Top 11 MCP Servers for Data Science & ML in 2026

Data science is where AI agents earn their keep. Load a CSV, run pandas over it, tune a model's hyperparameters, query a warehouse, embed documents into a vector store — these are exactly the repetitive, notebook-heavy tasks a capable model can drive end to end. The Model Context Protocol (MCP) is what makes that possible: it gives Claude and other LLMs a standard way to connect to a live Jupyter kernel, a DuckDB file, a Hugging Face Hub, or a governed data catalog and actually do the work rather than just describe it.

But an MCP server runs code and touches your data with real permissions, and "10k GitHub stars" tells you nothing about whether it does so safely. That is the differentiator for this list: every server below has been statically scanned by MCP Trust Checker, so alongside popularity you can see an A–F Trust Score derived from the published package source. Read the grade like a report card — an A (90–100) is clean and low-risk; lower grades or a non-zero count of high-severity findings mean "usable, but review what it can do before you wire it in." We link every score to its full registry report so you can see the findings yourself.

Here are the 11 MCP servers we recommend for data science and machine learning work in 2026, best-first.

1. Jupyter MCP Server

This is the closest thing to giving an LLM hands on a live kernel. The official Datalayer server connects to a running Jupyter instance — local, JupyterHub, or hosted — and lets the model edit, execute, and read notebook cells in real time. Crucially, it feeds cell output back to the model, including plots and rendered images, so it can iterate on an analysis exactly the way a human data scientist would. If you do your work in notebooks, start here.

Our scan comes back clean: no high-severity findings and a minimal capability footprint, which is reassuring for something that executes arbitrary code.

MCP Trust Score: A (98/100) · GitHub · PyPI

2. Hugging Face MCP Server

The official Hugging Face server turns the entire Hub into callable tools. An agent can run semantic search over models and datasets with filters, search papers, and discover Spaces — and any MCP-compatible Gradio app is automatically exposed as a tool. It ships both STDIO and Streamable-HTTP transports. For model and dataset sourcing, this is the default gateway to the largest ML ecosystem there is.

It earns a perfect 100/100, but our scan does flag one high-severity finding and a "high" capability level, which is expected given how much of the network and Hub it reaches. Skim the finding on its registry page before granting broad access.

MCP Trust Score: A (100/100) · GitHub · npm

3. MCP Server for Data Exploration

The most-starred pure data-analysis server, and the go-to for turning a raw CSV into insight. Load a file into a pandas DataFrame, then run arbitrary Python — pandas, numpy, matplotlib — against it, with results persisted in memory across calls. It ships an explore-data prompt so the model can go from CSV to summaries and charts without boilerplate. Purpose-built for ad-hoc EDA rather than being a generic database bridge.

Honest note: because it runs arbitrary Python, our scan flags two high-severity findings and a high capability level. That is inherent to a code-execution tool — review the findings on its registry page and sandbox it before pointing it at sensitive data.

MCP Trust Score: A (98/100) · GitHub · PyPI

4. MotherDuck / DuckDB MCP Server

DuckDB has become a de-facto standard for local analytical data science, and this official MotherDuck server connects an assistant straight to it — a local .duckdb file, an in-memory database, data on S3, or the MotherDuck cloud. It browses catalogs and runs read/write SQL, making it ideal for fast analytics over CSV and Parquet without spinning up a warehouse. A superb lightweight choice for exploration and pipeline work.

Clean grade with one high-severity finding and a high capability level (it can write, after all) — worth a glance on the registry page if you run it in read/write mode.

MCP Trust Score: A (98/100) · GitHub · PyPI

5. ClickHouse MCP Server

The official ClickHouse server runs analytical SQL against ClickHouse clusters, and sensibly defaults to read-only mode with writes opt-in. It also bundles chDB so you can query Parquet, CSV, and remote files in-process without a running cluster at all. When your datasets are large and columnar and you want interactive-speed exploration, this is the standard pick.

A clean scan: zero high-severity findings and a minimal capability level, helped by that read-only-by-default posture.

MCP Trust Score: A (98/100) · GitHub · PyPI

6. Qdrant MCP Server

For ML and RAG work, an agent often needs durable, searchable memory. The official Qdrant server provides exactly that: it embeds text (default all-MiniLM-L6-v2 sentence-transformers) and stores or retrieves it from a Qdrant vector collection, giving the model a persistent similar-document lookup. It's also a clean reference implementation of an embedding-backed MCP server if you're building your own.

Zero high-severity findings and a minimal capability footprint — one of the tidiest servers on this list.

MCP Trust Score: A (98/100) · GitHub · PyPI

7. Chroma MCP Server

Chroma is one of the most widely adopted embedding databases in ML tooling, and its official server exposes the full workflow: create collections, add documents, and retrieve via vector search, full-text search, and metadata filtering. It supports multiple embedding backends — default, OpenAI, Cohere, Jina, VoyageAI — and both local-persistent and Chroma Cloud modes. A common choice for giving agents working memory over a dataset.

Our scan is clean: no high-severity findings and a minimal capability level.

MCP Trust Score: A (98/100) · GitHub · PyPI

8. Optuna MCP Server

One of the few servers aimed squarely at the model-training side of ML. Optuna's official server exposes hyperparameter-optimization primitives as tools — create and load studies, suggest and report trials, and launch visualizations and the Optuna dashboard. That lets an LLM drive an automated tuning loop and then interactively explore optimization history and parameter importances by chatting about them. A genuine rarity: a first-party MCP for hyperparameter optimization.

Clean scan — zero high-severity findings and a minimal capability level.

MCP Trust Score: A (98/100) · GitHub · PyPI

9. Vizro MCP

Analysis is only useful if someone can see it. McKinsey's official Vizro server builds data-visualization dashboards and Plotly charts from natural language: it generates and validates Vizro configuration and returns live PyCafe preview links so you can view the dashboard immediately. It's the standout pick for turning results into polished, shareable, interactive visualizations.

A clean grade with zero high-severity findings and a minimal capability level.

MCP Trust Score: A (98/100) · GitHub · PyPI

10. DataHub MCP Server

In a larger organization, the hard question isn't "run this query" — it's "what data exists, where did it come from, and can I trust it?" Acryl Data's official server for the DataHub metadata platform answers exactly that. An agent can do data discovery, explore column- and table-level lineage, inspect schemas, and generate SQL over a governed catalog. It's the governance-aware layer that makes analytics defensible at scale.

It scores a perfect 100/100, with two high-severity findings and a high capability level flagged by our scan — reasonable for something that reaches deep into a metadata platform, but worth reviewing on its registry page before deployment.

MCP Trust Score: A (100/100) · GitHub · PyPI

11. MindsDB

MindsDB is the heavyweight of the list — a federated query engine with a built-in MCP server that lets an agent query and join across 200+ databases, warehouses, and SaaS sources through a single SQL-like interface. It also supports in-database ML: creating models, generating embeddings, and running predictions where the data lives. With ~38k stars and hundreds of contributors, it markets itself as an all-in-one MCP data gateway, and for breadth of connectivity nothing else here comes close.

That breadth costs it on our scan: it's the lowest grade on the list at 91/100 with five high-severity findings and a high capability level. That's a direct consequence of how much it can reach and do. It's still an A, but of everything here this is the one to review most carefully on its registry page — and to run with tightly scoped credentials — before granting it access.

MCP Trust Score: A (91/100) · GitHub · PyPI

How we graded these

Every score above comes from the MCP Trust Checker engine, which is deterministic and open source. It reads the actual published package source from npm or PyPI and analyzes what the server can do — its capabilities, data flows, and known risky patterns — using fixed rules rather than a language model. There is no LLM in the loop, so the same input always produces the same score: run it today or next month and an unchanged package grades identically. High-severity findings aren't hidden behind a good letter grade; they're counted separately and listed in full on each server's registry page. Browse them all at the MCP Trust Registry.

A high grade means the code is clean, not that a server is harmless in your environment. A server that executes Python or writes SQL is powerful by design — read its capability level and findings, then grant the narrowest access that gets the job done.

Want to go deeper? Browse every scanned tool in this category at the Data Science & ML registry, and scan any npm or PyPI package yourself — free — through the MCP Trust Checker API before you add it to your stack.

npx mcptrustchecker