Atlas / MCP servers / felores / Airtable

AirtableBLOCK

Name: Airtable
Author: felores

mcp/felores/airtable

MCP server by felores · Audited 2026-10-07

Search, create and update Airtable bases, tables, fields, and records using Claude Desktop and MCP (Model Context Protocol) clients

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

12 5r · 6w · 1d

Transport

stdio

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol server that provides tools for interacting with Airtable's API. This server enables programmatic management of Airtable bases, tables, fields, and records through Claude Desktop or other MCP clients.

This MCP server features a specialized implementation that allows it to build tables in stages, leveraging Claude's agentic capabilities and minimizing the failure rate typically seen in other MCP servers for Airtable when building complex tables. It also includes system prompt and project knowledge markdown files to provide additional guidance for the LLM when leveraging projects in Claude Desktop.

Requirements: Node.js

Install Node.js (version 18 or higher) and npm from nodejs.org
Verify installation:

node --version
npm --version

⚠️ Important: Before running, make sure to setup your Airtable API key

Obtaining an Airtable API Key

Log in to your Airtable account at airtable.com
Create a personal access token at Airtable's Builder Hub
In the Personal access token section select these scopes:
data.records:read
data.records:write
schema.bases:read
schema.bases:write
Select the workspace or bases you want to give access to the personal access token
Keep this key secure - you'll need it for configuration

Installation

Method 1: Using npx (Recommended)

Navigate to the Claude configuration directory:

Windows: C:\Users\NAME\AppData\Roaming\Claude
macOS: ~/Library/Application Support/Claude/

You can also find these directories inside the Claude Desktop app: Claude Desktop > Settings > Developer > Edit Config

Create or edit claude_desktop_config.json:

{
"m

Read from source at commit 74ad4c590fbfOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add airtable-mcp-server --env AIRTABLE_API_KEY=${AIRTABLE_API_KEY} -- npx -y @felores/[email protected]

claude-desktop

{
  "mcpServers": {
    "airtable-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@felores/[email protected]"
      ],
      "env": {
        "AIRTABLE_API_KEY": "${AIRTABLE_API_KEY}"
      }
    }
  }
}

Exposed tools (12)

5 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`create_field`	write	Create a new field in a table
`create_record`	write	Create a new record in a table
`create_table`	write	Create a new table in a base
`delete_record`	destructive	Delete a record from a table
`get_record`	read	Get a single record by its ID
`list_bases`	read	List all accessible Airtable bases
`list_records`	read	List records in a table
`list_tables`	read	List all tables in a base
`search_records`	read	Search for records in a table
`update_field`	write	Update a field in a table
`update_record`	write	Update an existing record in a table
`update_table`	write	Update a table

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (2 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (10)

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

docs/Airtable API Documentation.md:1

# Airtable API Documentation

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

docs/Airtable API field types and cell values.md:1

# Field types and cell values

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_record

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

axios, @types/node, typescript

Why it matters. 3 dependency range(s) float

Fix. pin exact versions or ship a lockfile