Superset
Integrates with Apache Superset to enable data visualization, SQL query execution, dashboard management, and analytics workflows through authenticated API calls without leaving your conversational interface.
0Tools
14Findings
174Stars
Mar 19, 2026Last Scanned
5 critical · 7 high · 1 medium · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings14
5critical
7high
1medium
1low
Critical5
criticalN9MCP Logging Protocol InjectionMCP01-prompt-injectionAML.T0054
Pattern "(?:logger|logging)\s*\.\s*(?:info|warning|error|debug)\s*\(\s*(?:f"|f').*(?:result|output|response|tool_output|content)" matched in source_code: "logger.info(
f"Stored token is invalid (status {response" (at position 3503)
Sanitize all dynamic content before including in MCP log messages. MCP logging notifications (notifications/message) are displayed in client UIs — injection payloads in log data can influence AI behavior if the client processes logs as context. Strip control characters, ANSI escape codes, newlines, and prompt injection patterns from log content. Use structured logging with separate data fields.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "(?:mcp|fastmcp|langchain-mcp|llama-index-mcp)(?:>=|~=|==)?(?!\d)" matched in source_code: "mcp" (at position 460)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
criticalK5Auto-Approve / Bypass Confirmation PatternMCP06-excessive-permissionsAML.T0054
Pattern "(no|without)[_\s-]?(user|human)?[_\s-]?(confirm|approv|consent|interaction|intervention)" matched in source_code: "without user confirm" (at position 24443)
Never auto-approve or bypass human confirmation for operations with side effects. Implement explicit confirmation gates that cannot be programmatically bypassed. If batch/CI mode is needed, require an explicit opt-in flag with audit logging. Required by EU AI Act Art. 14 (human oversight) and OWASP ASI09.
criticalK8Cross-Boundary Credential SharingMCP05-privilege-escalationAML.T0054
Pattern "(return|respond|output|result).*(?:token|credential|api[_\s-]?key|secret|password|bearer)" matched in source_code: "result = await superset_auth_refresh_token" (at position 6773)
Never forward, share, or embed credentials across trust boundaries. Use OAuth token exchange (RFC 8693) to create scoped, delegated tokens instead of passing original credentials. Never include credentials in tool responses. Required by ISO 27001 A.5.17 and OWASP ASI03.
criticalL7Transitive MCP Server DelegationMCP06-excessive-permissionsAML.T0054
Pattern "(?:connect|initialize).*(?:mcp|modelcontextprotocol).*(?:server|endpoint|url)" matched in source_code: "Initialize FastMCP server" (at position 4087)
MCP servers MUST NOT create client connections to other MCP servers without explicit user disclosure. If delegation is required, declare all downstream servers in the server's capabilities and tool descriptions. Never forward user credentials to sub-servers. Implement a trust boundary between the approved server and any delegated servers. Log all transitive delegations for audit.
High7
highQ14Concurrent MCP Server Race ConditionMCP07-insecure-configT1068
Pattern "(?:tmp|temp|tmpdir|os\.tmpdir).*(?:write|create|exec)(?!.*(?:mkdtemp|exclusive|O_EXCL))" matched in source_code: "tempt to exec" (at position 5744)
MCP servers sharing filesystem or database backends with other servers must implement proper concurrency controls. Use: (1) file locking (flock/lockfile) for filesystem operations, (2) database transactions for all read-modify-write sequences, (3) atomic file operations (O_EXCL, mkdtemp) instead of check-then-create, (4) lstat() to detect symlinks before following (CVE-2025-53109). Never assume exclusive access to shared resources — other MCP servers may be operating concurrently.
highC3Server-Side Request Forgery (SSRF)MCP04-data-exfiltrationAML.T0057
Pattern "\bhttpx\.(?:get|post|put|delete|patch|head|options|request|AsyncClient|Client)\s*\([^)]*(?:req|request|input|param|params|args|url|uri|href|link|target|destination|endpoint|host|address|resource|src|source)" matched in source_code: "httpx.AsyncClient(base_url=SUPERSET_BASE_URL" (at position 2878)
Validate ALL user-supplied URLs before making HTTP requests:
1. Parse the URL and check the hostname against an explicit allowlist of permitted domains.
2. Block requests to RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
3. Block loopback (127.0.0.0/8), link-local (169.254.0.0/16), and IPv6 equivalents.
4. Block file:// and other non-http(s) protocols explicitly.
5. Disable automatic redirect following, or re-validate each redirect destination.
6. In cloud environments: block requests to IMDS endpoints (169.254.169.254,
metadata.google.internal) at both the application AND network layer.
Example (Node.js): Use the `ssrf-req-filter` package or implement URL validation
against an allowlist before calling fetch/axios/got.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "mcp@null" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
highK13Unsanitized Tool OutputMCP02-tool-poisoningAML.T0054
Pattern "(?:query|execute|select|find).*(?:return|respond|result|rows|data)(?!.*(?:sanitize|escape|encode|map|filter|select|pick))" matched in source_code: "execute (should be a callable that return" (at position 5986)
Sanitize all external data before including in tool responses. Implement output encoding that neutralizes prompt injection patterns. Truncate excessively long content. Validate structure before passing database results. Apply the principle: treat all external data as untrusted, even in tool outputs. Required by CoSAI MCP-T4.
highK18Cross-Trust-Boundary Data Flow in Tool ResponseMCP04-data-exfiltrationAML.T0054
Pattern "(?:readFile|read_file|query|select|getSecret|getCredential|getPassword).*(?:webhook|http|fetch|axios|post|send|email|slack|discord)" matched in source_code: "query/ POST" (at position 40918)
Implement data flow taint tracking: tag data from sensitive sources (databases, credentials, files) and prevent it from flowing to external sinks (HTTP, webhooks, email) without explicit sanitization/redaction. Apply data classification and enforce boundary controls per trust level. Required by ISO 27001 A.5.14 and CoSAI MCP-T5.
highP9Missing Container Resource LimitsMCP07-insecure-configT1499.001
Pattern "(?:for|while)\s*[^}]*(?:fs\.writeFile|open\s*\([^)]*["']w|createWriteStream)(?!.*(?:limit|max|count|quota))" matched in source_code: "format="%(asctime)s - %(levelname)s - %(message)s",
datefmt="%Y-%m-%d %H:%M:%S",
)
logger = logging.getLogger(__name__)
"""
Superset MCP Integration
This module provides a Model Control Protocol (MCP) server for Apache Superset,
enabling AI assistants to interact with and control a Superset instance programmatically.
It includes tools for:
- Authentication and token management
- Dashboard operations (list, get, create, update, delete)
- Chart management (list, get, create, update, delete)
- Database and dataset operations
- SQL execution and query management
- User information and recent activity tracking
- Advanced data type handling
- Tag management
Each tool follows a consistent naming convention: superset_<category>_<action>
"""
# Load environment variables from .env file
load_dotenv()
# Constants
SUPERSET_BASE_URL = os.getenv("SUPERSET_BASE_URL", "http://localhost:8088")
SUPERSET_USERNAME = os.getenv("SUPERSET_USERNAME")
SUPERSET_PASSWORD = os.getenv("SUPERSET_PASSWORD")
ACCESS_TOKEN_STORE_PATH = os.path.join(os.path.dirname(__file__), ".superset_token")
# Initialize FastAPI app for handling additional web endpoints if needed
app = FastAPI(title="Superset MCP Server")
@dataclass
class SupersetContext:
"""Typed context for the Superset MCP server"""
client: httpx.AsyncClient
base_url: str
access_token: Optional[str] = None
csrf_token: Optional[str] = None
app: FastAPI = None
def load_stored_token() -> Optional[str]:
"""Load stored access token if it exists"""
try:
if os.path.exists(ACCESS_TOKEN_STORE_PATH):
with open(ACCESS_TOKEN_STORE_PATH, "r") as f:
return f.read().strip()
except Exception:
return None
return None
def save_access_token(token: str):
"""Save access token to file"""
try:
with open(ACCESS_TOKEN_STORE_PATH, "w" (at position 611)
Always set resource limits for MCP server containers: memory (--memory), CPU (--cpus), PIDs (--pids-limit), file descriptors (--ulimit nofile), and open files. In Kubernetes, set both requests and limits in the container spec. Use LimitRange and ResourceQuota at the namespace level as a safety net. Set pids.max in cgroups to prevent fork bombs. A missing PID limit allows a single tool invocation to fork-bomb the host (CVE-2025-26449 class).
highK7Long-Lived Tokens Without RotationMCP06-excessive-permissionsAML.T0054
Pattern "(access[_\s-]?token|bearer).*(?:store|save|cache|persist)(?!.*(?:refresh|rotate|expir|ttl|renew))" matched in source_code: "ACCESS_TOKEN_STORE" (at position 1613)
Use short-lived tokens (1 hour max) with refresh token rotation. Implement token expiry validation on every request. Store tokens in secure credential managers (AWS SSM, HashiCorp Vault) instead of hardcoding. Required by ISO 27001 A.8.24 (cryptographic controls) and OWASP ASI03.
Medium1
mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054
Pattern "(?:fetch|axios|got|request|urllib|httpx|http\.get|http\.post)\s*\((?!.*(?:timeout|signal|AbortSignal|deadline|cancel))" matched in source_code: "request(" (at position 8258)
Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.