Skip to content

v1.4.0 — Per-tool access control & write-capable pipelines

Choose a tag to compare

View all tags
@1luvc0d3 1luvc0d3 released this 12 Jul 03:31
v1.4.0
2f5b434
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fine-grained operational control and write-capable composition — the two biggest gaps identified in the July 2026 review against Metabase's official MCP (v0.62).

What's New

Per-tool access control — MCP_TOOLS_ALLOW / MCP_TOOLS_DENY

Server modes give coarse control; these refine it per tool. Denied tools are never registered with the MCP client, and the same policy is enforced on operations nested inside batch_execute and run_workflow — a denied tool can't be reached through a batch or pipeline. Deny always wins over allow.

# Expose read tools but never raw SQL
MCP_MODE=read
MCP_TOOLS_DENY=execute_query

The official Metabase MCP is an instance-wide on/off switch (see metabase/metabase#73907, #76628 requesting exactly this).

Write-capable batch & workflow pipelines

In write/full mode, batch_execute and run_workflow now accept the non-destructive write tools. One run_workflow call can create a card, create a dashboard, and link them:

{
  "steps": [
    { "name": "card", "tool": "create_card", "args": { "name": "MAU Trend", "database_id": 2, "sql": "SELECT ..." } },
    { "name": "dash", "tool": "create_dashboard", "args": { "name": "Growth" } },
    { "name": "link", "tool": "add_card_to_dashboard", "args": { "dashboard_id": "$dash.id", "card_id": "$card.id" } }
  ]
}

Write steps get the same guardrails as the standalone tools: write-tier rate limiting, SQL validation, per-operation audit logging. Deletes are never batchable — destructive actions stay explicit single calls.

Configurable tiered rate limits

RATE_LIMIT_READ_PER_MINUTE (120), RATE_LIMIT_WRITE_PER_MINUTE (30), RATE_LIMIT_LLM_PER_MINUTE (20). Fixes a bug where RATE_LIMIT_REQUESTS_PER_MINUTE was silently ignored — it now applies to the read tier as a legacy fallback.

⚠️ Breaking: Node.js >= 20 required

Node 18 (EOL April 2025) is no longer supported — the security-patched test toolchain requires Node >= 20.19. engines.node is now >=20.0.0; CI tests on Node 20/22/24.

Security & housekeeping

  • All 24 Dependabot alerts cleared (npm audit: 0), including a critical vitest advisory (#46)
  • Lint was silently broken since ESLint 9; migrated to flat config and added lint to CI (#47)
  • README comparison updated for official Metabase MCP v0.61/v0.62, which added write operations (#42)
  • MCP server metadata version was stale at 1.0.0; now reports correctly (#49)

What's Changed

  • Per-tool access control + tiered rate-limit wiring (#43)
  • Non-destructive write ops in batch/workflow (#48)
  • README repositioning vs official MCP v0.62 (#42)
  • Security dependency updates, Node 20/22/24 CI matrix (#46)
  • ESLint 9 flat config + lint in CI (#47)
  • Publish workflow fixed to run on Node 24 (#50)

Install

One-click

Download metabase-mcp-1.4.0.mcpb below, double-click in Claude Desktop.

npm

npx @ai-1luvc0d3/metabase-mcp@1.4.0

Full Changelog: v1.3.0...v1.4.0

Assets 3
Loading