# list_cards

List questions/cards in Metabase. Returns up to 100 cards. Use search_content for discovery.

Agent View of the PolicyLayer registry record for `list_cards`. HTML page: https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-cards

## Facts

- Tool: `list_cards`
- Server: Metabase MCP (`1luvc0d3/metabase-mcp`) — https://policylayer.com/tools/1luvc0d3-metabase-mcp.md
- Homepage: https://github.com/1luvc0d3/metabase-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Allowed

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_cards",
    "arguments": {}
  }
}
```

## Why list_cards is rated Low

This tool performs a simple query/list operation to retrieve card metadata from Metabase. It has no capability to modify, delete, execute, or affect data. The blast radius is minimal—at worst, an agent could learn about available cards in the system, which is low sensitivity information. Confidence is high due to the clear read-only nature of the operation.

From the tool's own definition: "Tool description explicitly states 'List questions/cards in Metabase' and 'Returns up to 100 cards', which are read-only retrieval operations. No modifications, deletions, or side effects are mentioned."

## Use case

AI agents call list_cards to retrieve information from Metabase MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Metabase MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_cards": {}
  }
}
```

## Other tools on Metabase MCP (29)

- `delete_card` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/delete-card.md
- `delete_dashboard` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/delete-dashboard.md
- `remove_card_from_dashboard` — Destructive — https://policylayer.com/tools/1luvc0d3-metabase-mcp/remove-card-from-dashboard.md
- `ask_data` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/ask-data.md
- `batch_execute` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/batch-execute.md
- `execute_card` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/execute-card.md
- `execute_query` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/execute-query.md
- `nlq_to_sql` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/nlq-to-sql.md
- `run_workflow` — Execute — https://policylayer.com/tools/1luvc0d3-metabase-mcp/run-workflow.md
- `compare_metrics` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/compare-metrics.md
- `explain_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/explain-sql.md
- `generate_insights` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/generate-insights.md
- `get_card` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-card.md
- `get_collections` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-collections.md
- `get_dashboard` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-dashboard.md
- `get_database_schema` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/get-database-schema.md
- `list_dashboards` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-dashboards.md
- `list_databases` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/list-databases.md
- `optimize_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/optimize-sql.md
- `search_content` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/search-content.md
- `trend_analysis` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/trend-analysis.md
- `validate_sql` — Read — https://policylayer.com/tools/1luvc0d3-metabase-mcp/validate-sql.md
- `add_card_to_dashboard` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/add-card-to-dashboard.md
- `create_card` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-card.md
- `create_collection` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-collection.md
- `create_dashboard` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/create-dashboard.md
- `move_to_collection` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/move-to-collection.md
- `update_card` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/update-card.md
- `update_dashboard` — Write — https://policylayer.com/tools/1luvc0d3-metabase-mcp/update-dashboard.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=1luvc0d3-metabase-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/1luvc0d3-metabase-mcp