
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@icedq/mcp-server
Advanced tools
MCP Bundle for iceDQ Data Quality Platform with Sandy AI assistant and enhanced features
Connect your AI assistant to iceDQ Data Quality Platform
Website • Documentation • Support • Privacy Policy
The iceDQ MCP Server connects AI assistants — including Claude Desktop, VS Code, and Cursor — to your iceDQ Data Quality Platform, enabling intelligent data quality management through natural language.
With 48 tools across the full data quality lifecycle, you can explore data landscapes, profile quality metrics, generate AI-powered check suggestions, create and execute validation rules, and monitor results — all from within your AI assistant.
The server is published to npm as @icedq/mcp-server. Most MCP clients can launch it on demand with npx — no manual install or build step required.
Add this to your MCP client configuration (e.g. Claude Desktop's claude_desktop_config.json, VS Code's .vscode/mcp.json, or Cursor's MCP settings):
{
"mcpServers": {
"icedq": {
"command": "npx",
"args": ["-y", "@icedq/mcp-server"],
"env": {
"ICEDQ_BASE_URL": "https://app.icedq.net",
"ICEDQ_REALM": "iam.icedq",
"ICEDQ_CLIENT_ID": "<your-client-id>",
"ICEDQ_CLIENT_SECRET": "<your-client-secret>",
"AUTH_TYPE": "username_password",
"ICEDQ_USERNAME": "<your-username>",
"ICEDQ_PASSWORD": "<your-password>",
"ICEDQ_ORG_ID": "<your-org-id>"
}
}
}
}
Prefer a global install? npm install -g @icedq/mcp-server installs the icedq-mcp-server command, which your client can run directly instead of npx.
| Variable | Required | Description |
|---|---|---|
ICEDQ_BASE_URL | ✅ | Base URL of your iceDQ instance (e.g. https://app.icedq.net) |
ICEDQ_REALM | ✅ | Authentication realm (default iam.icedq) |
ICEDQ_CLIENT_ID | ✅ | OAuth client ID for API authentication |
AUTH_TYPE | ✅ | username_password or access_token |
ICEDQ_ORG_ID | ✅ | Your iceDQ organization ID |
ICEDQ_CLIENT_SECRET | ⬩ | Required for username_password mode |
ICEDQ_USERNAME | ⬩ | Required for username_password mode |
ICEDQ_PASSWORD | ⬩ | Required for username_password mode |
TOKENS_PATH | ⬩ | Path to a token JSON file — required for access_token mode |
DEBUG | — | Set true for verbose logging |
For per-client walkthroughs and authentication details, see the setup guides below.
Choose your setup guide based on your AI client:
| Client | Setup Guide |
|---|---|
| Claude Desktop | Installation in Claude Desktop |
| VS Code | VS Code & Cursor Setup |
| Cursor | VS Code & Cursor Setup |
| Authentication | Authentication Guide |
For a general introduction, see the MCP Server Overview.
| Category | Tools |
|---|---|
| Discovery | list_workspaces, list_connections, test_connection, list_folders, list_rules, list_workflows, list_schedules |
| Data Exploration | list_databases, list_schemas, list_tables, list_columns, get_database_metadata, fetch_sample_data |
| Profiling & AI | profile_data, suggest_quality_checks |
| Validation Rules | create_validation_rule, update_rule, get_rule |
| Duplicate Detection | create_duplicate_rule |
| SQL Pushdown Rules | create_pushdown_rule |
| Cross-Source Rules | create_checksum_rule, analyze_recon_mapping, create_recon_rule |
| Workflows & Schedules | create_workflow, add_rules_to_workflow, remove_rules_from_workflow, create_schedule, modify_schedule, add_rules_workflows_to_schedule |
| Execution & Monitoring | execute_rule, execute_schedule, check_workflow_run_status, get_workflow_run_result, get_checks_exception_report, get_exception_report_url, get_rule_workflow_run_history, get_scheduler_runs_history |
| Organization | create_folder, move_rules, move_workflows, check_task_status, create_parameter, update_parameter, parse_csv_and_create_parameter, get_guidance |
| Tool | Description |
|---|---|
datawarehouse_query_schema | Get the data warehouse query schema definition |
datawarehouse_query_executor | Execute structured queries against the iceDQ data warehouse |
validate_and_explain_structured | Validate and preview a query before execution |
"List my iceDQ workspaces and show the connections in the first one"
"Fetch sample data from dbo.Customers, profile it, and suggest quality checks"
"Create a validation rule on dbo.Customers with NotNull on Email, Email format check, and ValidValues on Status"
"Compare row counts between SQL Server Orders and Snowflake FACT_ORDERS"
"Execute the Customer_Quality_Checks rule and show me the exception report"
| Issue | Solution |
|---|---|
| Organization ID required | Set ICEDQ_ORG_ID in your MCP configuration |
| Authentication failures | Verify ICEDQ_CLIENT_ID, ICEDQ_CLIENT_SECRET, username, and password |
| No workspaces returned | Check base URL, verify credentials, and confirm the user has workspace access |
| Token file errors | Ensure TOKENS_PATH points to a valid, readable JSON file with accessToken and refreshToken fields |
| Sample data not returning | Confirm the connection is ACTIVE and the table name is correct (case-sensitive) |
To enable detailed logging, set DEBUG=true in your MCP environment configuration.
access_token mode, tokens are automatically refreshed and persisted to the configured token file (TOKENS_PATH)FAQs
MCP server for iceDQ Data Reliability Platform — 48 tools for validation, reconciliation, duplicate detection, scheduling, and data exploration.
The npm package @icedq/mcp-server receives a total of 193 weekly downloads. As such, @icedq/mcp-server popularity was classified as not popular.
We found that @icedq/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.