mcp server for lightdash
SaferSkills independently audited lightdash_mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect Claude, Cursor, and other AI assistants to your Lightdash analytics using the Model Context Protocol (MCP).
A Model Context Protocol (MCP) server for interacting with Lightdash, enabling LLMs to discover data, create charts, and manage dashboards programmatically.
This MCP server provides a comprehensive set of tools for the full data analytics workflow:
pip install lightdash-mcpuvx lightdash-mcppipx run lightdash-mcpgit clone https://github.com/poddubnyoleg/lightdash_mcp.git
cd lightdash_mcp
pip install .If your Lightdash instance is behind Google Cloud Identity-Aware Proxy (e.g. Cloud Run with --iap), install with the iap extra:
pip install lightdash-mcp[iap]
# or from source
pip install .[iap]Set IAP_ENABLED=true. The server will sign a JWT (audience {LIGHTDASH_URL}/*) via the IAM Credentials API and attach it as Proxy-Authorization: Bearer <jwt> on every request. The Authorization: ApiKey header is preserved for Lightdash.
Both service account credentials and user credentials (Application Default Credentials / ADC) are supported:
Service account credentials (default in Cloud Run, GCE, etc.):
roles/iam.serviceAccountTokenCreator on itselfroles/iap.httpsResourceAccessor on the Cloud Run serviceUser credentials (ADC) (e.g. gcloud auth application-default login):
IAP_SA to the service account email to impersonate for signing the JWTroles/iam.serviceAccountTokenCreator on the target service accountroles/iap.httpsResourceAccessor on the Cloud Run serviceThe server requires the following environment variables:
| Variable | Required | Description | Example |
|---|---|---|---|
LIGHTDASH_TOKEN | ✅ | Your Lightdash Personal Access Token | ldt_abc123... |
LIGHTDASH_URL | ✅ | Base URL of your Lightdash Instance | https://app.lightdash.cloud |
CF_ACCESS_CLIENT_ID | ❌ | Cloudflare Access Client ID (if behind CF Access) | - |
CF_ACCESS_CLIENT_SECRET | ❌ | Cloudflare Access Client Secret (if behind CF Access) | - |
LIGHTDASH_PROJECT_UUID | ❌ | Default project UUID (falls back to first available project) | 3fc2835f-... |
IAP_ENABLED | ❌ | Enable Google Cloud IAP authentication (true/1) | true |
IAP_SA | ❌ | Service account email for IAP when using user credentials (ADC) | [email protected] |
ldt_)Add the following to your claude_desktop_config.json:
{
"mcpServers": {
"lightdash": {
"command": "uvx",
"args": ["lightdash-mcp"],
"env": {
"LIGHTDASH_TOKEN": "ldt_your_token_here",
"LIGHTDASH_URL": "https://app.lightdash.cloud",
"LIGHTDASH_PROJECT_UUID": "your-project-uuid"
}
}
}
}Create or edit .mcp.json in your project root:
{
"mcpServers": {
"lightdash": {
"type": "stdio",
"command": "lightdash-mcp",
"env": {
"LIGHTDASH_URL": "https://your-lightdash-instance.com",
"LIGHTDASH_TOKEN": "ldt_your_token_here",
"LIGHTDASH_PROJECT_UUID": "your-project-uuid"
}
}
}
}Restart Claude Code and run /mcp to verify the server shows as connected.
Note: Don't commit.mcp.jsonif it contains secrets — add it to.gitignore.
Export the environment variables before running:
export LIGHTDASH_TOKEN="ldt_your_token_here"
export LIGHTDASH_URL="https://app.lightdash.cloud"
lightdash-mcp| Tool | Description |
|---|---|
list-projects | List all available Lightdash projects |
get-project | Get detailed information about a specific project |
list-explores | List all available explores/tables in a project |
get-explore-schema | Get detailed schema for a specific explore (dimensions, metrics, joins) |
list-spaces | List all spaces (folders) in the project |
get-custom-metrics | Get custom metrics defined in the project |
| Tool | Description |
|---|---|
list-charts | List all saved charts, optionally filtered by name |
search-charts | Search for charts by name or description |
get-chart-details | Get complete configuration of a specific chart |
create-chart | Create a new saved chart with metric query and visualization config |
update-chart | Update an existing chart's configuration (name, description, queries, visualization) |
run-chart-query | Execute a chart's query and retrieve the data |
delete-chart | Delete a saved chart |
| Tool | Description |
|---|---|
list-dashboards | List all dashboards in the project |
create-dashboard | Create a new dashboard (empty or with tiles) |
duplicate-dashboard | Clone an existing dashboard with a new name |
get-dashboard-tiles | Get all tiles from a dashboard with optional full config |
get-dashboard-tile-chart-config | Get complete chart configuration for a specific dashboard tile |
get-dashboard-code | Get the complete dashboard configuration as code |
create-dashboard-tile | Add a new tile (chart, markdown, or loom) to a dashboard |
update-dashboard-tile | Update tile properties (position, size, content) |
rename-dashboard-tile | Rename a dashboard tile |
delete-dashboard-tile | Remove a tile from a dashboard |
update-dashboard-filters | Update dashboard-level filters |
run-dashboard-tiles | Execute one, multiple, or all tiles on a dashboard concurrently |
| Tool | Description |
|---|---|
run-chart-query | Execute a saved chart's query and return data |
run-dashboard-tiles | Run queries for dashboard tiles (supports bulk execution) |
run-raw-query | Execute an ad-hoc metric query against any explore |
| Tool | Description |
|---|---|
create-space | Create a new space to organize charts and dashboards |
delete-space | Delete an empty space |
.
├── pyproject.toml # Package configuration
├── lightdash_mcp/ # Main package
│ ├── __init__.py # Package init
│ ├── server.py # MCP server entry point
│ ├── lightdash_client.py # Lightdash API client
│ └── tools/ # Tool implementations
│ ├── __init__.py # Auto-discovery and tool registry
│ ├── base_tool.py # Base tool interface
│ └── *.py # Individual tool implementations
├── README.md
└── LICENSEThe server automatically discovers and registers tools from the tools/ directory. To add a new tool:
lightdash_mcp/tools/ (e.g., my_new_tool.py) from pydantic import BaseModel, Field
from .base_tool import ToolDefinition
from .. import lightdash_client as client
class MyToolInput(BaseModel):
param1: str = Field(..., description="Description of param1")
TOOL_DEFINITION = ToolDefinition(
name="my-new-tool",
description="Description of what this tool does",
input_schema=MyToolInput
)
def run(param1: str) -> dict:
"""Execute the tool logic"""
result = client.get(f"/api/v1/some/endpoint/{param1}")
return resultTools are automatically discovered via tools/__init__.py, which:
tools/ directory for Python modulesTOOL_DEFINITION.nameYou can test individual tools by importing them:
from tools import tool_registry
# List all registered tools
print(tool_registry.keys())
# Test a specific tool
result = tool_registry['list-projects'].run()
print(result)If you see 401 Unauthorized errors:
LIGHTDASH_TOKEN is correct and starts with ldt_If you see connection errors:
LIGHTDASH_URL is correcthttps://app.lightdash.cloudhttps://your-domain.comCF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET are setIAP_ENABLED=true is set, install with pip install lightdash-mcp[iap], and verify the service account has serviceAccountTokenCreator on itselfIf a tool isn't showing up:
tools/ directoryTOOL_DEFINITION variabletools/__init__.pyContributions are welcome! Please:
This project is licensed under the MIT License - see the LICENSE file for details.
For issues and questions:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.