orange3-mcpSAFE
Tools for building and configuring Orange3 data-mining workflows and managing Orange3 add-ons, in two forms sharing the same core logic.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Tools for building and configuring Orange3 data-mining workflows and managing Orange3 add-ons, in two forms sharing the same core logic (src/orange3_mcp/workflow.py, widgets.py, addons.py):
- MCP server (below) — for MCP clients like Claude Desktop/Code.
- Web app — a self-contained Docker Compose deployment with a
browser GUI, for running on your own machine.
MCP server
An MCP server driven from any MCP client (e.g. Claude Desktop, Claude Code).
It does not require Orange3 itself to be installed: workflows are created and edited as in-memory graphs and serialized directly to Orange's .ows scheme XML format, so it works headless. Add-on management shells out to pip in whatever Python environment the server runs in — install Orange3 there if you want to open/run the workflows it produces.
What it does
- Workflows: create a scheme, add widget nodes, connect their input/output channels, set
widget properties, and save/load .ows files.
- Widget catalog: a curated set of ~50 core Orange3 widgets (Data, Visualize, Model, Evaluate,
Unsupervised) with their qualified class names and channel names. It's best-effort — verify by opening a saved workflow in Orange Canvas — and it's extensible (see below).
- Add-ons: list installed Orange3 add-ons, browse known community add-ons, and install/remove
them via pip. Install/uninstall ask for confirmation through the MCP client's own UI (MCP "elicitation") before touching the environment.
Install
pip install -e .
Requires Python 3.10+.
Run
As a standalone process (stdio transport):
orange3-mcp
Claude Desktop / Claude Code configuration
Add to your MCP client's server config (e.g. claude_desktop_config.json):
{
"mcpServers": {
"orange3": {
"commandb838fc909e64OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add orange3-mcp --env OPENAI_API_KEY=${OPENAI_API_KEY} -- uvx orange3-mcp{
"mcpServers": {
"orange3-mcp": {
"command": "uvx",
"args": [
"orange3-mcp"
],
"env": {
"OPENAI_API_KEY": "${OPENAI_API_KEY}"
}
}
}
}Exposed tools (16)
6 read · 7 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_node | write | Add a widget node to a workflow. `widget` may be a catalog id (e.g. |
connect_nodes | read | Connect an output channel of one node to an input channel of another. |
create_workflow | write | Create a new, empty Orange3 workflow and return its id. |
describe_workflow | read | Return the full current state (nodes, links) of a workflow. |
export_workflow | read | Return a workflow as .ows XML content for a client-side file/download. |
install_addon | write | Install (or upgrade) an Orange3 add-on via pip, after user confirmation. |
list_installed_addons | write | List Orange3 add-ons currently installed in this Python environment. |
list_widgets | read | List known Orange3 widgets, optionally filtered by category |
list_workflows | read | List all persisted workflows known to this server. |
load_workflow | read | Load an existing .ows file into a new in-memory workflow session. |
remove_link | destructive | Remove a link between two nodes. |
remove_node | destructive | Remove a node (and any links attached to it) from a workflow. |
save_workflow | write | Write an .ows file on the server and return its XML content for download. |
search_addons | write | Search known Orange3 add-ons (community plugins) by name/description substring. |
set_node_properties | write | Merge widget-specific configuration properties into a node (e.g. a file path |
uninstall_addon | destructive | Uninstall an Orange3 add-on via pip, after user confirmation. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (2)
remove_link, remove_node, uninstall_addon
Gates applied: no_behavioural_pass, no_license.
b838fc909e64full audit observations/trust-audit/mcp-server/flatmarstheory__orange3-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b838fc909e64 | SAFE | B | 89 | first audit |
Questions
What is the orange3-mcp MCP server?
Tools for building and configuring Orange3 data-mining workflows and managing Orange3 add-ons, in two forms sharing the same core logic.
What tools does orange3-mcp expose?
16 in total: 6 read-only, 7 that write, and 3 that can delete or overwrite (remove_link, remove_node, uninstall_addon). Every one is listed on this page with its risk.
Is orange3-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does orange3-mcp need?
It reads OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (b838fc909e64), read on 2026-10-12. The repository is watched and re-audited when it changes.