analytics-mcp-server (zoho/analytics-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 38 tools. No publisher has claimed this listing.

Caution

68/100

analytics-mcp-server

Item: analytics-mcp-server
Rating: 68
Author: M8ven

→ zoho/analytics-mcp-server · listed on github_repo_search

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

zoho

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool annotations don’t match behaviour

1 read-only tool performs write/delete/exec — queryData (line 110: fs.mkdirSync(tempDir, { recursive: true }))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 7 credentials: ANALYTICS_CLIENT_SECRET, ANALYTICS_REFRESH_TOKEN, OIDC_PROVIDER_CLIENT_SECRET, SESSION_SECRET_KEY, REDIS_PASSWORD, CATALYST_CLIENT_SECRET, CATALYST_REFRESH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes38 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

queryData

exportView

importData

listAggregateFormulas

Use Case: 1) Fetches the list of aggregate formulas in a workspace or a specific view/table. 2) Use this to discover existing aggregate formulas and their expressions before creating new ones or referencing them in reports. Important Notes: 1) If viewId is provided, fetches aggregat…

getWorkspacesList

<use_case> 1) Fetches the list of workspaces in the user's organization. 2) Used in the scenario where the user needs to select a workspace for further operations. </use_case> <important_notes> 1) Try to avoid setting includeSharedWorkspaces to True unless you sp…

getViewDetails

<use_case> 1) Fetches the details of a specific view in a workspace. 2) Use this when you need detailed information about a specific view, such as its structure, data, and properties. (In case of a table, it will return the columns and their data types, dashboards will return the…

searchViews

use_case: 1) Searches for views in a workspace using either contains string name matching or natural language query via Retrieval-Augmented Generation (RAG). 2) Use this when you need to find specific views or views relevant to a question. important_notes: - If viewContainsStr i…

checkConnection

addAggregateFormula

createWorkspace

createTable

Create a new table in the given workspace with the given name

createChartReport

createSummaryReport

createPivotReport

createQueryTable

Create a query table in the specified workspace with the given name and SQL query

createLookup

deleteLookup

Remove a lookup relationship for a specified column in a table (view).

deleteView

<use_case> Delete a view (table, report, or dashboard) in the specified workspace. </use_case>

addRow

<use_case> Adds a new row to the specified table. </use_case>

deleteRows

<use_case> Deletes rows from the specified table based on the given criteria. </use_case>

updateRows

<use_case> Updates rows in the specified table based on the given criteria. </use_case>

import_data

<use_case> 1. Imports data into a specified table in a workspace. The data to be imported should be provided as a list of dictionaries or as a file path (only local file). If file_path is provided, the format of the file should also be provided (csv or json), else the data parameter will be used. 2.…

export_view

<use_case> Export an object from the workspace in the specified format. These objects can be tables, charts, or dashboards. </use_case>

query_data

Executes a SQL query on the specified workspace and returns the top N rows as results. Use this to retrieve data from Zoho Analytics using custom SQL queries, gather insights, and answer natural language queries by analyzing the results.

get_workspaces_list

<use_case> 1) Fetches the list of workspaces in the user's organization. 2) Used in the scenario where the user needs to select a workspace for further operations. </use_case>

get_view_details

search_views

<use_case> 1) Searches for views in a workspace using either contains string name matching or natural language query via Retrieval-Augmented Generation (RAG). 2) Use this when you need to find specific views or views relevant to a question. </use_case>

create_workspace

<use_case> Create a new workspace in zoho analytics with the given name. </use_case>

create_table

<use_case> Create a new table in the given workspace with the given name. </use_case>

create_aggregate_formula

<use_case> Create an aggregate formula in the specified table of the workspace. </use_case>

create_chart_report

<use_case> - Create a chart report in the specified workspace for a table in Zoho Analytics. - Use this to generate visual representations of data using bar, line, pie, scatter, or bubble charts. </use_case>

create_pivot_report

<use_case> - Create a pivot table report in the specified workspace and table in Zoho Analytics. - Use this when user needs multidimensional data summaries by defining rows, columns, and data fields. </use_case>

create_summary_report

<use_case> - Create a summary report in the specified workspace and table in Zoho Analytics. - Use this to generate grouped aggregate reports, ideal for quick summaries with group-by and aggregate logic. - Creates a summary table that groups data by specified columns and applies aggregate functions.…

create_query_table

<use_case> 1. Create a query table in the specified workspace with the given name and SQL query. 2. Used when user needs to create a derived table based on a SQL query. 3. Used when further transformations are needed on existing tables. </use_case>

delete_view

<use_case> Delete a view (table, report, or dashboard) in the specified workspace. </use_case> <arguments> workspace_id (str): The ID of the workspace containing the view. view_id (str): The ID of the view to delete. org_id (str | None): The ID of the organization to which the workspace belongs to. …

add_row

<use_case> Adds a new row to the specified table. </use_case>

delete_rows

<use_case> - Deletes rows from the specified table based on the given criteria. </use_case>

update_rows

<use_case> Updates rows in the specified table based on the given criteria. </use_case>

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configACCOUNTS_SERVER_URLVerify ANALYTICS_SERVER_URL and matches your organization's region

configANALYTICS_CLIENT_ID

🔐 secretANALYTICS_CLIENT_SECRET

configANALYTICS_ORG_ID

🔐 secretANALYTICS_REFRESH_TOKEN

configANALYTICS_SERVER_URLVerify and ACCOUNTS_SERVER_URL matches your organization's region

configQUERY_DATA_RESULT_ROW_LIMITStd> (Optional)</td>

configANALYTICS_WORKSPACE_LIST_RESULT_SIZE

configANALYTICS_VIEW_LIST_RESULT_SIZE

configQUERY_DATA_POLLING_INTERVALtd> (Optional)</td>

configQUERY_DATA_QUEUE_TIMEOUTtd> (Optional)</td>

configQUERY_DATA_QUERY_EXECUTION_TIMEOUTtd> (Optional)</td>

configANALYTICS_MCP_DATA_DIR

configOIDC_PROVIDER_CLIENT_ID

🔐 secretOIDC_PROVIDER_CLIENT_SECRET

configMCP_SERVER_PUBLIC_URLOnce the container is running, share with your users; their MCP clients will connect over HTTP without any local setup.

🔐 secretSESSION_SECRET_KEY

configMCP_SERVER_ORG_IDS

configBEHIND_PROXY

configTRUSTED_PROXY_LIST

configDEPLOYMENT_SCENARIO

configTRUSTED_PUBLIC_NETWORKS

configTRUSTED_DOMAINS_ALLOWLIST

configCLIENT_IP_HEADER

configSTORAGE_BACKENDtd>Required only when =redis</td>

configREDIS_HOSTtd>/REDIS_PORT/REDIS_PASSWORD</td>

configREDIS_PORTtd>REDIS_HOST//REDIS_PASSWORD</td>

🔐 secretREDIS_PASSWORDtd>REDIS_HOST/REDIS_PORT/</td>

configCATALYST_SDK_APP_NAME

configCATALYST_PROJECT_ID

configCATALYST_ZAID

configCATALYST_ENVIRONMENT

configCATALYST_CLIENT_ID

🔐 secretCATALYST_CLIENT_SECRET

🔐 secretCATALYST_REFRESH_TOKEN

configCATALYST_CACHE_SEGMENT_ID

configCATALYST_PROJECT_DOMAIN

configOAUTH_DEFAULT_SCOPE

configOAUTH_OFFLINE_ACCESS_SCOPE

configOAUTH_MAX_CLIENT_NAME_LENGTH

configOAUTH_MAX_STRING_LENGTH

configOAUTH_MAX_SCOPE_LENGTH

configOAUTH_MAX_REDIRECT_URIS

configOAUTH_MAX_GRANT_TYPES

configOAUTH_MAX_RESPONSE_TYPES

configOAUTH_AUTH_TRANSACTION_TTL

configOAUTH_AUTH_CODE_TTL

configOAUTH_REGISTERED_CLIENTS_TTL

configOAUTH_CLIENT_IP_MAPPING_TTL

configGLOBAL_OAUTH_RATE_LIMIT_CAPACITY

configGLOBAL_OAUTH_RATE_LIMIT_WINDOW

configPRIVATE_OAUTH_STANDARD_RATE_LIMIT_COUNT

configPRIVATE_OAUTH_STANDARD_RATE_LIMIT_WINDOW

configPUBLIC_OAUTH_STANDARD_RATE_LIMIT_COUNT

configPUBLIC_OAUTH_STANDARD_RATE_LIMIT_WINDOW

configPRIVATE_OAUTH_REGISTRATION_RATE_LIMIT_COUNT

configPRIVATE_OAUTH_REGISTRATION_RATE_LIMIT_WINDOW

configPUBLIC_OAUTH_REGISTRATION_RATE_LIMIT_COUNT

configPUBLIC_OAUTH_REGISTRATION_RATE_LIMIT_WINDOW

configPRIVATE_OAUTH_MAX_CLIENTS_PER_IP

configPUBLIC_OAUTH_MAX_CLIENTS_PER_IP

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tool annotations

21/38 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

17/38 tools missing one or more hints — import_data (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); export_view (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); query_data (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +14 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool annotations match behaviour

1 read-only tool performs write/delete/exec — queryData (line 110: fs.mkdirSync(tempDir, { recursive: true }))

Either remove the readOnlyHint:true annotation, or remove the write/delete call from the tool handler.

Destructive tools are labelled

1 tool perform destructive updates without destructiveHint — queryData deletes at line 121 (fs.unlinkSync(tmpFilePath))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Tool test coverage

Only 0/38 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/zoho/analytics-mcp-server?variant=verified)](https://m8ven.ai/mcp/zoho/analytics-mcp-server)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 1f0ee52c5003bab16c73f94e5cef56822f3385da

code hash: dc8178330381ab0394ae48b3904caef28afe50d8ccf4ba57fd53ab81dd870b41

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client