W&BBLOCK
The official implementation of the W&B Models and Weave MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Query and analyze your Weights & Biases data using natural language through the Model Context Protocol.
[](https://github.com/wandb/wandb-mcp-server/actions/workflows/ci.yml)
[](https://wandb.ai/wandb/mcp-server-ci/weave) [](https://wandb.ai/wandb/mcp-server-ci/weave)
What's new in 0.4
- Structured experiment queries and legacy GraphQL inputs work through the same
query_wandb_tool interface.
- Targeted summary/config reads and sparse multi-key history make it easier
d75006fc7a58OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wandb_mcp_server --env DD_API_KEY=${DD_API_KEY} --env MCP_AUTH_DISABLED=${MCP_AUTH_DISABLED} --env MCP_SERVER_SECRETS_PROJECT=${MCP_SERVER_SECRETS_PROJECT} --env MCP_SERVER_SECRETS_PROVIDER=${MCP_SERVER_SECRETS_PROVIDER} -- uvx wandb_mcp_server{
"mcpServers": {
"wandb_mcp_server": {
"command": "uvx",
"args": [
"wandb_mcp_server"
],
"env": {
"DD_API_KEY": "${DD_API_KEY}",
"MCP_AUTH_DISABLED": "${MCP_AUTH_DISABLED}",
"MCP_SERVER_SECRETS_PROJECT": "${MCP_SERVER_SECRETS_PROJECT}",
"MCP_SERVER_SECRETS_PROVIDER": "${MCP_SERVER_SECRETS_PROVIDER}"
}
}
}
}Exposed tools (21)
17 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
create_wandb_report_tool | write | time.sleep(0.05) |
exception_tool | read | raise ValueError( |
failing_tool | read | raise ValueError( |
healthy_tool | read | return |
legacy | read | return payload |
list_entities_tool | write | started.set() |
local_async_tool | read | return await run_sync_in_current_tool(lambda: observed_threads.append(threading.get_ident()) or |
local_sync_tool | write | observed_threads.append(threading.get_ident()) |
log_analysis_to_wandb | read | error = RuntimeError( |
nested_helper_tool | read | with track_tool_execution( |
query_public_tool | read | with track_tool_execution( |
query_wandb_tool | read | backend() |
query_weave_traces_tool | read | def blocking_sdk_call() -> str: |
read | read | return { |
read_tool | read | request = httpx.Request( |
slow_async_tool | read | await asyncio.sleep(1) |
slow_local_tool | read | await asyncio.sleep(1) |
slow_tool | read | await asyncio.sleep(0.05) |
structured_error_tool | read | return json.dumps( |
sync_tool | write | return threading.current_thread().name |
untrusted_error_tool | read | return json.dumps({ |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
print("No W&B API key found in WANDB_API_KEY, .netrc, or .env.", file=sys.stderr)"4. .netrc file: machine api.wandb.ai login user password YOUR_KEY\n"
nrc = netrc.netrc(netrc_path)
for filepath in ("~/.netrc", "~/_netrc"):"W&B API key was not found through command-line arguments, .netrc, or WANDB_API_KEY environment variable. "
logger.info(f"API Key configured: {'Yes' if api_key else 'No'}")"HTTP_PROXY": "http://127.0.0.1:9",
"HTTPS_PROXY": "http://127.0.0.1:9",
"ALL_PROXY": "http://127.0.0.1:9",
"http_proxy": "http://127.0.0.1:9",
api_key = "explicit-super-secret-token"
api_key = "explicit-super-secret-token"
api_key = "boundary-super-secret-token"
secret = "oversized-error-secret-token"
SECRET = "test-secret-api-key-123456"
.pre-commit-config.yaml
restored = pickle.loads(pickle.dumps(record))
curl --fail http://127.0.0.1:8080/health
<a href="https://cursor.com/en/install-mcp?name=wandb&config=eyJ0cmFuc3BvcnQiOiJodHRwIiwidXJsIjoiaHR0cHM6Ly9tY3Aud2l0aHdhbmRiLmNvbS9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIge3tXQU5EQl9BUEl
raw = base64.b64decode((encoded + padding).encode("ascii"), altchars=b"-_", validate=True)decoded = base64.b64decode(value + ("=" * (-len(value) % 4)), altchars=b"-_", validate=True)ranks[base64.b64decode(token, validate=True)] = int(rank)
raw = base64.b64decode((encoded + padding).encode("ascii"), altchars=b"-_", validate=True)curl -LsSf https://astral.sh/uv/install.sh | sh
src/wandb_mcp_server/data/cl100k_base.tiktoken
Gates applied: no_behavioural_pass.
d75006fc7a58full audit observations/trust-audit/mcp-server/wandb__w-b.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | d75006fc7a58 | BLOCK | D | 62 | first audit |
Questions
What is the W&B MCP server?
The official implementation of the W&B Models and Weave MCP server.
What tools does W&B expose?
21 in total: 17 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is W&B safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does W&B need?
It reads DD_API_KEY, MCP_AUTH_DISABLED, MCP_SERVER_SECRETS_PROJECT, MCP_SERVER_SECRETS_PROVIDER and WANDB_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does W&B run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as wandb_mcp_server.
How current is this page?
The grade is for one exact copy of the source (d75006fc7a58), read on 2026-10-07. The repository is watched and re-audited when it changes.