// SCAN REPORT

Langfuse MCP Server

32 tools. 8 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 4 Jul 2026

8 can modify or destroy data

24 read-only

32 tools total

Community server · catalogue entry verified 04/07/2026

How to control Langfuse MCP Server ↓

TOOL MAP

What Langfuse MCP Server exposes to your agents

Read (24) Write / Execute (6) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Langfuse MCP Server tools

Destructive · High delete_dataset_item This tool permanently deletes data without the ability to undo the operation. Destructive · High write_delete_dataset_item This tool irreversibly deletes data from a dataset, which is the defining characteristic of the Destructive category. Write · Medium create_comment This tool creates new comments, which are metadata additions that can be modified or deleted later. Write · Medium create_dataset This tool creates a new dataset, which is a Write operation—it modifies system state by adding new persistent data.

8 of Langfuse MCP Server's 32 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Langfuse MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Langfuse MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_dataset_item": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "create_comment": {
    "limits": [
      {
        "counter": "create_comment_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_comment": {
    "limits": [
      {
        "counter": "get_comment_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Langfuse MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON LANGFUSE →

Instant setup, no code required.

FULL CATALOGUE

All 32 Langfuse MCP Server tools

DESTRUCTIVE 2 tools

Destructive delete_dataset_item ⚠️ DESTRUCTIVE: Delete a dataset item permanently from the dataset. Destructive write_delete_dataset_item ⚠️ DESTRUCTIVE: Permanently delete a dataset item. This write operation cannot be undone.

WRITE 6 tools

Write create_comment Create a new comment on traces, observations, sessions, or prompts. Write create_dataset Create a new dataset for organizing test data and examples. Write create_dataset_item Add a new item to a dataset with input/output examples. Write write_create_comment Create a comment on a trace, observation, session, or prompt. This write operation will modify your Langfuse p Write write_create_dataset Create a new dataset for organizing test data and examples. This write operation will modify your Langfuse pro Write write_create_dataset_item Add an item to a dataset with input/output examples. This write operation will modify your Langfuse project.

READ 24 tools

Read get_comment Get detailed information about a specific comment. Read get_cost_analysis Specialized cost breakdowns by model, user, and daily trends. Read get_daily_metrics Daily usage trends and patterns. Read get_dataset Get detailed information about a specific dataset by name. Read get_dataset_item Get detailed information about a specific dataset item. Read get_health_status Get system health status and availability information. Read get_metrics Query aggregated metrics (costs, tokens, counts) with flexible filtering and dimensions. Read get_model_detail Get detailed information about a specific AI model. Read get_observation_detail Get detailed information about a specific observation by ID. Read get_observations Get LLM generations/spans with details and filtering. Read get_projects List available Langfuse projects (alias for list_projects). Read get_prompt_detail Get detailed information about a specific prompt template. Read get_trace_detail Get detailed information about a specific trace including all observations. Read get_traces Fetch traces with flexible filtering options. Read list_comments List comments with filtering options for objects and users. Read list_dataset_items List items in datasets with filtering and pagination. Read list_datasets List all datasets in the project with pagination support. Read list_models List all available AI models in the Langfuse project. Read list_projects List configured Langfuse projects available to this MCP server. Read list_prompts List all prompt templates in the Langfuse project. Read project_overview Get a summary of total cost, tokens, and traces for a project over a time window. Read top_expensive_traces Find the most expensive traces by cost over a time period. Read usage_by_model Break down usage and cost by AI model over a time period. Read usage_by_service Analyze usage and cost by service/feature tag over a time period.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Langfuse MCP Server

Can an AI agent delete data through the Langfuse MCP Server MCP server? +

Yes. The Langfuse MCP Server server exposes 2 destructive tools including delete_dataset_item, write_delete_dataset_item. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Langfuse MCP Server? +

The Langfuse MCP Server server has 6 write tools including create_comment, create_dataset, create_dataset_item. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Langfuse MCP Server.

How many tools does the Langfuse MCP Server MCP server expose? +

32 tools across 3 categories: Destructive, Read, Write. 24 are read-only. 8 can modify, create, or delete data.

How do I enforce a policy on Langfuse MCP Server? +

Register the Langfuse MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Langfuse MCP Server tool call.

Deterministic rules across all 32 Langfuse MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON LANGFUSE →

Instant setup, no code required.

32 Langfuse MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.