For Metabase MCP Server
mcp-for-metabase
PyPI
v0.4.0
Published by dominikpollok — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 101
Each tool and what it can reach — statically extracted from the published source.
metabase_get_native_query_snippetreads sensitive datametabase_list_native_query_snippetsreads sensitive datametabase_add_dashboard_cardno sensitive capabilitymetabase_api_requestno sensitive capabilitymetabase_archive_cardno sensitive capabilitymetabase_archive_collectionno sensitive capabilitymetabase_archive_dashboardno sensitive capabilitymetabase_clear_cacheno sensitive capabilitymetabase_collection_treeno sensitive capabilitymetabase_connection_testno sensitive capability
Show 91 more tools ↓
metabase_copy_cardno sensitive capabilitymetabase_copy_dashboardno sensitive capabilitymetabase_copy_documentno sensitive capabilitymetabase_create_api_keyno sensitive capabilitymetabase_create_bookmarkno sensitive capabilitymetabase_create_cardno sensitive capabilitymetabase_create_card_public_linkno sensitive capabilitymetabase_create_collectionno sensitive capabilitymetabase_create_dashboardno sensitive capabilitymetabase_create_dashboard_public_linkno sensitive capabilitymetabase_create_documentno sensitive capabilitymetabase_create_native_query_snippetno sensitive capabilitymetabase_create_or_update_cardno sensitive capabilitymetabase_create_or_update_collectionno sensitive capabilitymetabase_create_or_update_dashboardno sensitive capabilitymetabase_create_or_update_native_query_snippetno sensitive capabilitymetabase_create_pulseno sensitive capabilitymetabase_create_segmentno sensitive capabilitymetabase_create_timelineno sensitive capabilitymetabase_create_timeline_eventno sensitive capabilitymetabase_create_userno sensitive capabilitymetabase_delete_api_keyno sensitive capabilitymetabase_delete_bookmarkno sensitive capabilitymetabase_delete_cardno sensitive capabilitymetabase_delete_card_public_linkno sensitive capabilitymetabase_delete_dashboardno sensitive capabilitymetabase_delete_dashboard_public_linkno sensitive capabilitymetabase_delete_documentno sensitive capabilitymetabase_delete_pulse_subscriptionno sensitive capabilitymetabase_delete_segmentno sensitive capabilitymetabase_delete_timelineno sensitive capabilitymetabase_delete_timeline_eventno sensitive capabilitymetabase_discover_operationsno sensitive capabilitymetabase_export_card_queryno sensitive capabilitymetabase_get_cache_configno sensitive capabilitymetabase_get_cardno sensitive capabilitymetabase_get_card_seriesno sensitive capabilitymetabase_get_dashboardno sensitive capabilitymetabase_get_dashboard_itemsno sensitive capabilitymetabase_get_database_metadatano sensitive capabilitymetabase_get_documentno sensitive capabilitymetabase_get_operationno sensitive capabilitymetabase_get_permission_groupno sensitive capabilitymetabase_get_permissions_graphno sensitive capabilitymetabase_get_pulseno sensitive capabilitymetabase_get_segmentno sensitive capabilitymetabase_get_settingno sensitive capabilitymetabase_get_settingsno sensitive capabilitymetabase_get_table_metadatano sensitive capabilitymetabase_get_timelineno sensitive capabilitymetabase_get_userno sensitive capabilitymetabase_invalidate_cacheno sensitive capabilitymetabase_list_api_keysno sensitive capabilitymetabase_list_bookmarksno sensitive capabilitymetabase_list_databasesno sensitive capabilitymetabase_list_documentsno sensitive capabilitymetabase_list_permission_groupsno sensitive capabilitymetabase_list_pulsesno sensitive capabilitymetabase_list_revisionsno sensitive capabilitymetabase_list_saved_snapshotsno sensitive capabilitymetabase_list_segmentsno sensitive capabilitymetabase_list_timelinesno sensitive capabilitymetabase_list_usersno sensitive capabilitymetabase_remove_dashboard_cardno sensitive capabilitymetabase_rescan_database_valuesno sensitive capabilitymetabase_restore_saved_snapshotno sensitive capabilitymetabase_restore_snapshotno sensitive capabilitymetabase_revert_revisionno sensitive capabilitymetabase_run_card_queryno sensitive capabilitymetabase_run_queryno sensitive capabilitymetabase_searchno sensitive capabilitymetabase_snapshot_entityno sensitive capabilitymetabase_sync_database_schemano sensitive capabilitymetabase_update_api_keyno sensitive capabilitymetabase_update_bookmark_orderingno sensitive capabilitymetabase_update_cache_configno sensitive capabilitymetabase_update_cardno sensitive capabilitymetabase_update_collectionno sensitive capabilitymetabase_update_dashboardno sensitive capabilitymetabase_update_dashboard_cardsno sensitive capabilitymetabase_update_dashboard_parametersno sensitive capabilitymetabase_update_databaseno sensitive capabilitymetabase_update_documentno sensitive capabilitymetabase_update_native_query_snippetno sensitive capabilitymetabase_update_permissions_graphno sensitive capabilitymetabase_update_pulseno sensitive capabilitymetabase_update_segmentno sensitive capabilitymetabase_update_settingno sensitive capabilitymetabase_update_timelineno sensitive capabilitymetabase_update_timeline_eventno sensitive capabilitymetabase_update_userno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (101 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.4.0 latest |
A 96/100 | 0 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan mcp-for-metabase --online --registry pypiMore in Business & CRM
Security scan results for the 21e14 MCP server.
Security scan results for the Agentgate Ucp MCP server.
Security scan results for the Autotask MCP server.
Security scan results for the B2c Dx MCP server.
Security scan results for the Brreg MCP server.
Security scan results for the Canlii MCP server.