Dreamlit Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Dreamlit Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Dreamlit MCP lets AI clients create, inspect, test, publish, unpublish, analyze, and style Dreamlit notification workflows.
Dreamlit is a database-driven notification workflow platform for Supabase and Postgres apps. Use this MCP server when you want an AI client to help build notification workflows from outcome-oriented prompts, review and publish them through Dreamlit, or answer bounded analytics questions about notification performance.
https://mcp.dreamlit.ai/mcpThis repository contains public setup docs and MCP registry metadata for Dreamlit's hosted remote MCP server. The production backend implementation is not open source.
Use your MCP client's remote server flow and enter:
https://mcp.dreamlit.ai/mcpThe client should open a Dreamlit authorization page. Choose the workspace you want the AI client to access and approve the requested scopes.
codex mcp add dreamlit --url https://mcp.dreamlit.ai/mcp
codex mcp login dreamlitTo request every supported v1 scope explicitly:
codex mcp login dreamlit --scopes workflows:read,workflows:write,workflows:publish,analytics:readnpx @modelcontextprotocol/inspectorThen choose Streamable HTTP and use:
https://mcp.dreamlit.ai/mcpDreamlit exposes product-level workflow and analytics tools, not low-level graph editing or database APIs.
| Tool | Scope | Purpose |
|---|---|---|
get_status | workflows:read | Get Dreamlit guidance, workspace context, project setup, schema hints, workflow state, and app URLs. |
list_projects | workflows:read | Find accessible Dreamlit projects in the approved workspace. |
list_workflows | workflows:read | Find workflows in a project by name, description, trigger type, and pagination. |
list_brand_kits | workflows:read | Find saved brand kit ids and style summaries with pagination before applying one to generated email drafts. |
get_workflow_and_preview_url | workflows:read | Inspect a workflow draft and get the Dreamlit preview or builder URL before editing or publishing. |
get_analytics | analytics:read | Query bounded notification analytics, recipient engagement, and workflow run data with filters and cursor pagination. |
create_or_update_workflow | workflows:write | Create a new workflow draft or update an existing draft from a natural-language prompt. |
send_workflow_test | workflows:write | Confirm and send a draft email or Slack test without publishing the workflow. |
prepare_publish | workflows:publish | Validate a workflow before publishing and return confirmation fields. |
confirm_publish | workflows:publish | Publish or schedule a workflow after explicit user confirmation. |
unpublish_workflow | workflows:publish | Disable live triggers or schedules for a workflow. |
get_status first to understand the workspace, project setup, and prompting guidance.list_projects and list_workflows if the user names a project or workflow without IDs.list_brand_kits when the user wants a specific saved brand kit applied to generated email drafts.get_workflow_and_preview_url before editing an existing workflow.get_analytics for bounded analytics questions, filtering first and paginating with returned cursors for larger result sets.create_or_update_workflow to create or update a draft.prepare_publish followed by confirm_publish.Drafts are not live after authoring. Publishing is always a separate explicit step.
Ask for the outcome, not a workflow graph. Good prompts include:
Examples:
When a new organization row is inserted, send an internal Slack alert with the organization name, owner email, and plan.Every Monday at 9 AM America/New_York, send admins a weekly usage digest summarizing active users, failed payments, and new signups.Tomorrow at 10 AM, announce the launch to active users who opted into product updates. Include unsubscribe.OAuth access is scoped to the workspace selected during authorization. Personal access tokens are project scoped and can be created from Dreamlit project settings.
Available scopes:
workflows:readworkflows:writeworkflows:publishanalytics:readUse the least privilege that fits the client. Read-only workflow and brand-kit clients should request only workflows:read; analytics clients should request analytics:read.
Dreamlit MCP can access workflow metadata, saved brand kit summaries, connected project context, and bounded analytics results needed to perform the requested actions. It does not require clients to send database credentials through MCP.
Analytics access is structured and paginated. Use filters and cursors for larger result sets; CSV exports and bulk dumps are not exposed through MCP.
Do not paste secrets, raw credentials, or private tokens into prompts. Use Dreamlit's app settings for integrations and credentials.
For support, contact [email protected].
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.