dbtSAFE
A MCP (Model Context Protocol) server for interacting with dbt.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.bestpractices.dev/projects/11137)
This MCP (Model Context Protocol) server provides various tools to interact with dbt. You can use this MCP server to provide AI agents with context of your project in dbt Core, dbt Fusion, and dbt Platform.
Read our documentation here to learn more. This blog post provides more details for what is possible with the dbt MCP server.
Experimental MCP Bundle
We publish an experimental Model Context Protocol Bundle (dbt-mcp.mcpb) with each release so that MCPB-aware clients can import this server without additional setup. Download the bundle from the latest release assets and follow Anthropic's `mcpb` CLI docs to install or inspect it.
Feedback
If you have comments or questions, create a GitHub Issue or join us in the community Slack in the #tools-dbt-mcp channel.
Architecture
The dbt MCP server architecture allows for your agent to connect to a variety of tools.
Tools
SQL
Tools for executing and generating SQL on dbt Platform infrastructure.
execute_sql: Executes SQL on dbt Platform infrastructure with Semantic Layer support.text_to_sql: Generates SQL from natural language using project context.
Semantic Layer
To learn more about the dbt Semantic Layer, click here.
get_dimension_values: Gets distinct values for a dimension; option to scope to specific metrics.get_dimensions: Gets dimensions for specified metrics.get_entities: Gets entities for specified metrics.- `getmetrics
5c67e9c89d28OBSERVED · 2026-09-29Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add dbt-mcp --env DBT_TOKEN=${DBT_TOKEN} --env GOOGLE_GENAI_API_KEY=${GOOGLE_GENAI_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"dbt-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"DBT_TOKEN": "${DBT_TOKEN}",
"GOOGLE_GENAI_API_KEY": "${GOOGLE_GENAI_API_KEY}",
"OPENAI_API_KEY": "${OPENAI_API_KEY}"
}
}
}
}Exposed tools (1)
0 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
execute_sql | write | Execute a SQL query |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
.DS_Store
.changie.yaml
.mcpbignore
.pre-commit-config.yaml
.DS_Store
print(f"✅ Token: {'*' * len(token)}")const dbtMcpDir = path.resolve(__dirname, "../../..");
@ai-sdk/openai, @modelcontextprotocol/sdk, ai, @types/node, tsx, typescript
react, react-dom, @eslint/js, @types/react, @types/react-dom, @vitejs/plugin-react, eslint, eslint-plugin-react-hooks
Gates applied: no_behavioural_pass.
5c67e9c89d28full audit observations/trust-audit/mcp-server/dbt-labs__dbt.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-29 | 5c67e9c89d28 | SAFE | B | 89 | first audit |
Questions
What is the dbt MCP server?
A MCP (Model Context Protocol) server for interacting with dbt.
What tools does dbt expose?
1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is dbt safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does dbt need?
It reads DBT_TOKEN, GOOGLE_GENAI_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does dbt run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as dbt-mcp at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (5c67e9c89d28), read on 2026-09-29. The repository is watched and re-audited when it changes.