bintocher/mcp-superset

A comprehensive Model Context Protocol (MCP) server for Apache Superset. Gives AI assistants (Claude, GPT, etc.) full control over your Superset instance — dashboards, charts, datasets, SQL Lab, users, roles, RLS, and more — through 137 tools.
Comparison with Other Superset MCP Servers
| Feature | **mcp-superset** | superset-mcp | superset-mcp (Winding2020) | superset-mcp-server |
|---------|:-:|:-:|:-:|:-:|
| **Total tools** | **137** | 60 | 31 | 4 |
| Language | Python | Python | TypeScript | TypeScript |
| Dashboard CRUD | 15 tools | 5 | 8 | - |
| Dashboard native filters | **5 tools** | - | - | - |
| Chart CRUD | 11 tools | 5 | 7 | - |
| Database tools | 18 tools | 14 | 1 | 1 |
| Dataset tools | 11 tools | 3 | 7 | - |
| SQL Lab | 5 tools | 7 | 1 | 1 |
| **Security (users/roles)** | **26 tools** | 2 | - | - |
| **Row Level Security** | **5 tools** | - | - | - |
| **Groups** | **9 tools** | - | - | - |
| **Permissions audit** | **yes** | - | - | - |
| **Dashboard access grant/revoke** | **yes** | - | - | - |
| **Auto datasource_access sync** | **yes** | - | - | - |
| Reports & annotations | 10 tools | - | - | - |
| Tags | 7 tools | 7 | - | - |
| Asset export/import | yes | - | - | - |
| **Safety: confirmation flags** | **14 types** | - | - | - |
| **Safety: DDL/DML blocking** | **yes** | - | - | - |
| **Safety: system role protection** | **yes** | - | - | - |
| Transport | HTTP, SSE, stdio | stdio | stdio | stdio |
| Auth method | JWT + auto-refresh + CSRF | Username/password + token file | Username/password or token | LDAP |
| Superset versions | 6.0.1 | 4.1.1 | not specified | not specified |
| CLI with args | --host --port --transport | - | - | - |
| PyPI package | mcp-superset | superset-mcp | superset-mcp (npm) | - |
| uvx support | **yes** | - | - | - |
| License | MIT | MIT | - | Apache 2.0 |
| GitHub stars | new | 170 | 21 | 5 |
**Key differentiators:**
- Only MCP server with **full security management** (users, roles, RLS, groups, permissions audit)
- Only one with **built-in safety validations** (confirmation flags, DDL/DML blocking)
- Only one with **dashboard native filter management**
- Only one with **automatic datasource_access synchronization**
- Only one with **multiple transport options** (HTTP, SSE, stdio)
- Only one with **configurable CLI** (--host, --port, --transport, --env-file)
Features
- **137 MCP tools** covering the complete Superset REST API
- **Dashboard management** — CRUD, copy, publish/unpublish, export/import, embedded mode, native filters
- **Chart management** — CRUD, copy, data retrieval, export/import, cache warmup
- **Database management** — CRUD, connection testing, schema/table introspection, SQL validation
- **Dataset management** — CRUD, duplicate, schema refresh, export/import
- **SQL Lab** — query execution, formatting, cost estimation, results & CSV export
- **Security** — users, roles, permissions, Row Level Security (RLS), groups
- **Access control automation** — grant/revoke dashboard access with automatic datasource permission sync
- **Audit** — comprehensive permissions matrix (user x dashboards x datasets x RLS)
- **Tags, reports, annotations, saved queries** — full CRUD
- **Asset export/import** — full instance backup and restore
- **Built-in safety** — confirmation flags for destructive operations, DDL/DML blocking in SQL Lab
- **JWT authentication** with automatic token refresh and CSRF handling
- **Streamable HTTP, SSE, and stdio transports**
Quick Start
Installation
Configuration
Create a .env file in the current directory, or set environment variables:
Session-cookie authentication (SSO/OAuth)
When Superset is behind SSO (OAuth/OIDC/SAML), password login via the REST
API is unavailable. Instead, supply a browser **session cookie**:
| Variable | Description |
| --- | --- |
| SUPERSET_SESSION_COOKIE | Session cookie value copied from your browser. When set, this mode is used instead of username/password. |
| SUPERSET_SESSION_COOKIE_NAME | Cookie name. Defaults to session. |
Copy the cookie from your browser's dev tools (Application → Cookies →
your Superset domain → session). The MCP server sends it on every request
and fetches CSRF tokens with it. The session cannot be renewed server-side,
so when it expires you must paste a fresh value and restart the server.