What rankings score, and what decides blast radius
| Dimension | Scored by existing rankings | Scored here |
|---|---|---|
| Capability | Tool count | What the tools can change |
| Identity | Rarely mentioned | OAuth, token, or a credential in a file |
| Write posture | Absent | What the server does with no flags set |
| Governance | Assumed | Whether platform policy survives the hop |
A vendor that places itself first wrote five of the seven ranking pages we checked, and none scores the auth model. Our Model Context Protocol hub covers the protocol itself.
The scorecard
Auth, write posture, and status come from each vendor's own documentation as of late August 2026. Directional, not lab numbers.
| Server | Auth model | Writes by default | Governance | Status |
|---|---|---|---|---|
| Colrows | Governed by the graph | No | Compile-time | Available |
| Snowflake managed | OAuth 2.0 | No, configurable | Snowflake RBAC per tool | GA |
| Databricks managed | OAuth on-behalf-of user | No, Genie tools read-only | Unity Catalog | Beta or Public Preview |
| GoodData | API token, Bearer | Yes | Workspace permissions | Live since Jan 2026 |
| Apache Superset | JWT | Yes, preview-first | Superset RBAC | Version unresolved |
| Power BI remote | Microsoft Entra ID | No, read-only | Fabric RBAC, with a gap | Public preview |
| Power BI Modeling, local | Entra or service principal | Yes, read-write is default | Model-level | Public preview |
| ClickHouse | Token or OAuth on HTTP | No, env var unlocks | Credential scope only | Active |
| Postgres MCP Pro | Connection URI at startup | Depends on mode | Credential scope only | Active |
Fix the Context, Not the Model. A well-governed semantic layer that understands business context creates more reliable AI-driven analytics than fine-tuning the model itself. MCP delivers that context to the agent. The protocol does not decide which context the agent may receive.
Two kinds of tool surface
Every server on this list falls into one of two groups, and the group matters more than the tool count.
Governed servers inherit a platform permission model. Databricks uses on-behalf-of user OAuth, so the agent gets exactly what the human gets and Unity Catalog does the rest. Snowflake grants privileges per tool. Its documentation also states that personal access tokens are not the recommended path, because a leaked token becomes a standing grant. Superset runs the full Superset role model behind JWT.
A credential scopes the raw servers, and nothing else does. ClickHouse and Postgres MCP Pro expose SQL execution against whatever the connection user can reach. There is no semantic layer and no policy engine in the path. Name Postgres MCP Pro precisely. Crystal DBA publishes it, not the PostgreSQL project. It carries an MIT licence and takes a connection URI at startup, with no per-session authentication.
The servers, by what they expose
1. Colrows - a governed tool surface
Colrows exposes questions rather than tables. The agent asks for a metric and the compiler resolves it, proves the join path, and applies row and column rules before SQL exists. The tool surface cannot express an unauthorised query, which is a different guarantee from refusing one. See why MCP is not enough.
2. Snowflake managed MCP - the most complete governed option
Snowflake reached general availability and exposes Cortex Agent, Cortex Analyst, Cortex Search, generic user-defined functions, and a SQL execution tool. Two published limits shape agent design: a server carries at most 50 tools, and responses truncate at 250 KB. Read Cortex Analyst alternatives for the layer beneath it.
3. Databricks managed MCP - governed, and not yet GA
Databricks exposes five endpoints covering Genie, AI search, SQL, and Unity Catalog functions. Genie tools stay read-only, and the agent authenticates on behalf of the user. Databricks chose the right design here. Its own pages disagreed on status in August 2026, showing Beta on one and Public Preview on another. Either way it is not general availability. See Databricks Genie alternatives.
4. GoodData MCP - broad, and write-capable
GoodData launched publicly on 21 January 2026 with roughly 22 tools spanning metadata, metric creation, alerts, scheduled exports, and chat. It authenticates with a Bearer API token and it can write. Label element results default to 100 and cap at 10,000.
5. Apache Superset MCP - open, and version-ambiguous
The official server exposes 20 tools across charts, dashboards, datasets, SQL Lab, and system checks, under Apache 2.0 and behind JWT. Superset applies its full role model, which makes it one of the better governed open options. Pin your version carefully. Apache serves the official documentation from an unreleased branch, and community forks expose far more tools.
6. Power BI - read the two servers separately
Microsoft ships two servers, and they behave very differently.
The remote server stays read-only over Entra ID and exposes four tools. One of those four requires a Copilot licence. The local Modeling server runs read-write by default, with read-only as an opt-in flag. Microsoft also documents that row-level security is not supported on the remote server under service principal authentication. That single line should decide how you deploy it. See Power BI Copilot alternatives.
7. ClickHouse and Postgres - useful, ungoverned
Both are small, well-built, and appropriate for a developer on their own machine. ClickHouse ships four tools and stays read-only until an environment variable says otherwise. Postgres MCP Pro offers a restricted mode that parses SQL so nothing can escape a read-only transaction. The design is genuinely thoughtful. Neither belongs in front of regulated data without a policy layer above it.
Why tool counts mislead
Rankings in this category lead with tool counts, and the number is close to meaningless. Three reasons.
- Community forks inflate it. The official Superset server exposes 20 tools. A community fork of the same product exposes 137. Comparing those two numbers tells you nothing about either.
- One powerful tool beats twenty narrow ones. A single run-SQL tool can do more, and more damage, than a dozen scoped metadata readers.
- Servers cap the count anyway. Snowflake allows at most 50 tools per server, so past a point the number stops describing capability and starts describing packaging.
Count what the tools can reach instead. A server with four read-only tools over a governed semantic model is safer than one with forty tools over a superuser connection.
Four questions before you connect one
- How does the agent prove who it is? OAuth on-behalf-of the user keeps the human permission model. A shared token creates a second, invisible identity.
- What is the default write posture? Not the capability, the default. Someone will deploy it without flags.
- Does row-level security survive the hop? Ask for the sentence in the docs. One major vendor documents that it does not, under one specific auth mode.
- What happens on the tenth tool call? Tool budgets, response truncation, and rate limits all shape whether a multi-step agent completes.
The MCP security risks post covers the attack surface, and MCP governance covers who decides what an agent may ask.
Where Colrows changes the math (our product)
Colrows exposes questions rather than tables, so the tool surface itself carries the policy. The compiler resolves a request against a typed semantic graph scoped to the caller. It proves the join path and applies row and column rules before SQL exists.
That ordering removes the three gaps above at once. There is no default write posture to misconfigure, because the surface cannot express a write. There is no row-level security to lose at the hop, because the scope produced the plan. And the audit record holds the exact statement that ran, not a refusal.
A note on the claims
Tool inventories, auth models, default write posture, and status come from each vendor's own documentation as of late August 2026. Where a vendor's pages disagree with each other we say so rather than pick the flattering one. Preview status in this category changes weekly. Colrows sells a competing product, and we wrote the sections above with that disclosed. We review this page quarterly.
Frequently asked questions
What is an MCP server for analytics?
An MCP server exposes your data platform to an AI agent as a set of callable tools over the Model Context Protocol. Instead of the agent guessing at an API, it sees a documented tool list such as list tables, run query, or ask metric. The protocol standardises how the agent connects. The protocol does not standardise what the agent may do once connected.
Which analytics MCP servers are generally available in 2026?
Snowflake published a managed MCP server as generally available, with Native Apps agents and MCP servers reaching general availability on 7 August 2026. GoodData launched publicly on 21 January 2026 and Qlik reached general availability on 10 February 2026. Databricks managed MCP was still labelled Beta or Public Preview across its own pages in late August 2026, so treat it as pre-general-availability.
Are MCP servers safe to give an AI agent?
That depends entirely on the server. Governed servers inherit the platform permission model, so Databricks uses on-behalf-of user authentication and Snowflake uses OAuth with per-tool privileges. A credential in a config file scopes the raw servers, and nothing more. Microsoft documents one gap plainly. Row-level security does not apply on the Power BI remote MCP server under service principal authentication. A gap of that shape is exactly what to check for.
Do MCP servers allow an agent to write data?
Some do, and at least one defaults to it. Microsoft ships a local Power BI Modeling MCP server where read-write is the default mode and read-only is opt-in. ClickHouse takes the opposite approach and requires an environment variable to unlock writes. Check the default posture rather than the capability list, because the default is what a rushed deployment will actually run.
