Tabularis

Overview

From the repository's own README, as read at the audited commit.

<div align="center">  <img src="public/logo-sm.png" width="120" height="120" /></div># tabularis<p align="center">  <strong>Tabularis is an open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including DuckDB, ClickHouse, Redis and Firestore.<br />  Its built-in MCP server lets Claude, Cursor and Devin (formerly Windsurf) read your schema and run queries in the same app you already use.</strong></p><p align="center">  <strong>README:</strong>  <a href="./README.md">English</a> |  <a href="./README.it.md">Italiano</a> |  <a href="./README.es.md">Español</a> |  <a href="./README.zh-CN.md">中文</a> |  <a href="./README.fr.md">Français</a> |  <a href="./README.de.md">Deutsch</a> |  <a href="./README.ja.md">日本語</a> |  <a href="./README.ru.md">Русский</a> |  <a href="./README.tl.md">Tagalog</a> |  <a href="./README.ko.md">한국어</a> |  <a href="./README.pt-BR.md">Português (Brasil)</a></p><p align="center">  ![](https://img.shields.io/github/release/TabularisDB/tabularis.svg?style=flat)![](https://img.shields.io/github/stars/TabularisDB/tabularis?style=flat)![](https://img.shields.io/github/downloads/TabularisDB/tabularis/total.svg?style=flat)![Build & Release](https://github.com/TabularisDB/tabularis/workflows/Release/badge.svg)[![Discord](https://img.shields.io/discord/1502944695808950282?color=5865F2&logo=discord&logoColor=white)](https://discord.com/invite/K2hmhfHRSt)[![Gitster](https://gitster.dev/api/repositories/badge/cmlko1jr60005ne4yh7i7oy3e)](https://gitster.dev/repo/TabularisDB/tabularis)<br /><br /><a href="https://vercel.com/open-source-program">  <img alt="Vercel OSS Program" src="https://vercel.com/oss/program-badge-2026.svg" /></a></p><p align="center">  <a href="https://snapcraft.io/tabularis"><img src="https://img.shields.io/badge/snap-tabularis-blue?logo=snapcraft" alt="Snap Store" /></a>  <a href="https://flatpark.org/apps/dev.tabularis.Tabularis/"><img src="https://img.shields.io/badge/flatpak-tabularis-4A90D9?logo=fl

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude mcp add plugin-api -- npx -y @tabularis/[email protected]

{
  "mcpServers": {
    "plugin-api": {
      "command": "npx",
      "args": [
        "-y",
        "@tabularis/[email protected]"
      ]
    }
  }
}

Exposed tools (2) 2 read · 0 write · 0 destructive

Details

Source

tabularisdb/tabularis

npm

@tabularis/plugin-api@0.1.2

License

Apache-2.0

Stars

4,981 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (6 observation(s))

Shell

declared (3 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

const fn = new Function(

const evaluate = new Function(

ssh_key_file: Some("/home/user/.ssh/id_rsa".to_string()),

private_key_path: Some("~/.ssh/id_rsa".into()),

<key>sshKeyLocation</key><string>/home/u/.ssh/id_ed25519</string>

.ends_with("id_ed25519"));

format!("~/.ssh/{}", trimmed)

let e = parse("jdbc:mysql://user:pw@host:3306/db?useSSL=true", "mysql").unwrap();

notebookUndo.ts

.agents/skills

"http://127.0.0.1:0",

readd_unlisted_installed(&mut reg, "http://127.0.0.1:0", &["my-local-plugin".to_string()])

let err = resolve_registry("http://127.0.0.1:0/registry.json", LEGACY_REGISTRY_URL, &[])

"http://127.0.0.1:7890"

"mysql://user%40domain:password%23123@host/db",

.node-version

.tabularium.tmpl

CLAUDE.md

import type { ExplainNode } from "../../src/types";

} from "../../src/parsers/mysql";

import { NodeIdAllocator } from "../../src/parsers/node";

} from "../../src/parsers/postgres";

import { detectFormat, parseExplain } from "../../src/parsers/source";

const binary = atob(padded);

const binaryString = atob(payload);

Gates applied: no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 398f7acb5774 · full audit: observations/trust-audit/mcp-server/tabularisdb__tabularis.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions