{
  "slug": "io-github-motherduckdb-mcp-server-motherduck",
  "name": "io.github.motherduckdb/mcp-server-motherduck",
  "title": "mcp-server-motherduck",
  "description": "SQL analytics and data engineering for AI Assistants and IDEs",
  "version": "1.1.0",
  "publishedAt": "2026-10-07T14:43:37.460568Z",
  "updatedAt": "2026-10-07T14:43:37.460568Z",
  "repoUrl": "https://github.com/motherduckdb/mcp-server-motherduck",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "motherduckdb"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "pypi",
      "identifier": "mcp-server-motherduck",
      "version": "1.1.0",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "motherduck_token",
      "isSecret": true,
      "isRequired": false,
      "description": "Access token for MotherDuck connections (alternative to --motherduck-token)"
    },
    {
      "name": "MOTHERDUCK_TOKEN",
      "isSecret": true,
      "isRequired": false,
      "description": "Access token for MotherDuck connections (alternative to --motherduck-token)"
    },
    {
      "name": "HOME",
      "isSecret": false,
      "isRequired": false,
      "description": "Used by DuckDB for extensions and config. Override with --home-dir if not set."
    },
    {
      "name": "AWS_ACCESS_KEY_ID",
      "isSecret": true,
      "isRequired": false,
      "description": "AWS access key for S3 database connections"
    },
    {
      "name": "AWS_SECRET_ACCESS_KEY",
      "isSecret": true,
      "isRequired": false,
      "description": "AWS secret access key for S3 database connections"
    },
    {
      "name": "AWS_SESSION_TOKEN",
      "isSecret": true,
      "isRequired": false,
      "description": "AWS session token for temporary credentials"
    },
    {
      "name": "AWS_DEFAULT_REGION",
      "isSecret": false,
      "isRequired": false,
      "description": "AWS region for S3 database connections"
    },
    {
      "name": "AWS_ENDPOINT",
      "isSecret": false,
      "isRequired": false,
      "description": "AWS endpoint for S3 database connections"
    }
  ],
  "category": "databases",
  "subcategory": "sql",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/motherduckdb/mcp-server-motherduck"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "warn",
      "detail": "Asks for 5 secrets: motherduck_token, MOTHERDUCK_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account motherduckdb"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "mcp-server-motherduck 1.1.0 has no setup.py; nothing runs at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 39 files in mcp-server-motherduck 1.1.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 39 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (pypi)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"mcp-server-motherduck\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"mcp-server-motherduck==1.1.0\"\n      ]\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 536,
  "archived": false,
  "pushedAt": "2026-10-26T07:57:06Z",
  "review": {
    "package": "mcp-server-motherduck",
    "version": "1.1.0",
    "at": "2026-10-31",
    "files": 11,
    "lines": 1716,
    "verdict": "pass-with-notes",
    "summary": "Lets an AI run SQL on a local DuckDB file, an S3-hosted DuckDB file or your MotherDuck cloud databases. It only contacts MotherDuck or S3 when you configure them, and it has no telemetry. Read-only is the default for real databases, but DuckDB SQL can still read other files on your computer and fetch web addresses. The optional database-switching tool can escape read-only mode, so leave it off unless you need it.",
    "hosts": [
      {
        "host": "MotherDuck cloud (reached by DuckDB's motherduck extension)",
        "when": "only when --db-path is md:..., lazily on the first tool call",
        "sends": "the MotherDuck token, SQL queries, custom_user_agent mcp-server-motherduck/1.1.0, session_hint=mcp"
      },
      {
        "host": "Amazon S3 or AWS_ENDPOINT",
        "when": "only when --db-path is s3://..., on first connection",
        "sends": "AWS credentials from env (as a DuckDB secret) and S3 reads"
      },
      {
        "host": "DuckDB extension repository (extensions.duckdb.org)",
        "when": "INSTALL httpfs for s3:// paths (database.py:137), or DuckDB extension autoload",
        "sends": "extension download request (DuckDB dependency behaviour)"
      },
      {
        "host": "any URL named in a SQL query",
        "when": "if the model's SQL uses DuckDB's http/https/s3 reading functions",
        "sends": "HTTP requests chosen by the query"
      }
    ],
    "env": [
      {
        "name": "motherduck_token / MOTHERDUCK_TOKEN (or --motherduck-token)",
        "sent_to": "MotherDuck"
      },
      {
        "name": "AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_DEFAULT_REGION, AWS_ENDPOINT",
        "sent_to": "Amazon S3 / the configured S3 endpoint (s3:// paths only)"
      },
      {
        "name": "MCP_PORT, MCP_HOST, MCP_TRANSPORT, MCP_STATELESS_HTTP, MCP_DB_PATH, MCP_SAAS_MODE, MCP_READ_WRITE, MCP_EPHEMERAL_CONNECTIONS, MCP_MAX_ROWS, MCP_MAX_CHARS, MCP_QUERY_TIMEOUT, MCP_INIT_SQL, MCP_ALLOW_SWITCH_DATABASES, MCP_MOTHERDUCK_CONNECTION_PARAMETERS",
        "sent_to": "not sent; local settings"
      }
    ],
    "local": "Opens the DuckDB file given by --db-path (read-only by default). Reads --init-sql if it is a file path (database.py:245-248). Can override HOME (database.py:80-81). switch_database_connection (opt-in) can open or create any absolute-path DuckDB file. DuckDB SQL from execute_query can also read arbitrary local files (read_csv, read_text, etc.) and, on a writable connection, write files (COPY ... TO) or ATTACH other database files; the package does not set enable_external_access=false.",
    "exec": "None by the package. SQL is executed by DuckDB as designed; no shell, eval or dynamic imports.",
    "telemetry": "None in the package. MotherDuck receives a user agent (mcp-server-motherduck/1.1.0) and session_hint=mcp identifying the connection as coming from this server.",
    "tools": [
      "execute_query",
      "list_databases",
      "list_tables",
      "list_columns",
      "switch_database_connection (only with --allow-switch-databases)"
    ],
    "toolText": "clean (descriptions and the server instructions are accurate DuckDB guidance; tool annotations correctly mark execute_query destructive when read-write; no hidden or invisible text)",
    "deps": [
      "fastmcp",
      "mcp",
      "duckdb",
      "click"
    ],
    "findings": [
      {
        "severity": "note",
        "at": "mcp_server_motherduck/database.py:313-337",
        "what": "execute_query runs any SQL the model writes. Read-only mode (the default for files and MotherDuck) protects the database itself, but DuckDB's external access is left on, so a query can read any local file the user can read (e.g. read_text('C:/Users/.../secrets')) or fetch remote URLs. This creates a data-exfiltration path if the model is prompt-injected. SaaS mode (--motherduck-saas-mode) restricts this for MotherDuck."
      },
      {
        "severity": "note",
        "at": "mcp_server_motherduck/__init__.py:201-208",
        "what": "The default :memory: database needs --read-write and is fully writable. In that mode SQL can ATTACH any local DuckDB file read-write and COPY data to files on disk."
      },
      {
        "severity": "note",
        "at": "mcp_server_motherduck/tools/switch_database_connection.py:97-102",
        "what": "If --allow-switch-databases is on (it is off by default), switching to ':memory:' always produces a writable connection, even when the server runs read-only. That bypasses read-only mode, for example by then ATTACHing local files. The tool reports this only as a warning."
      },
      {
        "severity": "note",
        "at": "mcp_server_motherduck/database.py:261-302",
        "what": "The MotherDuck token is embedded in the connection string. The code takes care not to return or log it (user_db_path is surfaced instead), but DuckDB error messages returned to the model were not checked for whether they could echo the connection string."
      },
      {
        "severity": "info",
        "at": "mcp_server_motherduck/database.py:151-179",
        "what": "AWS credentials from env are formatted into a CREATE SECRET statement without escaping. This is env-controlled, not reachable from tool input; a quote in a secret would only break the statement."
      },
      {
        "severity": "info",
        "at": "mcp_server_motherduck/database.py:238-259,331,449",
        "what": "--init-sql (file or SQL string from the operator) is executed on every new connection, including each ephemeral one."
      },
      {
        "severity": "info",
        "at": "mcp_server_motherduck/server.py:28-30",
        "what": "The server icon file (assets/duck_feet_square.png) is not among the reviewed code files; it is only loaded as an image data URI if present."
      },
      {
        "severity": "info",
        "at": "(package)",
        "what": "pyproject.toml was not among the reviewed files; dependencies listed come from imports. Line counts use the manifest convention (newline count + 1 per file, i.e. the empty segment after a final newline is counted); every line of every file was read with the Read tool."
      }
    ]
  },
  "health": {
    "score": 78,
    "parts": {
      "popularity": 0.6627480124245467,
      "activity": 0.8333221939691484,
      "issues": 1,
      "security": 0.8
    },
    "fail": 0,
    "warn": 1,
    "raw": {
      "stars": 536,
      "forks": 90,
      "downloads": 4589,
      "hn": {
        "n": 0,
        "pts": 0,
        "t": []
      },
      "issuesOpen": 0,
      "issuesClosed": 22,
      "prsMerged": 41,
      "commits90": 10,
      "release": "2026-10-07T14:44:12Z",
      "pushed": "2026-10-26T07:57:06Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:42:38.200Z"
  },
  "icon": "/icons/s/io-github-motherduckdb-mcp-server-motherduck.jpg"
}