MCP · Business intelligence · Metabase
Metabase MCP Server
Ask questions of your Metabase content and databases from an AI host through the MCP server built into Metabase, scoped to your permissions.
Raw SQL reaches your databases. The agent:sql:run scope lets the client write and run raw SQL on connected databases. Do not grant it for routine questions.
Understand the tool
What it does.
Metabase includes an MCP server at /api/metabase-mcp on each instance, once an admin turns it on. Clients register themselves through OAuth, and each tool needs a scope such as reading content, running queries, running raw SQL or editing content.
Why use it?
Use it to find existing questions and dashboards or run a quick query without opening Metabase. Grant only the scopes the task needs; raw SQL and content editing are separate permissions.
A useful fit for
- Finding existing questions and dashboards
- Quick metric lookups
- Drafting new questions for review
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Find the right dashboard
A manager wants last quarter's churn but doesn't know where it lives.
- Search Metabase content for churn.
- List matching dashboards and questions.
- Open the best match in Metabase.
Intended outputThe existing, trusted dashboard instead of a new ad-hoc query.
Use case 02
Answer a quick metric question
Someone asks how many orders shipped yesterday.
- Find the orders model or question.
- Run it with yesterday's date filter.
- Report the number with the question it came from.
Intended outputA number traceable to a Metabase question.
A concrete starting point
Illustrative prompt: find existing content
Content search needs only the content-read scope.
Using the Metabase MCP server, search for dashboards and saved questions about customer churn. List each with its title, collection and last-edited date, and recommend which one to use. Do not run raw SQL or create, edit or move anything.What this can change
Metabase content and any query results enter the AI host and its model provider.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A Metabase instance with the MCP server turned on by an admin.
- A Metabase user account; access is scoped to that user's permissions.
- An MCP client that supports OAuth with self-registration.
- Authentication
- OAuth with the client registering itself; tokens are scoped to your Metabase permissions and the scopes you approve.
- Can read
- Metabase content and data structure (agent:content:read)
- Query results (agent:query:run) and raw SQL results (agent:sql:run) when granted
- Can write or change
- Content create, edit and trash (agent:content:write)
- Alerts and subscriptions (agent:delivery:write)
- Network and data flow
- Your Metabase instance and its connected databases
- AI host/model provider
- Approval and control
- Tool approval happens in the client, not in Metabase. Approve only the scopes the task needs; on Pro and Enterprise, admins can audit MCP use.
Check your environment
Compatibility, costs and license.
Compatibility notes
- MCP clients with OAuth self-registration
- Clients connected before Metabase 0.64 must sign in again after upgrading
- Per-instance endpoint
Costs and account requirements
The MCP server is part of Metabase; usage analytics are on Pro and Enterprise plans. Plan pricing applies to hosted and paid editions.
Current pricing or plan information ↗AGPL-3.0 (Open Source Edition); commercial license for paid editions
The Open Source Edition is AGPL; Enterprise Edition features need a commercial license. Hosted Metabase Cloud has its own terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Raw SQL reaches your databases
The agent:sql:run scope lets the client write and run raw SQL on connected databases. Do not grant it for routine questions.
Content edits are shared
agent:content:write can change or trash content others rely on. Keep it off unless needed.
Where it may fall short
- Not checkable by IonBin: each endpoint belongs to a specific instance and needs an admin to turn it on.
- Tool approval is in the client, not Metabase.
Observed behavior · 2026-10-18
Runtime and security findings.
Not checkable: the MCP endpoint belongs to a specific Metabase instance that an admin must turn on, so nothing was contacted.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Documented concern
Not checkable without an instance
Metabase documents the endpoint as /api/metabase-mcp on each instance, available once an admin turns it on.
In practice: Try it on a test instance with non-production data before connecting your main one.
Documented concern
Scopes separate reading, querying, SQL and editing
Each tool needs one of agent:content:read, agent:content:write, agent:query:run, agent:sql:run or agent:delivery:write.
In practice: Approve read and query scopes for routine use; grant SQL and write scopes only when needed.
Version, environment and fixture
- Version or deployment
- Not observed
- Tested target
- https://<your-metabase>/api/metabase-mcp (per-instance endpoint; not contacted)
- Artifact identity
- Not available: no endpoint or artifact was contacted for this record.
- Environment and fixture
- No account, instance or credentials available to IonBin for this product; nothing was contacted.
- Recorded October 18, 2026.
Checks and results
1 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationCould not complete
- Method
POST https://<your-metabase>/api/metabase-mcp without credentials.- Expected
- An unauthenticated request is rejected with OAuth discovery.
- Observed
- Not run: the endpoint exists only on a specific Metabase instance with the MCP server turned on, and IonBin has no such instance, so there was no endpoint to contact.
Practical caveats
- Behavior is as documented by Metabase; none was observed.
- MCP analytics are documented for Pro and Enterprise plans.
What this evaluation does not establish
- Any request to a Metabase MCP endpoint: each one is part of a specific Metabase instance, and IonBin has no instance with the MCP server turned on.
- OAuth consent, permission scopes, query execution, content writes, MCP analytics and prompt-injection resistance.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
Well designed, with per-tool scopes and user-level permissions, but ranked last because IonBin could not check any endpoint.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Documented setup, scopes and auditing
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Metabase MCP server docs ↗www.metabase.com
- Metabase licenses and terms ↗www.metabase.com
- Metabase pricing ↗www.metabase.com