
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@us-all/openmetadata-mcp
Advanced tools
OpenMetadata MCP server - metadata management, lineage, search, data quality, and more
The OpenMetadata MCP that ships full CRUD across every entity type — including OM 1.12+ Data Contracts, Metrics, Search Index, API Collections, and API Endpoints that the embedded MCP doesn't cover yet.
172 tools, 4 workflow Prompts (lineage impact / DQ investigation / glossary bootstrap / owner reassign), 7 MCP Resources, and aggregations like
lineage-impact(downstream blast-radius w/ owner notification list),quality-rollup(DQ status across a scope), and official Data Contract validation.
lineage-impact answers "what breaks if I change/drop X?" by walking lineage + counting consumers + breaking down by entity type + resolving the owner union for change-mgmt notifications, in one call. get-domain-summary returns domain + 6 child entity types via /search/query with track_total_hits in one call instead of 7 sequential. get-table-summary folds table + lineage + sample-data + DQ similarly.semantic-search over OM 1.12+ vector index (POST /search/vector/query). Useful when keyword search misses synonyms.lineage-impact-analysis, data-quality-investigation, glossary-term-bootstrap, owner-change-propagation. Workflow templates the model invokes directly.om://table/{fqn}, om://glossary-term/{fqn}, om://lineage/{type}/{fqn}, om://search/{query}, om://dashboard/{fqn}, om://pipeline/{fqn}, om://schema/{fqn}.extractFields projection on 28 read tools (drops changeDescription/version/updatedBy/href noise — ~80% size reduction), OM_TOOLS/OM_DISABLE category toggles, search-tools meta-tool.lineage-impact renders as a blast-radius card on ChatGPT clients (downstream/upstream counts + type breakdown + top consumers + owners-to-notify) via _meta["openai/outputTemplate"]. Claude clients receive the same JSON content.MCP_TRANSPORT=http for ChatGPT Apps SDK or remote clients (Bearer auth via MCP_HTTP_TOKEN).Connect the server to Claude Desktop or Claude Code, then paste any of these:
payments.transactions table is being deprecated. List every dashboard, pipeline, and ML model that depends on it (upstream + downstream, depth 3)."payments glossary with these 8 terms: chargeback, refund, settlement, KYC, AML, transaction, customer-id, payment-method. Link related terms."taehee is leaving. List every entity (table/dashboard/pipeline/ML model) where they are owner. Then reassign all of them to team data-platform."analytics domain: total tables/dashboards/pipelines/ML models, top 5 by recent updates, and the data products it owns."OpenMetadata 1.12+ ships an embedded MCP. They are complementary:
| OM 1.12 embedded MCP | @us-all/openmetadata-mcp (this) | |
|---|---|---|
| Tool count | ~10 (search, glossary basics, lineage, DQ, RCA, semantic search) | 172 (full CRUD across all entity types) |
| OM 1.12+ entity types (Data Contracts/Metrics/Search Index/API) | partial | ✅ 12 tools |
| Aggregation tools | ❌ | ✅ lineage-impact, get-domain-summary, get-table-summary |
| MCP Prompts | ❌ | ✅ 4 |
| MCP Resources | ❌ | ✅ 7 |
| Auth | OAuth2 / PAT, OM Authorization Engine (RBAC) | JWT bot token + write gate |
| Deployment | Embedded in OM server (marketplace install) | Standalone npm / Docker / npx |
| OM version | 1.12+ only | 1.x compatible |
| Best for | RBAC-aware AI agents, SSO orgs | Bulk CRUD, automation, sample-data, older OM clusters |
Use the embedded MCP for RBAC-aware governance with SSO. Use this server for bulk metadata operations, full entity CRUD parity, automation, and OM clusters older than 1.12.
{
"mcpServers": {
"openmetadata": {
"command": "npx",
"args": ["-y", "@us-all/openmetadata-mcp"],
"env": {
"OPENMETADATA_HOST": "http://your-host:8585",
"OPENMETADATA_TOKEN": "<jwt-bot-token>"
}
}
}
}
claude mcp add openmetadata -s user \
-e OPENMETADATA_HOST=http://your-host:8585 \
-e OPENMETADATA_TOKEN=<jwt-bot-token> \
-- npx -y @us-all/openmetadata-mcp
docker run --rm -i \
-e OPENMETADATA_HOST=http://your-host:8585 \
-e OPENMETADATA_TOKEN=<jwt-bot-token> \
ghcr.io/us-all/openmetadata-mcp-server
git clone https://github.com/us-all/openmetadata-mcp-server.git
cd openmetadata-mcp-server && pnpm install && pnpm build
node dist/index.js
ingestion-bot works)| Variable | Required | Default | Description |
|---|---|---|---|
OPENMETADATA_HOST | ✅ | — | OpenMetadata server URL (e.g. http://localhost:8585) |
OPENMETADATA_TOKEN | ✅ | — | JWT or Bot token |
OPENMETADATA_ALLOW_WRITE | ❌ | false | Set true to enable mutations (create/update/delete) |
OM_TOOLS | ❌ | — | Comma-sep allowlist of categories. Biggest token saver. |
OM_DISABLE | ❌ | — | Comma-sep denylist. Ignored when OM_TOOLS is set. |
MCP_TRANSPORT | ❌ | stdio | http to enable Streamable HTTP transport |
MCP_HTTP_TOKEN | conditional | — | Bearer token. Required when MCP_TRANSPORT=http |
MCP_HTTP_PORT | ❌ | 3000 | HTTP listen port |
MCP_HTTP_HOST | ❌ | 127.0.0.1 | HTTP bind host (DNS rebinding protection auto-enabled for localhost) |
MCP_HTTP_SKIP_AUTH | ❌ | false | Skip Bearer auth — e.g. behind a reverse proxy that handles it |
Categories (10): search, core, discovery, governance, quality, services, admin, events, entities, meta (always-on).
When MCP_TRANSPORT=http: POST /mcp (Bearer-auth JSON-RPC) + GET /health (public liveness).
| Scenario | Tools | Schema tokens | vs default |
|---|---|---|---|
| default (all categories) | 172 | 24,000 | — |
typical (OM_TOOLS=search,core,governance,quality,discovery) | 120 | 19,500 | −19% |
narrow (OM_TOOLS=search,core) | 26 | 4,600 | −81% |
extractFields adds another ~80–90% reduction on individual responses (e.g. get-table 8KB → 200B with extractFields: "name,columns.*.name,columns.*.dataType"). Auto-applied across 28 read tools.
// without
get-table { "id": "..." }
// with
get-table { "id": "...", "extractFields": "name,description,columns.*.name,columns.*.dataType" }
Workflow templates available via MCP prompts/list:
lineage-impact-analysis — given an entity, walk upstream + downstream lineage and rank by impact.data-quality-investigation — diff DQ test results across two windows; cluster failure modes.glossary-term-bootstrap — bulk-create a glossary with N related terms, link automatically.owner-change-propagation — find all entities owned by user X, propose batch reassignment.URI-based read-only access:
om://table/{fqn} (table + columns + owners + tags + joins), om://glossary-term/{fqn}, om://lineage/{type}/{fqn} (depth 3), om://search/{query} (top 10 keyword hits), om://dashboard/{fqn}, om://pipeline/{fqn} (with tasks), om://schema/{fqn}.
10 categories. Use search-tools to discover at runtime; full list collapsed below.
| Category | Tools |
|---|---|
| Tables / Databases / Schemas / Lineage | 22 |
| Services (database/dashboard/messaging/pipeline/ml/storage) | 16 |
| Glossaries / Terms | 12 |
| Domains / Data Products | 12 |
| Classifications / Tags | 10 |
| Discovery (dashboards / pipelines / charts / topics / containers / ml-models) | 36 |
| Governance (roles / policies / users / teams / bots) | 13 |
| Quality (test suites / cases / sample data) | 13 |
| Stored Procedures / Queries | 11 |
| OM 1.12+ entities (Data Contract / Metric / Search Index / API Collection / API Endpoint) | 12 |
Search (search-metadata, suggest-metadata, semantic-search) | 3 |
Aggregations (lineage-impact, quality-rollup, get-domain-summary, get-table-summary) | 4 |
Quality (run-test-suite write-gated) | 1 |
Meta (search-tools) | 1 |
search-metadata, suggest-metadata, semantic-search
list-tables, get-table, get-table-by-name, create-table, update-table, delete-table
list-databases, get-database, get-database-by-name, create-database, update-database, delete-database
list-schemas, get-schema, get-schema-by-name, create-schema, update-schema, delete-schema
get-lineage, get-lineage-by-name, add-lineage, delete-lineage
6 database-service tools + 2 each for dashboard/messaging/pipeline/ml-model/storage services.
6 glossary CRUD + 6 glossary-term CRUD.
6 CRUD each, follows list / get / get-by-name / create / update / delete.
4 classification + 6 tag CRUD.
6 domain + 6 data-product CRUD.
3 user reads + 6 team CRUD.
list-roles, get-role, list-policies, get-policy
list-test-suites, get-test-suite, get-test-suite-by-name, list-test-cases, get-test-case, get-test-case-by-name, list-test-case-results
6 CRUD.
list-queries, get-query, create-query, update-query, delete-query
list-events, get-event-subscription, get-event-subscription-by-name
list-bots, get-bot, get-bot-by-name
get-table-sample-data, get-table-sample-data-by-name, get-topic-sample-data, get-topic-sample-data-by-name, get-container-sample-data, get-container-sample-data-by-name
list-data-contracts, get-data-contract-by-name, run-data-contract-validation, get-data-contract-latest-result, list-metrics, get-metric-by-name, list-search-indexes, get-search-index-by-name, list-api-collections, get-api-collection-by-name, list-api-endpoints, get-api-endpoint-by-name
lineage-impact, quality-rollup, get-domain-summary, get-table-summary
run-test-suite — triggers the test-suite's associated ingestion pipeline. Async; results land via the normal pipeline flow.
search-tools — query other tools by keyword; always enabled.
Claude → MCP stdio → src/index.ts → src/tools/*.ts → OpenMetadataClient (fetch) → OpenMetadata REST
Built on @us-all/mcp-toolkit:
extractFields — token-efficient response projectionsaggregate(fetchers, caveats) — fan-out helper used by lineage-impact / get-domain-summary / get-table-summarycreateWrapToolHandler — OPENMETADATA_TOKEN redaction + OpenMetadataError extractionsearch-tools meta-toolTargets OM 1.x. Validated against real OM backend with the OM 1.12+ entities.
Node.js 22+ • TypeScript strict ESM • pnpm • @modelcontextprotocol/sdk • zod • dotenv • vitest.
JSON-Patch updates handled automatically (PATCH application/json-patch+json content-type).
FAQs
OpenMetadata MCP server - metadata management, lineage, search, data quality, and more
We found that @us-all/openmetadata-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.