Airtable User MCP Server
airtable-user-mcp
npm
v2.5.0
Source verified
Published by automations-project — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Community MCP server for Airtable. Schema inspection, table / field / view CRUD (including merge-safe filter / sort / group updates), formula validation, and extension management. Not affiliated with Airtable Inc.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 6 = 94. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 9
high Shell/command execution in server code (src/cli.js)MTC-SRC-002
In the server's implementation (`src/cli.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFileSync } from 'child_process'; import { getHomeDir, getProfileDir } from './paths.js'; const __dirname = path.
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/cli.js
high Shell/command execution in server code (src/daemon/launcher.js)MTC-SRC-002
In the server's implementation (`src/daemon/launcher.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rt { spawn } from 'node:child_process'; import { randomUUID } from 'node:crypto'; import { existsSync, readFileSync } fr
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/daemon/launcher.js
high Shell/command execution in server code (src/daemon/token.js)MTC-SRC-002
In the server's implementation (`src/daemon/token.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: spawnSync } from 'node:child_process'; import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSy
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/daemon/token.js
high Shell/command execution in server code (src/daemon/tunnel-providers/cloudflared-named-setup.js)MTC-SRC-002
In the server's implementation (`src/daemon/tunnel-providers/cloudflared-named-setup.js:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nodeSpawn } from 'node:child_process'; import { dirname, join } from 'node:path'; import { homedir } from 'node:os'; i
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/daemon/tunnel-providers/cloudflared-named-setup.js
high Shell/command execution in server code (src/daemon/tunnel-providers/cloudflared-named.js)MTC-SRC-002
In the server's implementation (`src/daemon/tunnel-providers/cloudflared-named.js:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nodeSpawn } from 'node:child_process'; import { createInterface } from 'node:readline'; import { execFile as execFileCa
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/daemon/tunnel-providers/cloudflared-named.js
high Shell/command execution in server code (src/daemon/tunnel.js)MTC-SRC-002
In the server's implementation (`src/daemon/tunnel.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rt { spawn } from "node:child_process"; import { createInterface } from "node:readline"; import { execFile as execFileCa
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/daemon/tunnel.js
high Shell/command execution in server code (src/process-tree.js)MTC-SRC-002
In the server's implementation (`src/process-tree.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: execFileCb } from 'node:child_process'; import { promisify } from 'node:util'; import { setTimeout as delay } from 'node
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/process-tree.js
high Shell/command execution in server code (src/profile-lock.js)MTC-SRC-002
In the server's implementation (`src/profile-lock.js:24`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from 'node:child_process'; import { promisify } from 'node:util'; import { getHomeDir } from './paths.js';
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/profile-lock.js
medium Unconstrained URL/host parameter "url" on "upload_attachment"MTC-CAP-007
Tool "upload_attachment" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool upload_attachment · inputSchema.properties.url
Tools 74
Each tool and what it can reach — statically extracted from the published source.
download_base_formulasingests untrusted inputdownload_formula_fieldingests untrusted inputquery_recordsingests untrusted inputupload_attachmentingests untrusted inputairtable-user-mcpno sensitive capabilityapply_record_templateno sensitive capabilityapply_view_sortsno sensitive capabilitycreate_extensionno sensitive capabilitycreate_extension_dashboardno sensitive capabilitycreate_formula_fieldno sensitive capability
Show 64 more tools ↓
create_record_templateno sensitive capabilitycreate_recordsno sensitive capabilitycreate_tableno sensitive capabilitycreate_viewno sensitive capabilitycreate_view_sectionno sensitive capabilitydelete_fieldno sensitive capabilitydelete_fieldsno sensitive capabilitydelete_record_templateno sensitive capabilitydelete_recordsno sensitive capabilitydelete_tableno sensitive capabilitydelete_viewno sensitive capabilitydelete_view_sectionno sensitive capabilityduplicate_extensionno sensitive capabilityduplicate_fieldno sensitive capabilityduplicate_record_templateno sensitive capabilityduplicate_recordsno sensitive capabilityduplicate_viewno sensitive capabilityget_base_schemano sensitive capabilityget_table_schemano sensitive capabilityget_viewno sensitive capabilityinstall_extensionno sensitive capabilitylist_fieldsno sensitive capabilitylist_record_templatesno sensitive capabilitylist_tablesno sensitive capabilitylist_view_sectionsno sensitive capabilitylist_viewsno sensitive capabilitymanage_daemonno sensitive capabilitymanage_toolsno sensitive capabilitymove_overall_columnsno sensitive capabilitymove_view_to_sectionno sensitive capabilitymove_visible_columnsno sensitive capabilityNew Choiceno sensitive capabilityremove_extensionno sensitive capabilityrename_extensionno sensitive capabilityrename_fieldno sensitive capabilityrename_record_templateno sensitive capabilityrename_tableno sensitive capabilityrename_viewno sensitive capabilityrename_view_sectionno sensitive capabilityreorder_view_fieldsno sensitive capabilityset_calendar_date_columnsno sensitive capabilityset_form_metadatano sensitive capabilityset_form_submission_notificationno sensitive capabilityset_record_template_cellno sensitive capabilityset_record_template_visible_columnsno sensitive capabilityset_view_cell_wrapno sensitive capabilityset_view_color_configno sensitive capabilityset_view_columnsno sensitive capabilityset_view_coverno sensitive capabilityshow_or_hide_all_columnsno sensitive capabilityshow_or_hide_view_columnsno sensitive capabilitysync_baseno sensitive capabilityupdate_extension_stateno sensitive capabilityupdate_field_descriptionno sensitive capabilityupdate_formula_fieldno sensitive capabilityupdate_frozen_column_countno sensitive capabilityupdate_record_template_descriptionno sensitive capabilityupdate_recordsno sensitive capabilityupdate_view_descriptionno sensitive capabilityupdate_view_filtersno sensitive capabilityupdate_view_group_levelsno sensitive capabilityupdate_view_row_heightno sensitive capabilityvalidate_formulano sensitive capabilityXboxno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (74 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.5.0 latest |
A 94/100 | 9 | 1.13.0 | 2026-09-07 |
v2.4.15 |
A 94/100 | 6 | 1.12.1 | 2026-07-29 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan airtable-user-mcp --onlineMore in Other
A Model Context Protocol server implementation for AdGuard Home that enables AI agents to query and manage DNS records, filtering rules and more
Identity oracle and trust layer for autonomous AI agents. Bidirectional KYA and trust scoring.
MCP server with Airtable integration
A free one-minute reset for people, delivered by AI, with no account or personal data.
Access SEC filings efficiently, save time and tokens, and get cited answers.
A smart [MCP](https://modelcontextprotocol.io) server for [AniList](https://anilist.co) that gets your anime/manga taste - not just API calls.