# add_card_to_dashboard

Add a card/question to a dashboard

Agent View of the PolicyLayer registry record for `add_card_to_dashboard`. HTML page: https://policylayer.com/tools/1luvc0d3-metabase-mcp/add-card-to-dashboard

## Facts

- Tool: `add_card_to_dashboard`
- Server: Metabase MCP (`1luvc0d3/metabase-mcp`) — https://policylayer.com/tools/1luvc0d3-metabase-mcp.md
- Homepage: https://github.com/1luvc0d3/metabase-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "add_card_to_dashboard",
    "arguments": {}
  }
}
```

## Why add_card_to_dashboard is rated Medium

This tool creates an association between a card and dashboard, changing the dashboard's composition. It is Write rather than Read (it modifies state), and not Destructive (the change is reversible—the card can be removed). The blast radius is medium because misconfiguration could clutter dashboards or expose unintended data views, but the operation is not irreversible and does not execute external code or move money.

From the tool's own definition: "Tool description states 'Add a card/question to a dashboard' — this modifies dashboard state by inserting a new element, a reversible write operation."

## Use case

AI agents use add_card_to_dashboard to create or update resources in Metabase MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Metabase MCP environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Metabase MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "add_card_to_dashboard": {
      "limits": [
        {
          "counter": "add_card_to_dashboard_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Metabase MCP (29)

- `delete_card` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/delete-card.md
- `delete_dashboard` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/delete-dashboard.md
- `remove_card_from_dashboard` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/remove-card-from-dashboard.md
- `ask_data` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/ask-data.md
- `batch_execute` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/batch-execute.md
- `execute_card` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/execute-card.md
- `execute_query` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/execute-query.md
- `nlq_to_sql` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/nlq-to-sql.md
- `run_workflow` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/run-workflow.md
- `compare_metrics` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/compare-metrics.md
- `explain_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/explain-sql.md
- `generate_insights` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/generate-insights.md
- `get_card` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-card.md
- `get_collections` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-collections.md
- `get_dashboard` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-dashboard.md
- `get_database_schema` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-database-schema.md
- `list_cards` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-cards.md
- `list_dashboards` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-dashboards.md
- `list_databases` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-databases.md
- `optimize_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/optimize-sql.md
- `search_content` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/search-content.md
- `trend_analysis` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/trend-analysis.md
- `validate_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/validate-sql.md
- `create_card` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-card.md
- `create_collection` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-collection.md
- `create_dashboard` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-dashboard.md
- `move_to_collection` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/move-to-collection.md
- `update_card` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/update-card.md
- `update_dashboard` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/update-dashboard.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=1luvc0d3-metabase-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/1luvc0d3-metabase-mcp