metabase-mcp
The headless, AI-augmented MCP server for Metabase — API-key auth that works for agents, CI, and VPN'd self-hosted instances, with AI insights, production security controls, and support for any Metabase version.
Why This One?
Metabase ships an official MCP server (v0.60+), and since v0.61/v0.62 it covers both read and write operations — creating and updating questions, dashboards, and collections, plus raw SQL execution. It's good, and if it fits your setup you should consider it.
This server exists for the setups it doesn't fit:
- Headless / agent use. The official server's MCP endpoint is OAuth-only, which requires a browser flow and a reachable HTTPS instance. (Metabase's underlying Agent API does accept API keys — but that capability isn't exposed over MCP.) This server authenticates with a Metabase API key over MCP — it works in CI, in autonomous agents, and on self-hosted instances behind a VPN.
- AI inside the server. NLQ-to-SQL, SQL explain/optimize/validate, automated insights, and trend analysis run in the server with your own Anthropic key — independent of which AI client connects.
- Operational control. In Metabase's own words, their MCP server "doesn't come with granular control over which tools people can use" (docs) — it's an instance-wide on/off switch. This server has read/write/full modes, per-tool allow/deny lists, SQL injection guardrails, tiered rate limits, and risk-scored audit logging of every operation.
- Composition.
batch_execute(up to 20 parallel ops) andrun_workflow(chained steps with output references) have no official equivalent. - Any Metabase version — including pre-v0.60 instances that can't use the official MCP at all.






