PrefectCAUTION
Prefect MCP server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[!WARNING] This project is under active development and may change drastically at any time. This is an experimental MCP server for Prefect. APIs, features, and behaviors are subject to change without notice. We encourage you to try it out, provide feedback, and contribute. Please create issues or open PRs with your ideas and suggestions.
An MCP server for interacting with `prefect` resources.
The server gives MCP clients read-only tools for inspecting Prefect Cloud and self-hosted Prefect instances, plus a docs proxy so assistants can look up current Prefect CLI, SDK, and deployment guidance.
Choose Your Setup
See the agent setup guides for client-specific instructions and setup prompts, or give your agent the plain-text setup index.
ChatGPT Plugin and Claude Connector
Install the Prefect plugin in ChatGPT or connect the [Pref
9a87aca4fdc9OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add prefect-mcp -- None prefect-mcp==0.0.1-beta.13
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_release_notes | read | Get authoritative, structured release notes for a Prefect OSS release. |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (10 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (11)
.claude/skills/implement-eval
print(token)
base_url = f"http://127.0.0.1:{port}"return "http://127.0.0.1:4300"
"http://127.0.0.1:8100",
return "http://127.0.0.1:8000"
.pre-commit-config.yaml
uv.lock
The token response includes `expires_in`. Treat an agent as long-running if it may keep using the MCP connection longer than that returned lifetime. In that case, request a new token with the same cli
> **Important:** MCP server permissions and MCP client permissions are independent. MCP clients like Claude Code may also have shell access, which means the AI can invoke the `prefect` CLI directly. T
API-key usage remains supported for local, self-hosted, and custom deployments. Those modes are useful when you need self-hosted Prefect, custom network access, service-account credentials, or a serve
Gates applied: no_behavioural_pass.
9a87aca4fdc9full audit observations/trust-audit/mcp-server/prefecthq__prefect-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 9a87aca4fdc9 | CAUTION | B | 88 | first audit |
Questions
What is the Prefect MCP server?
Prefect MCP server
What tools does Prefect expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Prefect safe to connect to an agent?
With care. The audit graded it B (88/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Prefect need?
It reads OPENAI_API_KEY and TURBOPUFFER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Prefect run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as prefect-mcp.
How current is this page?
The grade is for one exact copy of the source (9a87aca4fdc9), read on 2026-10-08. The repository is watched and re-audited when it changes.