Metabase Full API MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific mcp_server implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Manage Metabase dashboards, users and questions through MCP

What we know

Community MCP wrapping much of Metabase REST API including dashboards, questions, permissions and admin settings.

Maintenance / activity evidence

261927 npm downloads during 2026-09-08 through 2026-10-07 for @serdnaley/metabase-mcp

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Full CRUD and admin changes; execute_query can execute arbitrary SQL Reported action classes: Full CRUD and admin changes; execute_query can execute arbitrary SQL. Complete write authority is not verified.
Metabase API key or email/password session
Sensitive access: Business analytics, Database content, Admin permissions

SQL execution remains possible under MCP read-only mode; database permissions are critical
SQL execution and Metabase API permissions may expose production data; MCP read-only controls are not a database permission substitute.
Metabase API key or account credentials; create/write dashboard or card actions, read-only mode configurable.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 261.9k package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package @serdnaley/metabase-mcp; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of Metabase Full API MCP before the next review?

No verified blocker to PUBLIC RADAR TRACKING within the bounded first-party evidence reviewed; material permissions and mitigations are explicitly disclosed.

SQL execution remains possible under MCP read-only mode; database permissions are critical
SQL execution and Metabase API permissions may expose production data; MCP read-only controls are not a database permission substitute.
Metabase API key or account credentials; create/write dashboard or card actions, read-only mode configurable.
Full CRUD and admin changes; execute_query can execute arbitrary SQL
Metabase API key or email/password session
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Reviewed write actions: Full CRUD and admin changes; execute_query can execute arbitrary SQL
Sensitive access: Business analytics, Database content, Admin permissions
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.
Exact dated attributable activity evidence
production authorization and network isolation depend on deployment
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Community server, not Metabase built-in MCP
Read-only MCP flag does not restrict arbitrary SQL execute_query
Restrict account DB permissions
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

261927 npm downloads during 2026-09-08 through 2026-10-07 for @serdnaley/metabase-mcp

Technical identity

npm/@serdnaley/metabase-mcp

Exact implementation source: https://www.npmjs.com/package/@serdnaley%2Fmetabase-mcp ↗
Reviewed resource type: MCP Server
Package identity: npm:@serdnaley/metabase-mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
@serdnaley/metabase-mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Provide Metabase base URL and one auth method: API key or both email/password; inspect read/write tool permissions.
publisher documented install or connect · Publisher instructions
npx -y @serdnaley/metabase-mcp
publisher documented step or launch · Publisher instructions
claude mcp add metabase -- npx -y @serdnaley/metabase-mcp
Configure / authenticate
MCP100 setup guide
Configure METABASE_API_KEY; tool access depends on Metabase API key permissions. Use a non-mutating database/list operation for authorized connection check.
METABASE_API_KEY OR METABASE_EMAIL plus METABASE_PASSWORD; provide Metabase URL.
Environment variables referenced by this route (respect the alternatives above): METABASE_URL, METABASE_API_KEY OR (METABASE_EMAIL AND METABASE_PASSWORD)
Check connection
Suggested check
User-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.

Official Documentation & Sources

What it does

Community MCP wrapping much of Metabase REST API including dashboards, questions, permissions and admin settings.

Capability: Data & Databases
Resource type: MCP Server
Best fit: Manage Metabase dashboards, users and questions through MCP

Representative uses

Query cards/dashboards
Create questions
Manage users and permissions
Run SQL queries

Limitations

Community server, not Metabase built-in MCP
Read-only MCP flag does not restrict arbitrary SQL execute_query
Restrict account DB permissions
SQL execution remains possible under MCP read-only mode; database permissions are critical
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Metabase API key or email/password session
Permissions: Full CRUD and admin changes; execute_query can execute arbitrary SQL
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: SQL execution remains possible under MCP read-only mode; database permissions are critical

Access scope and cautions

Write actions: Not verified Full CRUD and admin changes; execute_query can execute arbitrary SQL
Sensitive access: Business analytics Database content Admin permissions
Risk level: high
Security notes: SQL execution and Metabase API permissions may expose production data; MCP read-only controls are not a database permission substitute. Metabase API key or account credentials; create/write dashboard or card actions, read-only mode configurable.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Query cards/dashboards; Create questions; Manage users and permissions; Run SQL queries.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @serdnaley/metabase-mcp. Recorded transport: stdio. Recorded environment-variable notes: METABASE_URL; METABASE_API_KEY. No configuration values are supplied here. Prerequisites: Compatible MCP client. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Metabase API key or email/password session

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Full CRUD and admin changes; execute_query can execute arbitrary SQL. Recorded permission context: Full CRUD and admin changes; execute_query can execute arbitrary SQL

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Business analytics; Database content; Admin permissions.

What limitations and risks should I check before use?

SQL execution remains possible under MCP read-only mode; database permissions are critical. Community server, not Metabase built-in MCP. Read-only MCP flag does not restrict arbitrary SQL execute_query. Restrict account DB permissions. No independent release lifecycle audit; do not claim precise activity date. SQL execution and Metabase API permissions may expose production data; MCP read-only controls are not a database permission substitute. Metabase API key or account credentials; create/write dashboard or card actions, read-only mode configurable. Unknown vulnerabilities and client-side tool approvals were not exhaustively evaluated.