Atlas / MCP servers / theseedship / DuckDB MCP Native

DuckDB MCP NativeBLOCK

Name: DuckDB MCP Native
Author: theseedship

mcp/theseedship/duckdb-mcp-node

MCP server by theseedship · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

55 /100

Exposed tools

61 49r · 11w · 1d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@seed-ship/duckdb-mcp-native) [](https://opensource.org/licenses/MIT)

Native TypeScript implementation of DuckDB MCP (Model Context Protocol) server with federation, graph algorithms, and human-in-the-loop security.

v1.7.0 — Security hardening update. DuckDB remains pinned to 1.5.4.

Security update: users of 1.6.2 and earlier should upgrade to 1.7.0 and enable MCP_SECURITY_MODE=production or MCP_SANDBOX=strict when SQL can be influenced by untrusted input. Restart the process after updating. Review the security settings and compatibility changes: strict mode disables external data access, including S3. We thank Zureno for reporting this issue through coordinated disclosure.

npm install @seed-ship/[email protected]

For CLI/MCP configurations using npx, select @seed-ship/[email protected] explicitly and restart the MCP client. Updating this package does not automatically update already installed or pinned versions.

Features

32+ MCP Tools: SQL queries, schema inspection, CSV/Parquet loading, federation, graph algorithms, process mining, data helpers
8 Graph Algorithm Tools: PageRank, eigenvector, community detection, modularity, weighted paths, temporal analysis, period comparison, multi-format export
Layered Security: production mode disables external access in DuckDB (including local files, HTTP and S3) and gates destructive SQL via HITL elicitation
Federation: Distributed queries across multiple MCP servers with mcp:// URIs
Virtual Filesystem: Direct SQL access via mcp:// URIs with auto-format detection
Transports: stdio, WebSocket, TCP (HTTP client-side)
Process Mining: 3 tools for workflow analysis from Parquet files
DuckLake-style Snapshots: built-in

Read from source at commit f75743121a12OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add duckdb-mcp-native --env MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY} --env MINIO_SECRET_KEY=${MINIO_SECRET_KEY} -- npx -y @seed-ship/[email protected]

claude-desktop

{
  "mcpServers": {
    "duckdb-mcp-native": {
      "command": "npx",
      "args": [
        "-y",
        "@seed-ship/[email protected]"
      ],
      "env": {
        "MINIO_ACCESS_KEY": "${MINIO_ACCESS_KEY}",
        "MINIO_SECRET_KEY": "${MINIO_SECRET_KEY}"
      }
    }
  }
}

Exposed tools (61)

49 read · 11 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`analyze_data`	read	Analyze data in a table with aggregations and statistics
`attach_mcp`	read	Attach an external MCP server
`catalog_name`	read	DuckLake catalog name
`checks`	read	Types of checks to perform (nulls, duplicates, ranges)
`columns`	read	Specific columns to analyze (optional)
`create_virtual_table`	write	Create a virtual table from an MCP resource
`data_quality_check`	read	Check data quality and integrity
`describe_table`	read	Get schema information for a table
`detach_mcp`	read	Detach an MCP server
`drop_virtual_table`	destructive	Drop a virtual table
`ducklake.attach`	write	Attach or create a DuckLake catalog for ACID transactions and time travel
`ducklake.snapshots`	read	List, view, clone or rollback table snapshots with version control
`ducklake.time_travel`	write	Execute queries on historical data at a specific point in time
`ducklake_time_travel`	read	Query historical data from DuckLake tables
`execute_query`	write	Run SQL query
`export_data`	read	Export query results to a file
`federate_query`	write	Execute federated queries across multiple MCP servers using mcp:// URIs
`graph.community_detect`	read	Detect communities using label propagation algorithm
`graph.compare_periods`	read	Compare graph structure between two time periods — find new, removed, strengthened, and weakened edges
`graph.eigenvector`	read	Compute eigenvector centrality scores using power iteration
`graph.export`	read	Export graph in multiple formats: json, csv (Gephi), d3, graphml, or parquet
`graph.modularity`	read	Compute modularity score Q for community structure quality
`graph.pagerank`	read	Compute PageRank centrality scores for graph nodes using iterative power method
`graph.temporal_filter`	read	Filter graph edges by time period and return graph statistics
`graph.weighted_path`	read	Find weighted paths between nodes: strongest (max weight product), cheapest (min cost), or combined (additive)
`json_to_parquet`	read	Convert JSON data to Parquet format with compression
`list_attached_servers`	read	List all attached MCP servers
`list_mcp_resources`	read	List resources from attached MCP servers
`list_tables`	read	List all tables in DuckDB
`list_virtual_tables`	read	List all virtual tables
`load_csv`	read	Load a CSV file into DuckDB
`load_parquet`	read	Load a Parquet file into DuckDB
`migrate_to_ducklake`	read	Migrate data from various formats to DuckLake
`motherduck.attach`	read	Connect to MotherDuck cloud instance
`motherduck.create_database`	write	Create a new database in MotherDuck
`motherduck.detach`	read	Disconnect from MotherDuck cloud
`motherduck.import_table`	write	Import a table from MotherDuck to local
`motherduck.list_databases`	read	List all databases in MotherDuck
`motherduck.query`	write	Execute a query on MotherDuck cloud
`motherduck.share_table`	read	Share a local table to MotherDuck cloud
`motherduck.status`	read	Get current MotherDuck connection status
`optimize_query`	read	Get query optimization suggestions
`process.compose`	read	Compose a unified action plan by merging steps from multiple processes
`process.describe`	read	Describe top-N processes ordered by confidence score
`process.similar`	read	Find similar processes using embedding-based vector similarity
`profile_parquet`	read	Profile a parquet file - get row count, column stats (min/max/avg/nulls/distinct), and sample data
`query`	read	SQL query to optimize
`query_duckdb`	write	Execute SQL queries on DuckDB
`query_hybrid`	write	Execute a hybrid query across local and virtual tables
`query_sql`	write	Execute SQL query
`refresh_virtual_table`	read	Refresh a virtual table with latest data
`sample_parquet`	read	Sample data from a parquet file using various sampling methods
`source_path`	read	Path to source file (CSV, Parquet, etc.)
`table_name`	read	Name of the table to analyze
`tcp_echo`	read	Echo message via TCP
`tcp_status`	read	Get TCP server status
`test_tool`	read	A test tool
`timestamp`	read	Point in time to query (ISO format or version number)
`tool1`	read	Test tool 1
`tool2`	read	Test tool 2
`ws_echo`	read	Echo tool for WebSocket

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (4 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (20)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/federation/QueryRouter.ts:327

await exec(sql)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/federation/QueryRouter.ts:345

await exec(sql)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/federation/QueryRouter.ts:369

await exec(`DROP TABLE IF EXISTS ${escapeIdentifier(table)}`)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

test-data/process/process_edges.parquet

process_edges.parquet

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

test-data/process/process_steps.parquet

process_steps.parquet

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

test-data/process/process_summary.parquet

process_summary.parquet

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

drop_virtual_table

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius