Bio Superset Agent — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bio Superset Agent (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server that exposes Apache Superset as tools so the AI can build dashboards from Cursor: create dashboards, add charts from datasets (e.g. Snowflake views), and set filters from your instructions.
Best approach: Each colleague does a one-time setup on their machine with their own Superset credentials. No credentials are stored in the repo.
pip install -e . → get their own auth (see GET_TOKEN.md) → add Superset MCP in Cursor with their path and credentials → reload MCP.From the directory that contains mcp_superset (the folder can live anywhere):
cd <path-to-mcp_superset>
pip install -e .
# or with uv:
uv pip install -e .Use one of: (A) session cookie, (B) access token, or (C) username/password. Set in Cursor MCP config or your shell:
| Variable | Required | Description |
|---|---|---|
SUPERSET_URL | Yes | Base URL of Superset (e.g. https://superset.yourcompany.com) |
| Option A – Session cookie (browser / Google login, no JWT) | ||
SUPERSET_SESSION_COOKIE | Yes* | Cookie string, e.g. session=<value>. Get from DevTools -> Application -> Cookies -> your Superset URL -> copy session value. See GET_TOKEN.md. |
| Option B – Access token | ||
SUPERSET_ACCESS_TOKEN | Yes* | JWT from browser. Optional: SUPERSET_REFRESH_TOKEN. |
| Option C – Username/password | ||
SUPERSET_USERNAME | Yes | API user (e.g. admin) |
SUPERSET_PASSWORD | Yes | Password for that user |
SUPERSET_AUTH_PROVIDER | No | Auth provider; default db |
Session cookie (when you only have cookie, no Authorization header): See GET_TOKEN.md: log in to Superset, F12 -> Application -> Cookies -> your Superset URL -> copy the session cookie value, then set SUPERSET_SESSION_COOKIE=session=<paste value>. Session expires when you close the browser or after some time; get a fresh cookie when you get 401s.
Do not commit credentials. Use Cursor’s MCP env or a local .env that is gitignored.
Option A – Use your Python (recommended)
python (or the full path to your Python / venv, e.g. <path-to-mcp_superset>\.venv\Scripts\python.exe)
-m mcp_superset.server
Full path to the mcp_superset folder (e.g. c:\Bio\cursor_projects\mcp_superset)
SUPERSET_URL, SUPERSET_USERNAME, SUPERSET_PASSWORD
Option B – Global install
If you installed the package globally:
mcp-server-superset
Option C – JSON config (Cursor MCP)
If your Cursor MCP is configured via JSON, add something like:
{
"mcpServers": {
"superset": {
"command": "python",
"args": ["-m", "mcp_superset.server"],
"cwd": "C:\\path\\to\\mcp_superset",
"env": {
"SUPERSET_URL": "https://superset.yourcompany.com",
"SUPERSET_USERNAME": "your_user",
"SUPERSET_PASSWORD": "your_password"
}
}
}
}Replace C:\\path\\to\\mcp_superset with the actual path where you placed the folder.
Restart Cursor or reload MCP after adding the server.
| Tool | Purpose |
|---|---|
superset_list_databases | List Superset databases (e.g. Snowflake connection) |
superset_list_datasets | List datasets; optional database_id, search |
superset_get_dataset | Get dataset by id (columns, metrics) for building charts |
superset_list_dashboards | List dashboards; optional search |
superset_get_dashboard | Get dashboard by id or slug (layout, metadata, filters) |
superset_create_dashboard | Create empty dashboard; then add charts and filters |
superset_update_dashboard | Update dashboard (title, slug, published) |
superset_delete_dashboard | Delete a dashboard by id |
superset_update_dashboard_filters | Set native filters (JSON array of filter config) |
superset_add_chart_to_dashboard | Add chart to dashboard with position (x, y, width, height) |
superset_list_charts | List charts; optional search |
superset_get_chart | Get chart by id |
superset_create_chart | Create chart (dataset_id, viz_type, slice_name, params JSON) |
superset_update_chart | Update chart (slice_name, params, description) |
superset_delete_chart | Delete a chart by id |
superset_get_dashboard_charts | List charts on a dashboard |
list_objects, run_snowflake_query).superset_list_datasets to find the dataset that points at that viewsuperset_get_dataset to see columnssuperset_create_dashboard and then superset_create_chart for each chartsuperset_add_chart_to_dashboard to place themsuperset_update_dashboard_filters to add the filters you asked forsuperset_update_dashboard_filters takes a JSON string that is an array of filter objects. Each object typically has:
id: unique string id for the filtername: label shown in the UIfilterType: e.g. filter_select, filter_time, filter_timegraintargets: which charts/columns the filter applies todefaultDataMask: default valuescope: scope of the filterThe AI can build this from your instructions (e.g. “add a date range and a region dropdown”) by following Superset’s native filter schema.
For superset_create_chart, params is a JSON string object. Contents depend on viz_type, for example:
metrics, groupby, order_desc, row_limit, etc.metric, compare_lag, etc.metrics, groupby, time_range, order_desc, etc.The AI should use superset_get_dataset to see available columns/metrics and build valid params.
cd mcp_superset
set SUPERSET_URL=https://...
set SUPERSET_USERNAME=admin
set SUPERSET_PASSWORD=...
python -m mcp_superset.serverThe server uses stdio; Cursor will start it automatically when the tools are used.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.