query using /api/v1/sqllab/execute/ endpoint
list_dashboardsGet paginated list of all dashboards with optional filtering, sorting, and pagination. Uses Rison or JSON query parameters for filtering, sorting, pagination and for selecting specific columns and metadata.
get_dashboard_chart_query_contextGet the complete query context for a specific chart in a dashboard, including the chart's dataset ID, used metrics with their SQL expressions, calculated columns, and all applied dashboard filters. This tool provides comprehensive information about the chart's data sources and query structure.
get_dashboard_chartsGet all charts in a specific dashboard with their basic information including chart IDs, names, visualization types, and dataset information.
get_dashboard_filtersGet the dashboard's filter configuration including native filters, global filters, and their scope settings.
get_dashboard_configGet dashboard details and embedded configuration in a single response.
update_dashboard_configUpdate dashboard properties and/or embedded configuration in a single request. Provide at least one of dashboard or embedded_config.
add_chart_to_dashboardAdd an existing chart to a dashboard and place it in the layout (position_json).
remove_chart_from_dashboardRemove a chart from a dashboard and clean up its layout nodes.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
SUPERSET_ACCESS_TOKEN"": "your_access_token"SUPERSET_AUTH_PROVIDERSUPERSET_BASE_URL"": "your-superset-url",SUPERSET_PASSWORD"": "your_password",SUPERSET_USERNAME"": "your_username",Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
62/62 tools missing one or more hints — list_charts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_chart (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_current_chart_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.25.3 (high), axios@1.6.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/winding2020/superset-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check