GoodData MCP Server
The Model Context Protocol (MCP) server exposes GoodData platform capabilities to external MCP clients. You can connect from your own MCP client, such as a chatbot, IDE assistant, or custom agent, and interact with GoodData using natural language.
AI is becoming part of everyday work, but connecting it safely to company data can be a challenge. Teams want their chatbots, IDE assistants, and custom agents to work with real data, while keeping access secure and consistent.
The GoodData MCP Server lets AI clients connect directly to governed analytics in GoodData, so they always reason with trusted metrics, metadata, and platform capabilities instead of raw or ad-hoc queries.
How It Works
- The MCP server exposes GoodData platform capabilities to AI agents and developer tools.
- It supports the MCP protocol with error handling, multi-workspace isolation, and authentication.
- You connect with your own MCP client using an API token or, for supported clients, by signing in through your organization’s identity provider.
- Once connected, you can use natural language to trigger GoodData tools, such as listing metrics, creating alerts, creating metrics, running exports, or searching workspace metadata.
- Tool search helps MCP clients discover additional tools on demand, so the server can expose a larger set of capabilities without listing every tool up front.
- In addition to the server’s built-in tools, the server can expose GoodData v1 metadata API operations as MCP tools. These generated tools let agents use supported workspace-scoped API operations directly through MCP, without calling the REST API separately.
The latest supported MCP protocol version is 2025-11-25. Use MCP client libraries that support this protocol version.
Available Tools
Which tools appear in the initial MCP tool list on GoodData.CN depends on whether tool search is enabled for your organization. Tool search changes discovery only. It does not remove tools or change whether an existing tool can be called.
Tool Search
When tool search is enabled, tools/list returns only these two tools:
- search_tools - Search for MCP tools using a natural-language query. Results are ranked using each tool’s name, description, and parameter descriptions.
- call_tool - Call a tool returned by
search_toolsby providing its name and arguments.
All other MCP tools remain available. They are not listed by tools/list, but a client that already knows an exact tool name can call that tool directly without using call_tool.
For integrations that discover capabilities dynamically, use search_tools to find a tool and call_tool to run it. Integrations that already call specific tools by name can continue doing so and should not treat tools/list as a complete catalog.
This behavior applies to both built-in tools and generated API tools.
Important Notice
A short tool list containing only search_tools and call_tool is expected when tool search is enabled. A client that can neither use tool search nor call known tools by exact name cannot discover the other available tools.
Enable Tool Search and Generated API Tools
Tool search and generated API tools are enabled by default in GoodData.CN 4.15 and later. No additional configuration is required.
To restore the previous behavior, set these Helm values to false:
enableMcpToolSearchlists every tool intools/listinstead ofsearch_toolsandcall_tool.enableMcpGeneratedToolshides the generated API tools.
On GoodData.CN 4.14 and older, both values default to false. Set them to true to enable tool search and generated API tools.
Workspace Metadata
- get_workspace_info - Get workspace name, description, and organization information.
- list_workspace_metrics - List metrics with optional RSQL filtering and pagination. Supports optional
entity_idfor single-metric retrieval. - list_workspace_attributes - List attributes with optional RSQL filtering and pagination. Supports optional
entity_idfor single-attribute retrieval. - list_workspace_visualizations - List visualizations with optional RSQL filtering and pagination. Supports optional
entity_idfor single-visualization retrieval. - list_workspace_dashboards - List dashboards with optional RSQL filtering and pagination. Supports optional
entity_idfor single-dashboard retrieval.
List operations:
- entity_id - Retrieve a single entity through the relevant
list_*tool when supported. - include - Request related entities in one call, such as facts, labels, datasets, or visualizations.
- limit - Optional pagination. Recommended values are 10-50 for quick browsing and 100+ for comprehensive lists.
- rsql_filter - Optional RSQL filtering, for example
title=like=*revenue*ortags=in=('finance','kpi').
All list_* tools support the include parameter to fetch related entities in a single request.
Examples of valid includes:
- Metrics:
["facts", "attributes"] - Dashboards:
["visualizations"] - Attributes:
["labels", "datasets"]
Example usage:
list_workspace_metrics(entity_id="revenue_total")
list_workspace_dashboards(entity_id="sales_dashboard", include=["visualizations"])
list_workspace_attributes(include=["labels", "datasets"])Users
- list_users - Browse organization users.
- list_workspace_users - Browse users with access to the current workspace.
Agents
- list_agents - List the organization’s AI agents. Requires the AI entitlement.
Datasources and Data Modeling
- list_datasources - List datasources with optional RSQL filtering and pagination. This is a read-only operation and supports optional
datasource_idfor single-datasource retrieval. - test_datasource - Test datasource connectivity before scanning.
- scan_datasource - Discover Physical Data Model (PDM) from database schemas.
- generate_ldm - Generate Logical Data Model (LDM) from PDM.
- register_upload_notification - Invalidate cache after new data uploads.
Note: Datasource operations are organization-scoped and may require elevated permissions, such as MANAGE.
Analytics Authoring
- get_workspace_analytics - Retrieve complete analytics model from a workspace, including metrics, dashboards, visualizations, filter contexts, attribute hierarchies, export definitions, and dashboard plugins.
- create_metric - Create a new governed metric in the workspace.
- deploy_workspace_analytics - Deploy full analytics model to a workspace.
Warning
deploy_workspace_analytics replaces the existing analytics model in the workspace. Use it carefully.
Generated GoodData v1 API Tools
The MCP Server exposes supported GoodData v1 metadata API operations as generated MCP tools.
Every workspace-scoped GET endpoint in the metadata service is exposed as a read tool. Create tools are generated for these allowlisted workspace-scoped POST entities:
metricsvisualizationObjectsanalyticalDashboardsdashboardPluginsfilterContextsfilterViewsexportDefinitionsattributeHierarchiescustomApplicationSettingsmemoryItems
Generated tools do not include:
PUT,PATCH, orDELETEoperations- action endpoints
- organization-scoped or admin-scoped endpoints
- create operations outside the allowlist
This lets agents read and create supported workspace metadata through MCP without calling the REST API separately.
Generated tools grant no additional access. The backend authorizes each call using the same permissions as the underlying GoodData API.
Memory
- create_memory_item - Add persistent instruction or context to the AI system prompt for the workspace. Maximum length is 255 characters.
AI-Powered Search and Chat
- ai_search - Natural language search across workspace data with AI-generated insights.
- ai_chat - Conversational assistant with intelligent routing:
- Semantic Search - Find existing dashboards, metrics, and visualizations.
- Visualization Creation - Generate new visualizations from natural language.
- General Questions - Get answers about analytics concepts and best practices.
- Supports thread continuity for multi-turn conversations.
Key Driver Analysis
- run_key_driver_analysis - Analyze what drove a change in a metric.
AFM Execution (Label Elements)
- compute_label_elements - Retrieve distinct label (attribute) values with:
- Pattern filtering (SQL LIKE syntax:
"Premium%") - Exact filtering (
["USA", "Canada"]) - Exclusion mode (
complement_filter=True) - Pagination (default: 100, max: 10000)
- Dependent filters and validation by metrics/attributes
- Pattern filtering (SQL LIKE syntax:
- execute_visualization - Execute a saved visualization and return its computed result so MCP clients can use the data in downstream analysis or assistant workflows.
Automations and Alerts
- list_notification_channels - Discover available delivery channels (email, Slack, webhooks).
- list_automations - List all automations in the workspace.
- create_metric_alert - Create unified metric-based alerts supporting:
- Comparison alerts:
GREATER_THAN,LESS_THAN,EQUAL_TO,GREATER_THAN_OR_EQUAL_TO,LESS_THAN_OR_EQUAL_TO,NOT_EQUAL_TO - Range alerts:
BETWEEN,NOT_BETWEEN - Relative alerts:
INCREASES_BY,DECREASES_BY,CHANGES_BY(withDIFFERENCEorCHANGEarithmetic) - Schedule configuration (cron format, timezone)
- Recipients (internal user IDs and/or external email addresses)
- Metric formatting (titles and number formats for readable notifications)
- Comparison alerts:
- update_metric_alert - Update alert thresholds, operators, recipients, schedules, or convert alert type.
- update_alert_state - Pause or resume alerts by setting the target state. Use
state="pause"orstate="unpause". The tool accepts either a single automation ID or a list of automation IDs. - create_scheduled_export - Create a recurring export of a dashboard or visualization.
Example of Use
- You ask the assistant: “Alert me if Total Revenue drops below 90K.”
- The assistant analyzes your request and sets parameters:
- metric =
Total Revenue - operator =
LESS_THAN - threshold =
90000 - schedule = every morning at 8am
- delivery = your default method
- metric =
- You get confirmation: “Alert created: will check daily and notify you when Total Revenue < 90K.”
Important Recipient Rules:
Recipient types must match the notification channel’s allowedRecipients setting:
- CREATOR: Only the current user can be an internal recipient.
- INTERNAL: Only
internal_recipients(user IDs) are allowed. - EXTERNAL: Both internal user IDs and external email addresses are allowed.
Export Tools
- run_export - Run an on-demand export and return a download URL and file metadata.
The run_export tool can run supported export modes, such as:
- dashboard PDF export
- tabular XLSX export
- raw execution export
- dashboard slide deck export in PPTX format
- widget image export, such as PNG snapshots
The tool returns structured metadata where available, such as MIME type, file size, dashboard or visualization links, row and column counts for tabular exports, and width and height for image exports. Large files are returned through download URLs instead of being embedded in the response. Small image assets may be returned inline when supported by the client.
Exports are asynchronous. The tool reports progress while the export is being prepared and returns the file information after the export is complete. Some export types, such as slide decks, may take longer than simple image or tabular exports.
The tool uses existing GoodData export permissions. If the user lacks the required permission, the tool returns an error with information about what needs to be fixed before retrying.
Knowledge Base Tools
The GoodData MCP Server provides tools for accessing platform documentation and analytics knowledge. These allow MCP clients to retrieve structured guidance on MAQL, dashboards, datasets, visualizations, and the Logical Data Model.
- get_maql_guide - Returns MAQL syntax rules, function explanations, and examples. Clients can use this to learn metric syntax that is not part of general LLM training data.
- list_knowledge_topics - Lists all available knowledge topics:
gooddata,maql,dashboards,visualizations,datasets, andldm-schema. - get_knowledge_topic - Retrieves the full content of a specific knowledge topic.
Knowledge Resources
All knowledge topics exposed through the Knowledge Tools are also available as MCP Resources for clients that support resource querying. This allows AI agents to load documentation directly as structured content and use it to understand GoodData concepts.
Available Knowledge Resource URIs:
| MCP Resource URI | Description |
|---|---|
gdc-analytics-rules://gooddata | Overview of the GoodData analytics platform, key concepts, and system structure. Useful for general platform understanding. |
gdc-analytics-rules://maql | MAQL reference including syntax, operators, functions, and examples. Essential for generating or validating metrics. |
gdc-analytics-rules://dashboards | Documentation for dashboards, widgets, layout, filters, and interactions. Helps AI agents reference or construct dashboards correctly. |
gdc-analytics-rules://visualizations | Details on visualization types, configuration options, bucket structure, sorting, and limitations. Useful for generating valid visualization definitions. |
gdc-analytics-rules://datasets | Information about dataset structure, grain, roles, and relationships. Useful for metadata reasoning or dataset design. |
gdc-analytics-rules://ldm-schema | Logical Data Model structure and modeling rules, including dataset relationships and keys. Important for AI-driven LDM creation and validation. |
Each resource contains structured documentation that AI assistants can load, summarize, and reason about, enabling more accurate results when working with analytics or metadata definitions.
Connect
Endpoint
Use this endpoint to connect:
https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcpReplace <workspaceId> with the workspace ID you want to work in.
Authentication
The MCP Server supports multiple authentication approaches. Choose the method based on how the MCP client runs:
| Authentication | Best for | Runs as the end user? |
|---|---|---|
| Interactive SSO | A person using a supported MCP client | Yes. The user signs in through the organization’s identity provider. |
| Signed JWT | Integrations with their own server-side backend | Yes. The backend creates a short-lived token for the mapped user. |
| Per-user API token | Small or static user sets without a backend | Yes. The token represents its owner. |
| Shared API token | Prototypes, demos, or single-user setups | No. All requests use the same identity. |
For server-side integrations, prefer a signed JWT when the integration needs to act as individual users. Interactive SSO is intended for a person using an MCP client directly.
Interactive SSO
With interactive SSO, you do not create or paste a GoodData API token into the MCP client configuration. A compatible client discovers GoodData authentication automatically, opens your organization’s normal sign-in page in a browser, and obtains access after you sign in. Tool calls then run with your existing GoodData permissions. The token represents the same user access available through the GoodData API; it is not limited only to MCP operations.
To connect with interactive SSO, configure the MCP server URL without an Authorization header. For example:
{
"mcpServers": {
"GoodData": {
"type": "http",
"url": "https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp"
}
}
}For Claude Code, you can add the connection from the command line:
claude mcp add --transport http GoodData \
"https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp"On first use:
- The MCP client detects that authentication is required.
- The client opens your organization’s sign-in page in a browser.
- Sign in as you normally do to GoodData.
- If your organization requires approval, review which application is asking for access and select Allow.
- Control returns to the MCP client and subsequent tool calls run as your user.
Approving Access
When approval is required, an approval screen appears after you sign in and before the MCP client receives access. Hosted callbacks always require approval on GoodData Cloud. The screen shows:
- The name the application provides for itself and whether that identity comes from published client metadata or from self-registration
- The address where the authorization will be sent; for a hosted client, this is an external host named on the screen
- The signed-in user, when a display name is available
- How long the application can act as you if you allow access
A self-registered application name is not independently verified. Continue only if you started the connection yourself, either from an application on your computer or from a hosted tool you use.
Select Allow to complete the connection, or Don’t allow to refuse it. If you refuse, the client receives no access and the session created for that connection is removed.
The approval screen expires after ten minutes. If it expires, start the connection again from your MCP client. Approval is not remembered, so a new connection can require approval again.
By default, an interactive SSO connection expires after seven days of inactivity. The inactivity period restarts whenever the client uses the connection, and compatible clients renew access automatically. Your identity provider can end the session sooner. If the connection expires, sign in again when the client prompts you.
Signing out of GoodData in the browser does not end an existing MCP connection. Use your MCP client’s disconnect or clear-authentication action. If the client does not provide one, the connection can be revoked through:
POST /oauth2/revokeSend the token to revoke as form data using application/x-www-form-urlencoded. Revoking a refresh token ends the connection. Revoking only an access token does not prevent the client from renewing the connection with its refresh token.
API Token
API-token authentication continues to work as before and remains suitable for clients that cannot use interactive SSO. Pass the token as a Bearer token in your MCP client configuration:
Authorization: Bearer <your-api-token>Build a Client with Interactive SSO
Off-the-shelf clients that support interactive OAuth discover the required endpoints automatically. If you build your own client, GoodData exposes OAuth discovery and authorization endpoints on the organization hostname:
| Endpoint | Purpose |
|---|---|
/.well-known/oauth-protected-resource | Identifies the authorization server that protects the GoodData host. |
/.well-known/oauth-authorization-server | Advertises the authorization endpoints and supported options. |
/oauth2/authorize | Starts browser sign-in. |
/oauth2/token | Exchanges the authorization result for a token and renews access. |
/oauth2/register | Supports dynamic client registration. |
/oauth2/revoke | Revokes an access or refresh token. |
Interactive SSO uses the authorization-code and refresh-token flows with PKCE S256. PKCE S256 is required. Public clients do not use a client secret. GoodData supports dynamic client registration or client identification through a client-metadata URL.
Interactive SSO on GoodData.CN
Interactive SSO on GoodData.CN is disabled by default. Enable the MCP Server and OAuth Authorization Server in your Helm values. Also configure the ingress protocol and port to match the address that users’ browsers use to access GoodData.
deployMCPServer: true
enableGatewayOauthAuthorizationServer: true
ingress:
lbProtocol: https
lbPort: 443
apiGw:
oauth:
authorizationServer:
enabled: trueThese settings apply to all organizations in the deployment. If your externally reachable GoodData address uses a different protocol or port, set ingress.lbProtocol and ingress.lbPort to those browser-facing values.
Important Notice
ingress.lbProtocol and ingress.lbPort must describe what the browser sees, not the connection between your edge and the GoodData ingress.
For example, if TLS terminates at a proxy before the GoodData ingress and users access GoodData over HTTPS, do not set ingress.lbProtocol: http just because the internal hop uses HTTP. A protocol or port mismatch can cause GoodData to treat its own OAuth consent request as cross-origin. In that case, both Allow and Deny on the consent page can fail with HTTP 403.
Interactive SSO requires a GoodData.CN release that includes the MCP OAuth Authorization Server on the organization hostname. If the discovery endpoints return 404 after you enable the settings, verify your GoodData.CN version.
For clients that identify themselves through a client-metadata URL, the API gateway must be able to make a direct outbound HTTPS request to the host that serves the metadata document. This currently does not use a configured outbound proxy, does not support TLS interception with a private CA, and does not follow redirects. A client that registers dynamically does not require this outbound metadata request.
Before using interactive SSO on GoodData.CN, verify that:
- an identity provider is configured for the organization; the built-in provider is sufficient
- users access GoodData through the organization hostname stored in GoodData
ingress.lbProtocolandingress.lbPortmatch the browser-facing GoodData address- the ingress passes the
Hostheader unchanged - the
GD_SESSION_ID,GD_OAUTH_FLOW, andGD_OAUTH_CONSENTcookies pass through any proxy, WAF, or CDN unchanged - the edge preserves the
Referrer-Policy: same-originheader returned by the OAuth consent page - no interactive challenge, such as CAPTCHA or a JavaScript challenge, is applied to
/oauth2/*or/login/* - the user’s browser can reach the GoodData hostname
- the MCP client runs on the same machine as the browser
The OAuth consent page relies on Referrer-Policy: same-origin when the browser submits the user’s decision. Do not remove or overwrite this response header. In particular, changing it to no-referrer can cause the browser to send Origin: null. GoodData rejects that request as invalid cross-origin traffic, so both Allow and Deny return HTTP 403.
If a metadata-based client cannot complete sign-in because direct outbound HTTPS is unavailable, use an API token instead.
Example Configurations
The examples below use API-token authentication. If your client supports interactive SSO, configure only the MCP server URL as described in Interactive SSO and omit the Authorization header.
Claude Desktop
Claude Desktop supports stdio MCP servers natively. To connect to the GoodData streamable HTTP endpoint, use the mcp-remote bridge through npx.
Configuration file:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"GoodData": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <your-api-token>"
}
}
}
}Restart Claude Desktop after saving the configuration. The Bearer token is passed through the env block instead of directly as a CLI argument to avoid cross-platform issues with spaces.
Claude Code
claude mcp add --transport http GoodData \
"https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp" \
--header "Authorization: Bearer <your-api-token>"The --transport option must come before the server name. Use http as the transport value, not streamable-http.
Cursor
Configuration file: ~/.cursor/mcp.json for global configuration, or .cursor/mcp.json for a project. You can also configure the server from Cursor Settings > MCP.
{
"mcpServers": {
"GoodData": {
"url": "https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp",
"headers": {
"Authorization": "Bearer <your-api-token>"
}
}
}
}Cursor auto-detects the transport from the URL. You do not need to add a type field.
VS Code with GitHub Copilot
Configuration file: .vscode/mcp.json, or use MCP: Open User Configuration from the Command Palette.
{
"servers": {
"GoodData": {
"type": "http",
"url": "https://<your-gooddata-host>/api/v1/actions/workspaces/<workspaceId>/ai/mcp",
"headers": {
"Authorization": "Bearer <your-api-token>"
}
}
}
}The root key is servers, not mcpServers. The type is http, not streamable-http. VS Code tries Streamable HTTP first and falls back to SSE. This setup requires the GitHub Copilot extension with MCP support enabled.
Usage Examples
Browse Metrics
Tool: list_workspace_metrics
Optional filters:
title=like=*revenue*- Find metrics with “revenue” in the titletags=in=('finance','kpi')- Filter by tagslimit=10- Limit results to 10 metrics
Get specific metric:
list_workspace_metrics(entity_id="revenue_total")- Retrieve full metric details including MAQL definition
Create a Metric
Tool: create_metric
Use this tool to create a governed metric in the workspace. The metric becomes part of the semantic layer and can be reused by other GoodData capabilities.
Create Alerts
Tool: create_metric_alert
Comparison Alert Example:
automation_id: "revenue-milestone"
metric_id: "revenue_total"
operator: "LESS_THAN"
threshold: 90000
metric_format: "$#,##0"
metric_title: "Total Revenue"
notification_channel_id: "email-channel-id"
internal_recipients: ["user-id-123"]
cron: "0 0 8 * * *"Range Alert Example:
operator: "BETWEEN"
from_value: 100000
to_value: 1000000Relative Alert Example:
operator: "INCREASES_BY"
compare_metric_id: "revenue_last_month"
threshold: 0.10
arithmetic_operator: "CHANGE"
compare_metric_format: "$#,##0"
compare_metric_title: "Last Month Revenue"Update Alerts
Tool: update_metric_alert
Examples:
- Update threshold:
threshold=2000000 - Convert to range alert:
operator="BETWEEN",from_value=100000,to_value=500000 - Change to relative alert:
operator="INCREASES_BY",compare_metric_id="revenue_last_month",threshold=0.15 - Update schedule:
cron="0 30 14 * * 1-5",timezone="UTC"
Update Alert State
Tool: update_alert_state
Use this tool to pause or resume alerts.
automation_id: "revenue-milestone"
state: "pause"Create Scheduled Exports
Tool: create_scheduled_export
Use this tool to create recurring exports of dashboards or visualizations.
Run an Export
Tool: run_export
Use this tool to create an on-demand export. The MCP client can resolve a dashboard, visualization, or widget first, and then call run_export with the required export mode and identifiers.
Example requests:
Export the Executive KPI dashboard to PDF.Give me the Revenue table for Q4 as Excel.Create a PPTX of the Quarterly Review dashboard.Capture a PNG of the Pipeline Funnel widget at 1920 x 1080.
The response includes a download URL and metadata for the exported file.
Use Generated API Tools
On GoodData.CN, generated API tools are available when the capability is enabled for your deployment. If configuration is required, use the settings described in Enable Tool Search and Generated API Tools. Use search_tools to find a generated tool and call_tool to run it, or call a known generated tool directly by its exact name.
Generated API tools let agents read or create supported workspace metadata without making a separate REST API call.
Important Notice
Generated tools are subject to the same permissions as the GoodData API. Tool availability does not guarantee that the current user has permission to complete the requested operation.
AI Search and Chat
AI Search:
ai_search(question="What were the total sales last quarter?")AI Chat:
ai_chat(question="Give me bar chart slicing revenue by country")Multi-turn conversation:
# First request
result1 = ai_chat(question="Give me revenue by country")
thread_id = result1.thread_id_suffix
# Follow-up maintains context
result2 = ai_chat(
question="And now filter to USA only",
thread_id_suffix=thread_id
)Label Elements (AFM)
Tool: compute_label_elements
Examples:
- Basic lookup:
label_id="attr.customer.name" - Pattern search:
pattern_filter="Premium%" - Exact filter:
exact_filter=["North America", "Europe"] - Exclusion:
exact_filter=["Archived", "Deleted"],complement_filter=True - Pagination:
offset=200,limit=100
Scan Datasource and Generate LDM
Step 1: Scan datasource
scan_datasource(
datasource_id="my_db",
schemas=["public"],
scan_tables=True,
scan_views=True
)Step 2: Generate LDM
generate_ldm(
datasource_id="my_db",
pdm=scan_result # Pass entire scan result or scan_result["pdm"]
)Register Upload Notification
Tool: register_upload_notification
Use this tool after new data is uploaded for a datasource to invalidate related cache. This operation is organization-scoped and requires the MANAGE permission.
Security and Permissions
- Authentication: All operations require bearer authentication. The bearer token can be a GoodData API token, a signed JWT, or a token obtained automatically after interactive sign-in.
- Workspace Isolation: All operations are scoped to the authenticated user’s workspace context.
- Permission Enforcement: Tools respect user permissions and only return objects you can access. Generated API tools grant no additional access and enforce the same permissions as the underlying GoodData API.
- Organization-scoped Operations: Datasource operations may require elevated permissions.
- Alert Recipients: Must match the notification channel’s
allowedRecipientsconfiguration.
Limits and Behavior
Stateless HTTP Streaming: Optimized for MCP clients with stateless operation.
Pagination: List tools support
limitparameter (recommended: 10-50 for quick browsing).RSQL Filtering: Advanced filtering using RSQL syntax on list operations.
Cron Format:
"second minute hour day month weekday"(e.g.,"0 0 8 * * *"= daily at 8 AM).Label Elements: Default limit 100, maximum 10000.
Error Handling: Structured error responses with field-level validation messages.
Tool Search: When tool search is enabled for the organization,
tools/listreturns onlysearch_toolsandcall_tool. All other tools remain callable by exact name.Generated API Tools: When generated API tools are configurable in your GoodData.CN version, they require
enableMcpGeneratedTools. They are workspace-scoped and include metadata-serviceGEToperations and allowlisted create operations only.
- Exports: On-demand exports may take time to complete. Large files are returned through download URLs rather than embedded in the tool response.
Troubleshooting
401/403 Errors:
- If interactive SSO is enabled and your client supports it, a
401authentication challenge can cause the client to open the browser sign-in flow. This is expected behavior. - If you use an API token, verify that the token is valid and has access to the workspace.
- A
403usually means the authenticated user does not have permission for the requested operation. Check the required workspace or organization permissions.
Interactive SSO Does Not Start:
- Verify that both
enableGatewayOauthAuthorizationServerandapiGw.oauth.authorizationServer.enabledare set totrue. - For a client that uses a client-metadata URL, verify that the API gateway has direct outbound HTTPS access to the metadata host.
- If the browser never reaches a login page, check the
api-gwlogs for entries withaction=cimdFetch. A failed fetch indicates a network or metadata-host problem. - If no
cimdFetchentry appears, the client may be using dynamic registration. Check the other SSO prerequisites instead.
Approval Page Returns HTTP 403:
- Verify that
ingress.lbProtocolandingress.lbPortmatch the protocol and port used by the browser. - If TLS terminates before the GoodData ingress, configure the externally visible HTTPS protocol rather than the internal HTTP hop.
- Verify that your proxy, WAF, or CDN preserves
Referrer-Policy: same-originon the approval page. Do not override it withno-referrer. - Verify that
GD_OAUTH_CONSENTpasses through the edge unchanged.
404 Errors:
- Object may not exist or you may lack permission to view it.
- Verify workspace ID is correct in the endpoint URL.
Invalid RSQL Filter:
- Check RSQL syntax (e.g.,
title=like=*revenue*). - Verify field names match available metadata fields.
Alert Creation Failures:
- Comparison alerts require
thresholdparameter. - Range alerts require both
from_valueandto_value. - Relative alerts require
compare_metric_idandthreshold. - Recipients must match notification channel’s
allowedRecipientspolicy.
Only search_tools and call_tool Are Listed:
- This is expected when tool search is enabled for your organization.
- Use
search_toolsto discover a tool andcall_toolto run it. - If your integration already knows the exact tool name, it can call that tool directly. Do not use
tools/listas a complete catalog.
Generated API Tool Is Missing:
- If tool search and generated API tools are configurable in your GoodData.CN version, verify that both
enableMcpToolSearchandenableMcpGeneratedToolsare enabled for the organization.
- Use
search_toolsto find generated tools instead of relying on the initial tool list. - Some operations are intentionally not exposed, including
PUT,PATCH,DELETE, action endpoints, organization-scoped endpoints, and non-allowlisted create operations.
Export Fails:
- Verify that you have the required export permission for the requested export type.
- Check that the referenced dashboard, visualization, widget, or execution result exists and is accessible.
- For large exports, wait for the export to complete and use the returned download URL.
Label Elements Errors:
limitmust be > 0 and ≤ 10000.sort_ordermust be"ASC"or"DESC".
LDM Generation:
- Ensure PDM comes from successful
scan_datasourceoperation. - Can pass entire scan result or just the
pdmfield.
Compatibility
The GoodData MCP Server is compatible with MCP clients that support the required transport and protocol version.
Interactive SSO additionally requires a client that supports interactive OAuth and runs on the same machine as the user’s browser. Desktop applications and CLI clients can use this flow. Remotely hosted or web-based clients are not yet supported by interactive SSO.
On GoodData.CN, clients can discover tools with search_tools when tool search is enabled, or call tools they already know by exact name. Client capability does not change which tools are available on the server.
Supported client examples:
- Claude Desktop, through
mcp-remote - Claude Code
- Cursor
- VS Code with GitHub Copilot
- MCP Inspector
- Custom MCP clients