Atlas / MCP servers / imgwho / Cwtwb

CwtwbBLOCK

Name: Cwtwb
Author: imgwho

mcp/imgwho/cwtwb

MCP server by imgwho · Audited 2026-10-08

⚑ Report / re-scan Source ↗

A Python-based engine that enables Text-to-Tableau twb dashboards generation.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

82 35r · 42w · 5d

Transport

stdio

License

AGPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Tableau workbook engineering for reproducible .twb / .twbx generation, validation, and migration.

cwtwb is a Python toolkit and Model Context Protocol (MCP) server for building Tableau Desktop workbooks from code or agent tool calls.

It is meant to be a workbook engineering layer, not a conversational analytics agent. The focus is reproducibility, inspectability, and safe automation in local workflows, scripts, and CI.

Design Workflow Reference

The agent design workflow and the design_advisor skill are informed by Adam Mico's adammico-lab Tableau workflow skills, especially Tableau Dashboard Blueprint's build-from-a-design-spec approach. cwtwb independently adapts those ideas to reproducible .twb / .twbx authoring; it does not depend on, bundle, or copy adammico-lab code or skill content. cwtwb is not affiliated with Adam Mico, Salesforce, or Tableau.

The cw in cwtwb comes from Cooper Wenhua.

Author: Cooper Wenhua <[email protected]>

Website · Source · Changelog

[](https://pepy.tech/projects/cwtwb) [](https://datacooper.com) [](https://github.com/aidatacooper/cwtwb) [![License](https://img.shie

Read from source at commit fc0d542c6f63OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add cwtwb -- uvx cwtwb

claude-desktop

{
  "mcpServers": {
    "cwtwb": {
      "command": "uvx",
      "args": [
        "cwtwb"
      ]
    }
  }
}

Exposed tools (82)

35 read · 42 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_calculated_field`	write	Add a calculated field to the datasource.
`add_combined_set`	write	Union existing native sets at the same dimension grain.
`add_dashboard`	write	Create a dashboard combining multiple worksheets.
`add_dashboard_action`	write	Add a filter, highlight, URL, navigation, or parameter dashboard action.
`add_dashboard_extension`	write	Add a native dashboard extension with structured manifest and settings.
`add_dashboard_set_action`	write	Add a Set Action (edit-group-action) to a dashboard.
`add_dashboard_toggle_button`	write	Show/hide a dedicated dashboard sheet container with a native button.
`add_group`	write	Create a categorical dimension by grouping source-field members.
`add_hierarchy`	write	Create an ordered Tableau drill hierarchy from bare dimension fields.
`add_hyper_datasource`	write	Add and activate another independent extracted data source.
`add_parameter`	write	Add a parameter to the workbook.
`add_reference_band`	write	Add a constant or field-backed native filled band on an existing axis.
`add_reference_line`	write	Add a field-backed reference line to a configured worksheet pane.
`add_set`	write	Create a Tableau set (datasource filter-group) for membership logic.
`add_worksheet`	write	Add a new blank worksheet to the workbook.
`analyze_twb`	read	Analyze an existing TWB/TWBX file against cwtwb
`apply_twb_migration`	write	Apply a workbook migration and write a migrated TWB plus reports.
`apply_worksheet_refactor`	write	Rewrite one worksheet to use replacement fields without touching others.
`audit_calculated_fields`	read	Report calculated-field datatype/role contradictions without mutation.
`clone_worksheet`	read	Clone an existing worksheet and its worksheet window.
`configure_chart`	read	Configure chart type and field mappings for a worksheet.
`configure_chart_recipe`	read	Configure a showcase recipe chart through the shared recipe registry.
`configure_custom_label`	write	Set rich literal/field mark labels while preserving pane calculation context.
`configure_custom_tooltip`	write	Set formatted text/field runs or embedded sheets with explicit filter_fields.
`configure_datasource_blend`	read	Link independently aggregated sources in a worksheet without a join.
`configure_dual_axis`	read	Configure a dual-axis chart composition.
`configure_layered_chart`	read	Build layered panes with encodings, ordered values and native styles.
`configure_subtotals`	read	Configure visual subtotals and per-dimension subtotal labels.
`configure_worksheet_domain_range`	read	Complete missing dates for discrete exact-date fields; [] disables completion.
`configure_worksheet_style`	write	Apply worksheet-level styling: background color, axis/grid/border visibility.
`configure_worksheet_time_series`	read	Extend a continuous date domain and allow calculations on added periods.
`copy_default_device_layout`	read	Preserve default geometry in a custom Phone/Tablet layout with shared IDs.
`create_workbook`	write	Create a new workbook from a TWB or TWBX template file.
`describe_capability`	read	Describe one declared capability and its support tier.
`diff_template_gap`	read	Summarize the non-core capability gap of a TWB template.
`enable_automatic_phone_layout`	write	Derive a scrolling Phone layout from the default dashboard objects.
`enable_domain_completion`	write	Add an INDEX() detail table calculation to trigger Tableau densification.
`generate_gallery_layout`	read	Bind exact worksheet names to a Gallery template and validate the layout DSL.
`generate_layout_json`	write	Generate and save a dashboard layout file.
`generate_layout_yaml`	write	Generate and save a dashboard layout YAML file.
`get_mcp_status`	read	Report cwtwb MCP server version, workbook state, and safe usage guardrails.
`import_blended_field`	write	Define a primary aggregate proxy for a secondary source field.
`initialize_dashboard_filter_action`	read	Initialize an existing native filter action
`inspect_excel_connection`	read	Preview how an Excel workbook will be interpreted before connection setup.
`inspect_target_schema`	read	Inspect the first-sheet schema of a target Excel datasource.
`link_worksheet_filters`	read	Link matching categorical filters so one control filters all given sheets.
`list_capabilities`	read	List cwtwb
`list_dashboards`	read	List dashboards and their worksheet zones in the current workbook.
`list_fields`	read	List all available fields in the current workbook datasource.
`list_gallery_templates`	read	List packaged Gallery layouts and their explicit worksheet slots.
`list_worksheets`	read	List worksheet names in the current workbook.
`open_workbook`	read	Open an existing workbook (.twb or .twbx) for in-place worksheet editing.
`preview_twb_migration`	read	Preview a workbook migration onto a target datasource.
`preview_worksheet_refactor`	read	Preview worksheet-scoped field rewrites without mutating the workbook.
`profile_twb_for_migration`	read	Profile workbook datasources and worksheet scope before migration.
`propose_field_mapping`	read	Scan source and target schema and propose a field mapping.
`recommend_gallery_templates`	read	Recommend compatible Gallery templates with scores and reasons.
`remove_calculated_field`	destructive	Remove a previously added calculated field.
`repair_calculated_field_issues`	write	Preview or explicitly apply selected calculated-field metadata repairs.
`save_workbook`	write	Save the active workbook as a .twb or .twbx file. Use a .twbx extension to produce a
`screenshot_workbook`	read	Screenshot a published workbook
`select_datasource`	read	Select the source for subsequent field and worksheet authoring.
`set_compound_color_palette`	write	Map ordered categorical tuples to colors, including Measure Names.
`set_csv_connection`	write	Configure the workbook datasource to use a local CSV connection.
`set_date_options`	write	Set datasource weekday origin for date-part headers and week calculations.
`set_excel_connection`	write	Configure the workbook datasource to use a local Excel connection.
`set_field_fiscal_year_start`	write	Set the native fiscal year starting month on a date field and dependencies.
`set_field_format`	destructive	Set or clear a field
`set_field_geographic_role`	destructive	Assign or clear a field
`set_geocoding_context`	write	Set geographic lookup context for generated map coordinates.
`set_hyper_connection`	write	Configure the workbook datasource to use a local Hyper extract connection.
`set_measure_name_aliases`	write	Alias actual Measure Names members, including table calculation measures.
`set_mysql_connection`	write	Configure the workbook datasource to use a local MySQL connection.
`set_shape_palette`	write	Embed local shape assets and map categorical members to the native palette.
`set_tableauserver_connection`	write	Configure the workbook datasource to use a Tableau Server connection.
`set_worksheet_caption`	destructive	Set or clear a plain-text worksheet caption.
`set_worksheet_hidden`	write	Hide or unhide a worksheet tab by updating worksheet window metadata.
`set_worksheet_title`	destructive	Set or clear the visible plain-text worksheet title.
`upload_workbook`	write	Publish a .twb/.twbx to Tableau Cloud for openability or screenshots.
`validate_formula`	read	Check Tableau function names without mutating the active workbook.
`validate_workbook`	read	Validate a workbook against the official Tableau TWB XSD schema.
`validate_workbook_api`	write	Validate a .twb file via Tableau Cloud REST API (no publish).

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (10 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (17)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/cwtwb/validate/uploader.py:586

url, headers=headers, files=files, verify=False

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/cwtwb/validate/uploader.py:651

url, headers=headers, files=files, verify=False

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/cwtwb/validate/uploader.py:696

url, headers=headers, params=params, verify=False

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/cwtwb/references/Sample - EU Superstore.hyper

Sample - EU Superstore.hyper

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/cwtwb/references/Sample _ Superstore.hyper

Sample _ Superstore.hyper

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

remove_calculated_field, set_field_format, set_field_geographic_role, set_worksheet_caption, set_worksheet_title

Why it matters. 5 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

src/cwtwb/dashboard_extensions.py:94

base64.b64decode(icon, validate=True)

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

src/cwtwb/shape_assets.py:77

if prior is not None and base64.b64decode(prior.text or "") != data:

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/test_shape_assets.py:46

base64.b64decode(n.text)

LOWPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

src/cwtwb/skills/validation.md:73

Use this path only when the user explicitly asks for upload/publish evidence,

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

CHANGELOG.md:400

- **Runtime credential selection hardened**: explicit `env_path` now takes priority over MCP process environment variables for Tableau validation/upload/screenshot calls, preventing stale server confi

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

README.md:397

| **4. Upload + Screenshot** | Publish to Tableau Cloud/Server and capture a view image | Tableau credentials + `pip install "cwtwb[validate]"` |

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine