Mmcp.market

DataCharter MCP server

by datacharter·io.github.datacharter/datacharter·v0.44.0
No reviews yet

Local-first, contract-governed data explorer with read-only, PII-masked query tools for AI agents.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

12 stars503 downloads/wk

Reviews

Write one

Nobody has reviewed DataCharter yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

DataCharter tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.8 · 2026-09-19 · same rubric, same numbers if you re-run it

1 medium
  • Code scan274 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    datacharter-0.44.0/src/datacharter/server/static/assets/index-D7GT8bAk.js: …oC=34,vp=10,lC=13;function aj(e){return new Function("d","return {"+e.map(function(t,n){retur…
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the DataCharter repository's README, as published. We do not edit it. Read it on GitHub

DataCharter

Query all your data locally. Hand agents exactly the columns you choose.

A local SQL workspace over files and databases, federated by DuckDB and governed by charter.yaml. Agents get read-only, PII-masked access to what the contract grants. Apache-2.0. No paid edition.

<!-- mcp-name: io.github.datacharter/datacharter -->

datacharter.dev · Docs · Desktop · GovBench · Deploy

Two ways in. Same kernel.

Laptop

Drop a file. Query it. Chart it. An agent sees ••• where PII lives.

uvx datacharter serve          # demo workspace, http://127.0.0.1:8321
# or: datacharter init --from && datacharter serve
# or: datacharter init --template life && datacharter serve --local

No terminal: desktop app (beta). macOS (Apple Silicon) or Windows. Unsigned until Apple secrets exist.

brew install datacharter/tap/datacharter   # macOS
pip install datacharter                    # Python 3.11+

The workspace is a directory: charter.yaml, queries/, guides/. Commit it. Secrets stay out. Optional agent: SpaceXAI, Claude Code, Ollama (--local), or any OpenAI-compatible endpoint.

Company

The same binary, on a shared MCP endpoint. Identities live in git, not on our servers. No rows leave your infrastructure.

datacharter mcp --http --host 0.0.0.0   # OAuth env required off loopback
helm install datacharter ./chart \
  --set oauth.issuer=... --set oauth.audience=... --set oauth.jwksUri=...
datacharter govbench --json             # cite corpus govbench-v1
  • MCP Streamable HTTP (POST /mcp) with optional OAuth 2.1
  • principals: and grants: in charter.yaml (default-deny on HTTP)
  • Helm chart and OCI image
  • Hash-chained audit plus SIEM JSON/OTLP
  • GovBench: frozen 28-attack corpus, grade A-F

Wrap someone else's MCP server: datacharter mcp --guard "npx -y some-mcp-server".

What the contract enforces

PII default-deny, row filters, plain-English policies (aggregates only), canaries, a flight recorder, datacharter redteam, access diff on PRs. CLI reference: docs/cli.md. Security: docs/security.md.

Status: pre-release. V1 in development.

Privacy

Runs on your machine or in your cluster. No telemetry. No DataCharter-operated data plane. Privacy Policy.

License

Apache-2.0

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-09-19restoreC → Bscore 83: eval / new Function used

Install directly

claude mcp add datacharter -- uvx datacharter
Add to Cursor

DataCharter: common questions

Is DataCharter MCP server safe?
Mostly: it is graded B (83/100). Read the DataCharter safety report
How do I install DataCharter?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does DataCharter need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is DataCharter maintained?
The last commit was 5 days ago (2026-09-16). The latest release is v0.44.0.

More from datacharter →