MCP server · Org-owned · Audited from source

Tabularis MCP server

by tabularisdb/tabularisApache-2.0 licenceAudited 21 Sep 2026 · source 2a98835a733d

npm @tabularis/plugin-api 0.1.2★ 5,011

✕BLOCKGrade F · 48/100 · 21 Sep 2026 · 2a98835

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (48/100). It exposes 6 tools: 6 read, 0 write and 0 destructive. The audit recorded 33 findings (0 critical, 8 high, 7 medium, 16 low). Maintainer's description: Open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including SQL Server, DuckDB, ClickHouse and Redis. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Tabularis MCP server (tabularisdb/tabularis)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/tabularisdb/tabularis

Why this is BLOCK. The audit found 0 critical and 8 high findings; the most severe is Code injection at src/contexts/PluginSlotProvider.tsx:100. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score48/100✕BLOCK F

0 critical8 high7 medium16 low2 info

33 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared6 observations
ShellDeclared3 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (33)

Sorted by severity · the 25 most severe of 33 are listed

HIGHCode injectioncode.eval_exec · src/contexts/PluginSlotProvider.tsx:100

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fn = new Function(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · src/utils/pluginExplainLoader.ts:57

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const evaluate = new Function(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHFilesystem / pathfs.credential_store · src-tauri/src/commands.rs:3257

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

ssh_key_file: Some("/home/user/.ssh/id_rsa".to_string()),

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src-tauri/src/connection_import/convert.rs:318

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

private_key_path: Some("~/.ssh/id_rsa".into()),

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src-tauri/src/connection_import/importer_tests.rs:203

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

<key>sshKeyLocation</key><string>/home/u/.ssh/id_ed25519</string>

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src-tauri/src/connection_import/importer_tests.rs:244

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

.ends_with("id_ed25519"));

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src-tauri/src/connection_import/mod.rs:142

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

format!("~/.ssh/{}", trimmed)

Why: touches a credential store
Fix: —

HIGHHard-coded secretssecret.db_uri · src-tauri/src/connection_import/datagrip/jdbc.rs:217

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInventory / provenanceinv.binary · src/utils/notebookUndo.ts

F-13 Inventory / provenanceCWE-1104Layer L0

notebookUndo.ts

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMInventory / provenanceinv.symlink · .agents/skills

F-13 Inventory / provenanceCWE-1104Layer L0

.agents/skills

Why: link not followed
Fix: —

MEDIUMNetwork egressnet.raw_ip · src-tauri/src/plugins/compat.rs:441

F-04 Network egressCWE-200 · CWE-319Layer L1

"http://127.0.0.1:0",

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src-tauri/src/plugins/compat.rs:453

F-04 Network egressCWE-200 · CWE-319Layer L1

readd_unlisted_installed(&mut reg, "http://127.0.0.1:0", &["my-local-plugin".to_string()])

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src-tauri/src/plugins/compat.rs:501

F-04 Network egressCWE-200 · CWE-319Layer L1

let err = resolve_registry("http://127.0.0.1:0/registry.json", LEGACY_REGISTRY_URL, &[])

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · src-tauri/src/proxy/resolve/tests.rs:84

F-04 Network egressCWE-200 · CWE-319Layer L1

"http://127.0.0.1:7890"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · tests/utils/connectionStringParser.test.ts:241

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .node-version

F-13 Inventory / provenanceCWE-1104Layer L0

.node-version

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · packages/create-plugin/templates/rust-driver/.tabularium.tmpl

F-13 Inventory / provenanceCWE-1104Layer L0

.tabularium.tmpl

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.symlink · CLAUDE.md

F-13 Inventory / provenanceCWE-1104Layer L0

CLAUDE.md

Why: link not followed
Fix: —

LOWFilesystem / pathfs.traversal · packages/explain/tests/parsers/mysql.test.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { ExplainNode } from "../../src/types";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/explain/tests/parsers/mysql.test.ts:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

} from "../../src/parsers/mysql";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/explain/tests/parsers/mysql.test.ts:9

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { NodeIdAllocator } from "../../src/parsers/node";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/explain/tests/parsers/postgres.test.ts:5

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

} from "../../src/parsers/postgres";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/explain/tests/parsers/postgres.test.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { detectFormat, parseExplain } from "../../src/parsers/source";

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · src/utils/aiActivity.ts:307

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const binary = atob(padded);

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · src/utils/blob.ts:325

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const binaryString = atob(payload);

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

6 declared in source · 0 destructive

6 read0 write0 destructive

Tool	What it does	Risk
`Firestore`	No description in the source	read
`MongoDB`	MongoDB driver	read
`PostgreSQL`	No description in the source	read
`Redis`	Redis driver	read
`Test`	No description in the source	read
`d`	x	read

Safer alternatives

All databases servers →

Memory Keeper✓SAFE

mkreyman/mcp-memory-keeper

MCP server for persistent context management in AI coding assistants

1 destructiveGrade B

Neo4j✓SAFE

neo4j-contrib/mcp-neo4j

Neo4j Labs Model Context Protocol servers

Grade B

MotherDuck✓SAFE

motherduckdb/mcp-server-motherduck

Local MCP server for DuckDB and MotherDuck

3 readGrade B

Audit history

2026-09-21
✕BLOCK F 48 / 100
Source changed, verdict held · 2a98835a733d
2026-09-18
✕BLOCK F 48 / 100
First audit · 398f7acb5774

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Tabularis MCP server

What is the Tabularis MCP server?

Open-source desktop SQL workspace with 3 built-in database drivers and 16 shipped plugins, including SQL Server, DuckDB, ClickHouse and Redis. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN.

What tools does Tabularis expose?

6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Tabularis safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (48/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Tabularis need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (2a98835a733d), read on 2026-09-21. The repository is watched and re-audited when it changes.

I already installed Tabularis. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

tabularisdb/tabularis on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 2a98835a733dObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Tabularis MCP server?
GChatGPT CClaude PPerplexity
What tools does Tabularis expose?
GChatGPT CClaude PPerplexity
Is Tabularis safe to connect to an agent?
GChatGPT CClaude PPerplexity