superset-mcp (Winding2020/superset-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 62 tools. No publisher has claimed this listing.

D
Caution
58/100

superset-mcp

A Model Context Protocol (MCP) server for managing Apache Superset datasets, metrics, and SQL queries.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Winding2020

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 2 credentials: SUPERSET_ACCESS_TOKEN, SUPERSET_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes31 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_charts

Get list of all charts in Superset with optional filtering, sorting, and pagination. Uses Rison or JSON query parameters for filtering, sorting, pagination and for selecting specific columns and metadata.

create_chart

Create a new chart in Superset. IMPORTANT: You must first call `get_chart_params` with your desired viz_type to get the correct parameter structure before using this tool. Without the proper parameter structure, chart creation will fail.

get_current_chart_config

Get complete chart information including metadata, configuration, and relationships. This provides comprehensive details about a chart including its visualization parameters, datasource info, ownership, dashboards, tags, and more.

update_chart

Update chart properties including metadata, datasource, and visualization settings. This tool replaces the old update_chart_params with a unified interface that accepts object format params and can modify any chart property. IMPORTANT: When updating visualization parameters, first call `get_chart_pa

get_chart_filters

Get current data filters applied to a chart. This extracts filters from the chart's query context or form data. Use this tool to see what filters are currently applied before modifying them.

set_chart_filters

Set data filters for a chart. This permanently updates the chart's query context with the specified filters. Filters are applied at the data level, affecting what data is retrieved from the datasource.

list_datasets

Retrieves a list of all datasets in Superset. Supports powerful filtering, sorting, and pagination. You can specify which columns to return, making it efficient for fetching just the needed information.

get_dataset

Fetches detailed information for a single dataset by its ID. For virtual datasets, this tool returns the raw SQL query.

create_dataset

Creates a new dataset in Superset. You can create a physical dataset by linking to a table in a database, or a virtual dataset by providing a custom SQL query. For a physical dataset, provide `database_id` and `table_name`. For a virtual dataset, provide `database_id`, a `table_name` (as an alias),

update_dataset

Updates an existing dataset's properties. You can change its name, description, or underlying SQL query. This is also the tool to adjust settings like cache timeout. Note: To add, remove, or update individual columns in a virtual dataset's SQL, prefer using the more specific tools: `add_dataset_colu

delete_dataset

Deletes a dataset from Superset. This is a permanent operation and cannot be undone. Be cautious, as deleting a dataset will also break any charts and dashboards that depend on it.

refresh_dataset_schema

Refreshes a dataset's schema by syncing it with the latest information from the source database table. This is useful when the underlying table structure has changed (e.g., columns were added or removed) to ensure Superset has the most up-to-date column information.

find_and_replace_in_sql

Performs a simple text find-and-replace on a virtual dataset's SQL query. This is a powerful but direct tool; be sure to provide the exact text to find and its replacement to maintain valid SQL.

get_dataset_metrics

Get all metrics for a specified dataset

create_dataset_metric

Create one or more new metrics for a dataset

update_dataset_metric

Update one or more metrics in a dataset

delete_dataset_metric

Delete one or more metrics from a dataset

get_dataset_columns

Get column information of a dataset, useful for referencing available fields when creating metrics

create_calculated_column

Create one or more new calculated columns for a dataset

update_calculated_column

Update one or more existing calculated columns in a dataset

delete_calculated_column

Delete one or more calculated columns from a dataset

list_databases

Get all databases configured in Superset

execute_sql

Execute SQL query using /api/v1/sqllab/execute/ endpoint

list_dashboards

Get paginated list of all dashboards with optional filtering, sorting, and pagination. Uses Rison or JSON query parameters for filtering, sorting, pagination and for selecting specific columns and metadata.

get_dashboard_chart_query_context

Get the complete query context for a specific chart in a dashboard, including the chart's dataset ID, used metrics with their SQL expressions, calculated columns, and all applied dashboard filters. This tool provides comprehensive information about the chart's data sources and query structure.

get_dashboard_charts

Get all charts in a specific dashboard with their basic information including chart IDs, names, visualization types, and dataset information.

get_dashboard_filters

Get the dashboard's filter configuration including native filters, global filters, and their scope settings.

get_dashboard_config

Get dashboard details and embedded configuration in a single response.

update_dashboard_config

Update dashboard properties and/or embedded configuration in a single request. Provide at least one of dashboard or embedded_config.

add_chart_to_dashboard

Add an existing chart to a dashboard and place it in the layout (position_json).

remove_chart_from_dashboard

Remove a chart from a dashboard and clean up its layout nodes.

// known CVEs in dependencies14 high4 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

highaxios@1.6.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.6.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.6.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.6.0GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretSUPERSET_ACCESS_TOKEN"": "your_access_token"
configSUPERSET_AUTH_PROVIDER
configSUPERSET_BASE_URL"": "your-superset-url",
🔐 secretSUPERSET_PASSWORD"": "your_password",
configSUPERSET_USERNAME"": "your_username",
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

62/62 tools missing one or more hints — list_charts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_chart (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_current_chart_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +59 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.25.3 (high), axios@1.6.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/winding2020/superset-mcp?variant=verified)](https://m8ven.ai/mcp/winding2020/superset-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f0d7a3115f32d79099f7888b86b394fa591cb930
code hash: 59c71d110bc9201d2f29ff60c4aa40dd2d90ebbf8e4916ee8dff5b3f72ac668d
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client