execute_query

What execute_query does on Metabase MCP

AI agents invoke execute_query to trigger actions in Metabase MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why execute_query is rated High

The tool's primary action is to execute code (SQL queries) whose effects depend on the arguments provided. Although the restriction to SELECT statements prevents destructive operations (DELETE, DROP), the ability to execute arbitrary SELECT queries remains an Execute-category risk: an AI agent could craft expensive queries, access sensitive data across tables, or trigger application-side effects.

From the tool's definition Tool description explicitly states it "Execute[s] a SQL query" and calls the operation "execute". While constrained to SELECT statements only (mitigating destructive risk), execution of arbitrary read queries against a database constitutes code execution with…

The rule that runs execute_query safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Metabase MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For execute_query, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "execute_query": {
      "limits": [
        {
          "counter": "execute_query_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about execute_query