// SCAN REPORT

Metabase MCP Server

23 tools. 3 can modify or destroy data without limits.

3 write tools that can modify data. Rate limits recommended.

Last updated: 4 Jul 2026

3 can modify or destroy data

20 read-only

23 tools total

Community server · catalogue entry verified 04/07/2026

How to control Metabase MCP Server ↓

TOOL MAP

What Metabase MCP Server exposes to your agents

Read (20) Write / Execute (3) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Metabase MCP Server tools

Execute · High execute_card_query This tool executes queries against a database through Metabase. Execute · High execute_native_query This tool allows execution of arbitrary SQL queries against a database. Execute · High execute_query_builder_card This tool executes arbitrary query-builder cards with custom parameters, which constitutes triggering external database operations whose effects depend on the parameters provided.

3 of Metabase MCP Server's 23 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Metabase MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Metabase MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "get_activity": {
    "limits": [
      {
        "counter": "get_activity_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Metabase MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON METABASE →

Instant setup, no code required.

FULL CATALOGUE

All 23 Metabase MCP Server tools

EXECUTE 3 tools

Execute execute_card_query ▶️ [MODERATE RISK] Execute a saved card query and return results. Use this to get actual data from a card. May Execute execute_native_query ⚠️ [MODERATE RISK] Execute an ad-hoc native SQL query directly against a database. Use this when you need to r Execute execute_query_builder_card ⚙️ [MODERATE RISK] Execute a query-builder card with specific parameters. Use this to run query builder cards

READ 20 tools

Read get_activity 📜 [SAFE] Get recent activity feed showing views, edits, and other actions in Metabase. Use this to see what u Read get_card 🔍 [SAFE] Get a Metabase card/question by ID, including its SQL query. Use this when you need to see the SQL b Read get_card_with_parameters 🔗 [SAFE] Get a card with applied parameters from dashboard URL. Use this to extract card ID and parameters fr Read get_collection_items 📁 [SAFE] Get all items (cards, dashboards, models) in a specific collection. Use this to see what content is Read get_current_user 👤 [SAFE] Get information about the currently authenticated user (you). Risk: None - read-only operation. Read get_dashboard 📊 [SAFE] Get a dashboard by ID including all its cards, layout, and parameters. Use this to understand dashbo Read get_database 🗄️ [SAFE] Get database information by ID including engine type and connection details. Use this to understand Read get_database_metadata 🔍 [SAFE] Get complete metadata for a database including ALL tables, columns, and field types. This is compreh Read get_field 🔍 [SAFE] Get detailed information about a specific field/column including its type, description, and metadata Read get_field_values 🔍 [SAFE] Get distinct values for a field (useful for understanding what values exist in a column). May return Read get_generated_sql 📝 [MODERATE RISK] Get the generated SQL for a query-builder card with parameters. Use this to see the actual Read get_table_metadata 🔍 [SAFE] Get detailed metadata for a specific table including all columns, data types, and foreign key relati Read list_cards 📋 [SAFE] List Metabase cards/questions with optional filtering. Use this to discover available cards, find ca Read list_collections 📁 [SAFE] List all collections (folders) in Metabase. Collections organize cards and dashboards. Use this to u Read list_dashboards 📊 [SAFE] List all dashboards in Metabase. Use this to discover available dashboards or find dashboards by nam Read list_database_tables 📑 [SAFE] List all tables in a specific database. Use this to see what tables are available before querying. R Read list_databases 🗄️ [SAFE] List all available databases. Use this to see what data sources are connected to Metabase. Risk: No Read list_metrics 📊 [SAFE] List all metrics (saved aggregations) in Metabase. Metrics are reusable calculations like Read list_segments 🎯 [SAFE] List all segments (saved filters) in Metabase. Segments are reusable filters like Read list_users 👥 [SAFE - REQUIRES ADMIN] List all Metabase users. Requires admin permissions. Use this to see who has access

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Metabase MCP Server

Is the Metabase MCP Server MCP server safe to use without restrictions? +

The Metabase MCP Server server is primarily read-only with 20 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Metabase MCP Server MCP server expose? +

23 tools across 2 categories: Execute, Read. 20 are read-only. 3 can modify, create, or delete data.

How do I enforce a policy on Metabase MCP Server? +

Register the Metabase MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Metabase MCP Server tool call.

Deterministic rules across all 23 Metabase MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON METABASE →

Instant setup, no code required.

23 Metabase MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.