Metabase Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Metabase Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Completely vibecoded a TypeScript/Node.js MCP (Model Context Protocol) server that wraps the Metabase REST API, giving AI agents (Claude Desktop, Claude Code) full programmatic access to a Metabase v0.59.x instance. Agents can execute queries, explore schemas, and build dashboards entirely through structured tool calls — no human click-through required.
npm install npm run buildCompiled output is written to dist/. The entry point is dist/index.js.
.env.example and fill in values): cp .env.example .env docker compose up -dMetabase is available at http://localhost:3000 once healthy (allow ~2 minutes on first boot).
| Variable | Required | Description |
|---|---|---|
METABASE_URL | Yes | Base URL of your Metabase instance, e.g. http://localhost:3000 |
METABASE_API_KEY | Yes | API key created in Admin → Settings → Authentication → API Keys |
API Key Permissions: The API key must belong to a Metabase group with sufficient permissions for the operations you need. For full agent access (read schema, execute queries, create/edit cards and dashboards), the key's group should have access to all relevant databases and admin capabilities. A key with only basic viewer permissions will return 403 errors on write operations.
Add the following to your Claude Desktop MCP config file (typically ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"metabase": {
"command": "node",
"args": ["/absolute/path/to/metabase-mcp/dist/index.js"],
"env": {
"METABASE_URL": "http://localhost:3000",
"METABASE_API_KEY": "your-api-key-here"
}
}
}
}Replace /absolute/path/to/metabase-mcp with the actual path to this project.
Add the same config to your Claude Code MCP settings:
{
"mcpServers": {
"metabase": {
"command": "node",
"args": ["/absolute/path/to/metabase-mcp/dist/index.js"],
"env": {
"METABASE_URL": "http://localhost:3000",
"METABASE_API_KEY": "your-api-key-here"
}
}
}
}Once added to Claude Desktop or Claude Code, ask the agent to call the server_ping tool:
"Call the server_ping tool to verify the Metabase MCP server is running."
A successful response looks like:
{"ok": true, "server": "metabase-mcp", "version": "0.1.0"}# Run tests
npm test
# Watch mode
npm run test:watch
# Lint
npm run lint
# Type check without building
npm run typecheck
# Build
npm run build
# Run server directly (requires env vars set)
npm startMetabaseClient class (HTTP, X-Api-Key auth, typed errors) and MetabaseApiErrorcreateServer()), tool registrations, and stdio bootstrapAll MCP server logging goes to stderr exclusively. stdout is reserved for the JSON-RPC protocol stream — any non-protocol bytes there would corrupt the MCP session.
This server targets Metabase v0.59.x. APIs introduced after this version are not used.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.