v1.4.1 — Fix dashboard card operations on Metabase ≥ v0.50

Patch release fixing a compatibility bug found while dry-running the v1.4.0 demo against a fresh Metabase v0.62 instance.

Fixed

add_card_to_dashboard and remove_card_from_dashboard failed with a 404 against every Metabase ≥ v0.50 (#51). The client used POST/DELETE /api/dashboard/:id/cards, which Metabase removed in v0.50. This also broke the link step of the write pipelines introduced in v1.4.0.

The client now tries the legacy endpoint first (for pre-v0.50 instances) and falls back to the modern PUT /api/dashboard/:id dashcards API on 404 — verified live against Metabase v0.62, with unit tests covering both paths.

If you're on v1.4.0 with a modern Metabase, upgrade — the 3-step "create card → create dashboard → link them" workflow now completes end-to-end.

Install

One-click

Download metabase-mcp-1.4.1.mcpb below, double-click in Claude Desktop.

npm

npx @ai-1luvc0d3/metabase-mcp@1.4.1

Full Changelog: v1.4.0...v1.4.1

v1.4.0 — Per-tool access control & write-capable pipelines

Fine-grained operational control and write-capable composition — the two biggest gaps identified in the July 2026 review against Metabase's official MCP (v0.62).

What's New

Per-tool access control — MCP_TOOLS_ALLOW / MCP_TOOLS_DENY

Server modes give coarse control; these refine it per tool. Denied tools are never registered with the MCP client, and the same policy is enforced on operations nested inside batch_execute and run_workflow — a denied tool can't be reached through a batch or pipeline. Deny always wins over allow.

# Expose read tools but never raw SQL
MCP_MODE=read
MCP_TOOLS_DENY=execute_query

The official Metabase MCP is an instance-wide on/off switch (see metabase/metabase#73907, #76628 requesting exactly this).

Write-capable batch & workflow pipelines

In write/full mode, batch_execute and run_workflow now accept the non-destructive write tools. One run_workflow call can create a card, create a dashboard, and link them:

{
  "steps": [
    { "name": "card", "tool": "create_card", "args": { "name": "MAU Trend", "database_id": 2, "sql": "SELECT ..." } },
    { "name": "dash", "tool": "create_dashboard", "args": { "name": "Growth" } },
    { "name": "link", "tool": "add_card_to_dashboard", "args": { "dashboard_id": "$dash.id", "card_id": "$card.id" } }
  ]
}

Write steps get the same guardrails as the standalone tools: write-tier rate limiting, SQL validation, per-operation audit logging. Deletes are never batchable — destructive actions stay explicit single calls.

Configurable tiered rate limits

RATE_LIMIT_READ_PER_MINUTE (120), RATE_LIMIT_WRITE_PER_MINUTE (30), RATE_LIMIT_LLM_PER_MINUTE (20). Fixes a bug where RATE_LIMIT_REQUESTS_PER_MINUTE was silently ignored — it now applies to the read tier as a legacy fallback.

⚠️ Breaking: Node.js >= 20 required

Node 18 (EOL April 2025) is no longer supported — the security-patched test toolchain requires Node >= 20.19. engines.node is now >=20.0.0; CI tests on Node 20/22/24.

Security & housekeeping

• All 24 Dependabot alerts cleared (npm audit: 0), including a critical vitest advisory (#46)
• Lint was silently broken since ESLint 9; migrated to flat config and added lint to CI (#47)
• README comparison updated for official Metabase MCP v0.61/v0.62, which added write operations (#42)
• MCP server metadata version was stale at 1.0.0; now reports correctly (#49)

What's Changed

• Per-tool access control + tiered rate-limit wiring (#43)
• Non-destructive write ops in batch/workflow (#48)
• README repositioning vs official MCP v0.62 (#42)
• Security dependency updates, Node 20/22/24 CI matrix (#46)
• ESLint 9 flat config + lint in CI (#47)
• Publish workflow fixed to run on Node 24 (#50)

Install

One-click

Download metabase-mcp-1.4.0.mcpb below, double-click in Claude Desktop.

npm

npx @ai-1luvc0d3/metabase-mcp@1.4.0

Full Changelog: v1.3.0...v1.4.0

v1.3.0 — CodeAct-inspired batch & workflow tools

Introduces CodeAct-inspired composable tools and makes compact responses the default. Inspired by Apple's CodeAct research and Cloudflare Code Mode.

What's New

batch_execute — parallel operations in one call

Run up to 20 read operations simultaneously. Ideal for fetching multiple dashboards, cards, or schemas in a single round trip.

{
  "operations": [
    { "tool": "get_dashboard", "args": { "dashboard_id": 1 } },
    { "tool": "get_dashboard", "args": { "dashboard_id": 2 } },
    { "tool": "execute_card", "args": { "card_id": 5 } }
  ]
}

run_workflow — composable multi-step pipelines

Chain tools sequentially with $stepName.path references to pipe outputs between steps. Eliminates multi-turn chatter for common data exploration flows.

{
  "steps": [
    { "name": "find", "tool": "search_content", "args": { "query": "revenue" } },
    { "name": "details", "tool": "get_card", "args": { "card_id": "$find.results[0].id" } },
    { "name": "data", "tool": "execute_card", "args": { "card_id": "$find.results[0].id" } }
  ]
}

Default compact responses

All tools now return compact JSON by default (~50% token reduction). Use format: "default" to opt into pretty-printed output.

What's Changed

• batch_execute tool — parallel execution of multiple read operations (#40)
• run_workflow tool — composable pipelines with output chaining and per-step error handling (#40)
• Compact responses by default — all 30 tools now use compact JSON (#40)
• 30 total tools (up from 28)

Install

One-click

Download metabase-mcp-1.3.0.mcpb below, double-click in Claude Desktop.

npm

npx @ai-1luvc0d3/metabase-mcp@1.3.0

Full Changelog: v1.2.0...v1.3.0

v1.2.0 — Token optimization & Streamable HTTP

Adds token-optimized compact response format and Streamable HTTP transport alongside stdio.

What's Changed

• Compact response format — new format: "compact" option on query/schema tools reduces token usage by ~50% (#38)
• Streamable HTTP transport — MCP server now supports HTTP in addition to stdio for remote deployments (#38)
• README repositioned vs Metabase's official MCP (v0.60) — clarifies our differentiation (#37)

Install

npm

npx @ai-1luvc0d3/metabase-mcp@1.2.0

Full Changelog: v1.1.1...v1.2.0

v1.1.1 - Directory compliance

Patch release bringing the repo into full compliance with Anthropic's MCP Directory Policy ahead of directory submission.

What's Changed

• Tool annotations on all 28 tools (#32) — every tool declares `readOnlyHint` or `destructiveHint` plus `title`, per MCP spec
• Privacy Policy section in README (#32) — documents what's collected, transmitted, and retained
• Troubleshooting and Support sections in README (#32)

Install

One-click

Download `metabase-mcp-1.1.1.mcpb` below, double-click in Claude Desktop.

npm

```bash
npx @ai-1luvc0d3/metabase-mcp@1.1.1
```

Full Changelog: v1.1.0...v1.1.1

v1.1.0 — One-click install

Highlights

One-click install via Claude Desktop Extension (.mcpb) — no more editing JSON config files. Download the .mcpb from this release, double-click, and Claude Desktop prompts for your Metabase URL + API key (stored in OS keychain).

What's New

• 🎁 .mcpb Claude Desktop Extension (#14, #29) — attached to this release as `metabase-mcp-1.1.0.mcpb`
• 📚 5 usage examples in README covering all tool categories (#30)

Install

One-click (recommended)

1. Download `metabase-mcp-1.1.0.mcpb` below
2. Double-click to install in Claude Desktop
3. Enter your Metabase URL and API key when prompted

Via npm

```bash
npx @ai-1luvc0d3/metabase-mcp@1.1.0
```

Full Changelog: v1.0.2...v1.1.0

v1.0.2

What's Changed

First fully automated npm publish via OIDC trusted publishing.

Changes since v1.0.1

• Fix: upgrade npm to v11+ in publish workflow so OIDC trusted publishing works correctly (#22)

Install

```bash
npx @ai-1luvc0d3/metabase-mcp
```

v1.0.1

What's Changed

First official GitHub release with automated npm publish via OIDC trusted publishing.

Highlights since initial publish (v1.0.0)

• Security hardening fixes (#4)
• README security section with data privacy notes (#5)
• Automated npm publish via OIDC trusted publisher (#6, #7)
• Status badges on README (#8)
• Fix: upgrade npm for OIDC publishing (#22)

Install

```bash
npx @ai-1luvc0d3/metabase-mcp
```