Metabase MCP Server — agentic threat model

Not certain from the listing — The MCP server relies on external LLMs. The primary threat is prompt injection or adversarial manipulation of the model to execute unauthorized database queries or bypass intended query constraints.

The agent directly accesses Metabase dashboards, cards, and connected databases. This creates a high risk of data exfiltration, unauthorized data access, and potential database poisoning if write-back queries are permitted.

The server exposes tools for running queries and executing questions. Insecure tool integration or lack of input sanitization on the generated SQL/JSON queries could lead to direct database exploitation.

Not certain from the listing — The hosting environment of the MCP server must securely manage Metabase API credentials. Compromise of the server hosting this MCP would expose these credentials and database network paths.

Not certain from the listing — There is no mention of query logging, guardrails, or anomaly detection to monitor whether the LLM is executing anomalous or malicious database queries.

The agent authenticates using Metabase credentials. Security depends heavily on the principle of least privilege applied to these credentials, as the agent inherits the permissions of the authenticated Metabase user.

As an MCP server, this agent is designed to be called by other host agents. This introduces cascading risks where a compromised orchestrator agent can abuse this server to extract sensitive corporate BI data.