MCP, the Model Context Protocol, lets an AI agent access an analytics product through tools exposed by a server. Rather than give an agent database credentials, a product can run an MCP server that exposes named tools, such as "list metrics" or "run this query", for the agent to call.
For a product that serves many customers from one platform, that server is now part of the permission system. Whatever an agent asks for, the server has to answer with the same tenant and role limits the customer's dashboard applies.
What MCP Changes for Analytics
When Anthropic released MCP in November 2024, it described the goal as "replacing fragmented integrations with a single protocol". An agent that speaks MCP can discover a server's tools and call them without a custom integration for each product.
For analytics, the important change is where the query comes from. With a server, the agent calls the operations the server exposes, and the server decides how each call becomes a query. Whether those operations stay on governed definitions depends on which tools the server exposes: raw SQL execution, queries against governed metric definitions, or both.
Design the server to decide which definitions, metadata and data from the context layer an agent receives for each user.
Which Analytics Platforms Ship an MCP Server
Before connecting an agent, check each server's release status and, above all, whose permissions govern its queries:
| Platform | Status in its own documentation | Whose permissions queries use |
|---|---|---|
| Google Analytics | "Experimental", announced July 22, 2025 | runs locally, with read-only access scopes |
| Snowflake | generally available, November 4, 2025 | role-based access control on the server and its tools |
| Google Cloud remote servers, including BigQuery | remote MCP servers listed as generally available in the release notes | OAuth 2.0 with IAM |
| Looker | preview | "strict user-level permissions" |
| Power BI | preview | the authenticated user, with an exception covered below |
| Databricks | managed MCP servers | for the Databricks SQL server, "the caller's Unity Catalog and warehouse permissions" |
| Metabase | documented | "scoped to the connecting person's permissions" |
| dbt | local and remote servers | the warehouse credentials a query runs with; execute_sql "doesn't block write statements" |
Looker, Databricks SQL and Metabase describe queries that run with the connecting user's permissions. Check whether queries will run as a user, a service principal or a separate agent identity. Power BI does not enforce row-level security with service principal authentication.
The Spec Leaves Authorization Optional, So the Server Has to Decide
MCP's authorization requirements have changed across versions. If an analytics server was built against an earlier version, review its authorization flow against the current one.
- March 2025. The 2025-03-26 authorization section introduced OAuth, and its example flow "assumes the MCP server is also functioning as the authorization server."
- June 2025. The 2025-06-18 revision classified MCP servers as OAuth resource servers, separate from the authorization server. Its security guidance states that token passthrough "is explicitly forbidden".
- July 2026. The current version, 2026-07-28, keeps the resource-server model and deprecates dynamic client registration in favor of client ID metadata documents.
The current authorization section states that "Authorization is OPTIONAL for MCP implementations," and that servers using a local STDIO transport should take credentials from the environment instead. When a server does implement it, servers "MUST validate that access tokens were issued specifically for them as the intended audience" and "MUST NOT accept or transit any other tokens."
The specification covers token validation. A multi-tenant analytics server must also determine which tenant's rows each authenticated user can access.
Tenant Permissions Have to Follow the Calling User
An analytics MCP server can use a single service account with access to all customer data and leave filtering to the agent.
Power BI documents how that goes wrong. Queries "execute in the context of the authenticated user," and row-level security applies to user authentication. But "Power BI doesn't enforce RLS when you use service principal authentication." A server that connects as a service principal for convenience can reach every row that principal can read, whichever customer is asking.
monday.com's MCP security overview states: "There is no elevated or shared service account that bypasses user-level access control." OWASP's guidance on excessive agency gives the general rule: "Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not."
For embedded and customer-facing analytics, that means the tenant filter is applied by the server to every query a tool produces, using the identity on the token. A prompt that says "only show this customer's data" is not a control. The row-level security policy has to sit below the agent, where the agent cannot rewrite it.
What Public MCP Servers Get Wrong Today
- Authentication. Among 640 confirmed internet-facing MCP servers, 414 were dynamically audited, and 91.8% of that audited group lacked OAuth authentication (July 2026 study). A separate Astrix scan of public server repositories found only 8.5% used OAuth, while 53% relied on long-lived static secrets. Astrix's figures come from a language model's analysis of repository documentation, so verify authentication on the deployed server itself.
- Tool listings. Knostic identified 1,862 MCP servers exposed to the internet and manually verified a sample of 119. All 119 returned their tool listings without authentication.
- Tool poisoning. Among the MCP servers examined in a 2025 study, 7.2% had general vulnerabilities and 5.5% had MCP-specific tool poisoning, where malicious instructions are embedded in a tool's description and the agent follows them.
An analytics agent that reads a poisoned description from one server, has access to private data through another and can send data out through a third combines what Simon Willison calls the lethal trifecta. MCP makes that combination easy, because it "encourages users to mix and match tools from different sources".
A Checklist for an Analytics MCP Server in a Multi-Tenant Product
We recommend these checks before an MCP server reaches customer data. None of them should depend on what the model is told.
- Act as an OAuth resource server. Check that every access token was issued specifically for this server as its intended audience. Reject other tokens and never forward them.
- Run every call as the calling user. Resolve the tenant and role on the server from the authenticated identity, never from the prompt. Do not connect to the data through a shared account that can read every customer.
- Apply the tenant filter server-side on every tool. Apply the dashboard's row and field rules to every query the tool generates.
- Expose governed operations instead of raw SQL. Tools that query defined metrics through a semantic layer limit the agent to definitions you control. The same applies to natural language query.
- Default to read-only tools. Add write or export tools only with their own permission and approval step.
- Treat tool descriptions as code. Review and pin them, so a changed description cannot change agent behavior unnoticed.
- Bound every call. We recommend limits on result size, query cost and runtime per tool and per tenant.
- Log every call. Record user, tenant, tool, generated query and result size for each call.
For deciding which AI features may reach which data and who can switch them on, see AI analytics governance.
Where Sumboard Stands
Sumboard does not offer an MCP server today. Sumboard released an AI assistant in its SQL editor in January 2026. Natural language querying for your customers is in progress; the feature is designed to apply the same permission checks to the assistant's queries as to all other queries.
If you are planning an embedded analytics platform that AI agents will query, first decide how the server will enforce tenant permissions.
