superset-mcp

Files (3)

• SKILL.md
• SOURCE.md
• skill.json

SKILL.md (first lines)

# Superset MCP

Use this skill when the user wants to connect Cowork to an official Apache Superset MCP server.

## Server Setup

Cowork does not start Superset. The user must run or expose the official Superset MCP service from the Superset side, for example:

```bash
superset mcp run --host 127.0.0.1 --port 5008
```

The default endpoint is:

```text
http://localhost:5008/mcp
```

Development deployments may use `MCP_DEV_USERNAME` on the Superset side. For per-user access, enable JWT authentication on the Superset MCP service and ensure it accepts the JWT issued by the Superset security login API.

## Cowork Setup

Configure the skill:

- `SUPERSET_BASE_URL`: Superset Web/API root URL, such as `https://superset.example.com`.
- `SUPERSET_MCP_URL`: Streamable HTTP endpoint, usually `/mcp`.
- `SUPERSET_USERNAME`: the user's Superset username.
- `SUPERSET_PASSWORD`: the user's Superset password.
- `SUPERSET_PROVIDER`: `db` or `ldap`; defaults to `db`.
- `SUPERSET_MCP_TIMEOUT_SECONDS`: optional timeout, default 30 seconds.

Saving the Skill configuration automatically creates, updates, and enables its managed MCP connection. Connection testing remains a separate action on this page and does not run during save. When testing, discovering, or calling tools, Cowork calls `/api/v1/security/login` with `refresh: true`. Access and refresh tokens stay in memory only. Cowork refreshes the access token before expiry and logs in again after restart or an expired refresh token.

Cowork does not remotely start the Superset-side MCP process. If the endpoint refuses the connection, start `superset mcp run --host 0.0.0.0 --port 5008` in the Superset environment and check the port, firewall, TLS, and reverse proxy. Connection errors identify the failed authentication, transport, initialize, or `tools/list` phase instead of exposing raw task-group errors.

If `/mcp` returns 401 after login succeeds, verify `MCP_AUTH_ENABLED`, the MCP JWT algorithm/signing key, and `MCP_USER_RESOLVER` in `superset_config.py`. Cowork does not silently fall back to a development user.

## Safety Rules

- Confirm target dashboards, charts, datasets, and databases before high-impact operations.
- Executing SQL, creating charts, updating dashboards, and other write-like operations depend on Superset RBAC/JWT permissions and should be scoped to the user-approved target.
- Do not use third-party `superset-mcp` npm packages for this skill; this integration targets the official Superset MCP server.

From chuancyzhang/deepseek-cowork, Apache-2.0.

More from chuancyzhang/deepseek-cowork