B

Airtable Brain MCP Server

Advanced Airtable MCP server with governance, PII policies, rate limiting, and comprehensive CRUD operations

Overall Score74/100

Score Breakdown

Server Info

Package
@rashidazarang/airtable-mcp
Registry
npm
Maintainer
Community
Category
Project Management
Tags
databasespreadsheetno-code
Last Scanned
7 Apr 2026

Findings

5 issues

Authentication & Identity

MEDIUMHTTP/SSE transport supports per-request credentials

Supports both stdio and StreamableHTTPServerTransport (activated via PORT or MCP_HTTP_PORT env vars). No MCP OAuth. Accepts personal access token via multiple env var names (AIRTABLE_PAT preferred). Has governance system for base/table allowlisting, operation control, and PII policies.

Remediation

Implement the MCP OAuth spec so users authenticate directly without platform mediation.

Tool Schema Quality

HIGH6 of 42 tools have no input schema

Strong schema quality. Uses Zod with .strict() on many schemas preventing extra properties. delete_record has z.array().min(1).max(10) constraint. search_records has z.number().int().min(1).max(100) on maxRecords. list_records has pagination via offset. Webhook tools (5 tools) lack inputSchema - they accept raw Record<string, unknown>. Query tool validates formulas via validateFormula() for suspicious patterns. PII policies (mask/hash/drop) applied to all data retrieval.

Remediation

Define JSON Schema with explicit types for all tool parameters.

LLM Safety

HIGHTool descriptions contain instructional language

Descriptions include directives that could influence LLM behavior beyond tool selection.

Remediation

Remove instructional language. Descriptions should be purely factual.

Maintenance & Trust

LOWCommunity-maintained by Rashid Azarang

No official vendor backing.

Remediation

Seek vendor verification.

HIGH16 dependency vulnerabilities (1 critical, 12 high)

npm audit found 1 critical and 12 high severity CVEs.

Remediation

Run `npm audit fix` and update vulnerable dependencies.

Tools

42 total
NameDescriptionRisk
list_basesList all accessible Airtable bases with their names, IDs, and permission levelsread
describeDescribe Airtable base or table schema. Use detailLevel to optimize context usage: tableIdentifiersOnly, identifiersOnly, or full.read
queryQuery Airtable records with filtering, sorting, and pagination.read
list_governanceList governance policies and allowed operationsread
list_exceptionsList recent exceptions and errorsread
createCreate Airtable records (requires diff-before-write via dryRun first).write
updateUpdate Airtable records with diff review and idempotency keys.write
upsertUpsert Airtable records (create or update based on key field).write
list_webhooksList Airtable webhooks for the default base.read
create_webhookCreate a new webhook for a base.admin
refresh_webhookRefresh webhook expiration.write
delete_webhookDelete an Airtable webhook by ID.admin
get_webhook_payloadsGet payload history for an Airtable webhook.read
get_recordGet a single Airtable record by ID.read
delete_recordDelete one or more Airtable records by ID.admin
search_recordsSearch Airtable records using text search across a field.read
list_recordsList Airtable records with optional field selection and pagination.read
get_base_schemaGet the full schema for an Airtable base.read
list_tablesList all tables in an Airtable base.read
list_field_typesList available Airtable field types.read
get_table_viewsGet views for an Airtable table.read
create_tableCreate a new table in an Airtable base.write
update_tableUpdate table metadata (name, description).write
delete_tableDelete an Airtable table.admin
create_fieldCreate a new field in an Airtable table.write
update_fieldUpdate field metadata in an Airtable table.write
delete_fieldDelete a field from an Airtable table.admin
batch_create_recordsCreate multiple Airtable records in a batch.write
batch_update_recordsUpdate multiple Airtable records in a batch.write
batch_delete_recordsDelete multiple Airtable records in a batch.admin
batch_upsert_recordsUpsert multiple Airtable records in a batch.write
create_viewCreate a new view in an Airtable table.write
get_view_metadataGet metadata for an Airtable view.read
upload_attachmentUpload an attachment to an Airtable record.write
create_baseCreate a new Airtable base.write
list_collaboratorsList collaborators for an Airtable base.read
list_sharesList shares for an Airtable base.read
list_commentsList comments on an Airtable record.read
create_commentCreate a comment on an Airtable record.write
update_commentUpdate a comment on an Airtable record.write
delete_commentDelete a comment from an Airtable record.admin
whoamiGet the current user info (ID, email, scopes) for the configured PAT. Requires user.email:read scope for email.read

Deploy Airtable Brain MCP Server securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow