redash-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited redash-mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that connects Redash to Claude, Cursor, Gemini CLI, Codex, and any MCP client — query data, build charts and dashboards, and run SQL with natural language.
Install · Tools · Env · Examples · Troubleshooting · Privacy
add_widget places new widgets below existing ones; half-width widgets pair up side by side (previously they all overlapped at the top-left).Full history: Releases
Built for letting an LLM touch production data safely:
DROP/TRUNCATE/ALTER and DELETE/UPDATE without WHERE; strict/warn/off modes, PII detection, and auto-LIMIT.npx redash-mcp setup configures Claude Desktop / Claude Code / Cursor / Gemini CLI / Codex CLI.Requirements: Node.js 20+ and a Redash API key (Redash → Profile → Edit Profile → API Key).
npx redash-mcp setupThe wizard configures any combination of Claude Desktop, Claude Code, Cursor, Gemini CLI, and Codex CLI.
Alternatively, install Node.js, Claude Desktop, and the MCP config in one go:
curl -fsSL https://raw.githubusercontent.com/seob717/redash-mcp/main/install.sh | bash<details> <summary><b>Manual setup</b></summary>
~/Library/Application Support/Claude/claude_desktop_config.json~/.cursor/mcp.json (create it if missing){
"mcpServers": {
"redash-mcp": {
"command": "npx",
"args": ["-y", "redash-mcp"],
"env": {
"REDASH_URL": "https://your-redash-instance.com",
"REDASH_API_KEY": "your_api_key_here"
}
}
}
}Fully quit and restart Claude Desktop after saving.
Claude Code
claude mcp add --scope user redash-mcp \
-e REDASH_URL=https://your-redash-instance.com \
-e REDASH_API_KEY=your_api_key_here \
-- npx -y redash-mcpGemini CLI
gemini mcp add -s user \
-e REDASH_URL=https://your-redash-instance.com \
-e REDASH_API_KEY=your_api_key_here \
redash-mcp npx -y redash-mcpCodex CLI
codex mcp add redash-mcp \
--env REDASH_URL=https://your-redash-instance.com \
--env REDASH_API_KEY=your_api_key_here \
-- npx -y redash-mcp</details>
| Category | Tools |
|---|---|
| Data sources & schema | list_data_sources, list_tables, get_table_columns |
| Query | run_query — execute SQL and return results |
| Saved queries | list_queries, get_query, get_query_result (with parameter values), create_query, update_query, fork_query, archive_query |
| Charts | create_visualization — line / column / area / pie / scatter / counter |
| Dashboards | list_dashboards, get_dashboard, create_dashboard, add_widget (auto-layout) |
| Alerts | list_alerts, get_alert, create_alert |
| Smart Query (BIRD) | smart_query, get_bird_config, evaluate_queries, submit_query_feedback, manage_few_shot_examples, manage_keyword_map |
Applies to ad-hoc SQL run through run_query. Saved queries executed with get_query_result are not checked, so give the Redash data source a read-only DB account.
REDASH_SAFETY_MODE=off): DROP, TRUNCATE, ALTER TABLE, GRANT/REVOKE, DELETE/UPDATE without WHERESELECT *, queries without WHERE or LIMIT, PII column accessLIMIT N when REDASH_AUTO_LIMIT is setDetails: docs/sql-safety-guard.md. Query results are also cached in memory (see REDASH_MCP_CACHE_* below).
| Variable | Default | Description |
|---|---|---|
REDASH_URL | required | Redash instance URL (e.g. https://redash.example.com) |
REDASH_API_KEY | required | Redash user API key |
REDASH_SAFETY_MODE | warn | SQL safety level: off / warn / strict |
REDASH_SAFETY_DISABLE_PII | false | Disable PII detection |
REDASH_SAFETY_DISABLE_COST | false | Disable cost warnings |
REDASH_AUTO_LIMIT | 0 | Auto-append LIMIT N to queries without one (0 = off) |
REDASH_DEFAULT_MAX_AGE | 0 | Redash cache TTL in seconds |
REDASH_MCP_CACHE_TTL | 300 | MCP query cache TTL in seconds (0 = off) |
REDASH_MCP_CACHE_MAX_MB | 50 | Max memory for the MCP query cache, in MB |
REDASH_MCP_CONFIG_DIR | ~/.redash-mcp | Where BIRD few-shot, feedback, eval, and keyword-map data live |
REDASH_BIRD_ENABLED | true | false disables the BIRD smart query tools |
REDASH_HTTP_TIMEOUT_SECS | 30 | Per-request HTTP timeout against the Redash API |
ANTHROPIC_API_KEY | — | Enables the Claude Haiku fallback for table selection in smart_query |
Just ask in natural language:
smart_query picks the tables → run_querysmart_query guides the JOIN → run_querycreate_alertBuild a dashboard: "Save a monthly revenue query, chart it as a line, and put it on a new Revenue dashboard."
create_query — save "Monthly Revenue"get_query_result — run it once so the chart columns can be checkedcreate_visualization — type: "line", x_column: "month", y_columns: ["revenue"]create_dashboard — create "Revenue"add_widget — place the chart; more widgets stack below or pair side by side| Symptom | Fix |
|---|---|
npx not found (macOS GUI apps) | Run which npx and use the full path as command |
| "Authentication failed" | Check REDASH_API_KEY — it must be a user API key |
| "Unable to connect to the Redash server" | Check REDASH_URL (base URL with https://, without /api) and network/VPN |
| "The query timed out" | Simplify the query or pass a larger timeout_secs to run_query / get_query_result; raise REDASH_HTTP_TIMEOUT_SECS for slow API responses |
| Query blocked by the safety guard | Add WHERE/LIMIT; in strict mode, switch to REDASH_SAFETY_MODE=warn to get warnings instead |
| Tools don't show up | Fully restart the client after editing its config |
npm install
npm run dev # run from source (tsx)
npm test # vitest
npm run build # typecheck + bundle to dist/redash-mcp is a local MCP server that talks directly to your Redash instance. No intermediate servers are involved.
| Item | Description |
|---|---|
| Redash API Key | Stored only as a local environment variable (REDASH_API_KEY). Never transmitted externally. |
| Query content & results | Delivered only to the local MCP client via the MCP protocol. |
| BIRD SQL settings | Stored only in local files (~/.redash-mcp/): few-shot examples, keyword maps, and feedback. |
| LLM Fallback | Only when ANTHROPIC_API_KEY is set, smart_query sends table names, column names, and the question text to the Anthropic API. Query results and row data are never transmitted. |
We do not sell or share user data with third parties.
Retention: config files stay in ~/.redash-mcp/ until you delete them; the query cache is in-memory and cleared on shutdown; the schema cache is in-memory with a 10-minute TTL.
Contact: inquiries and security reports via GitHub Issues.
redash-mcp is an unofficial, community-built integration and is not affiliated with, endorsed by, or sponsored by Redash. "Redash" is a trademark of its respective owners and is used here only to describe compatibility. This project communicates with Redash solely through its public REST API.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.