Model Context Protocol moderate risk

Airtable

Airtable MCP server enables natural language interaction with Airtable data, offering CRUD operations, schema management, webhooks, and AI-powered analytics, secured with governance controls.

Connections & Capabilities

Connects To

GitHub

Capabilities

readwriteadmin

Quickstart

Install

npm install -g @rashidazarang/airtable-mcp

Config

{
  "mcpServers": {
    "airtable": {
      "command": "npx",
      "args": ["-y", "@rashidazarang/airtable-mcp"],
      "env": {
        "AIRTABLE_TOKEN": "YOUR_AIRTABLE_TOKEN",
        "AIRTABLE_BASE_ID": "YOUR_BASE_ID"
      }
    }
  }
}

Exposed MCP Tools (42)

safe

list_bases

Lists all accessible Airtable bases with associated permissions.

Read-only operation, no data modification.

safe

describe

Describes the schema of a specified Airtable base or table.

Read-only operation, no data modification.

safe

query

Queries records from an Airtable table based on specified filters and sorting.

Read-only operation, no data modification.

safe

search_records

Performs an advanced search for records using Airtable formulas.

Read-only operation, no data modification.

safe

list_records

Lists records from an Airtable table with field selection and pagination.

Read-only operation, no data modification.

safe

get_record

Retrieves a single record from an Airtable table by its ID.

Read-only operation, no data modification.

moderate

create

Creates a new record in an Airtable table.

Creates new data, requires dryRun diff review.

high

update

Updates an existing record in an Airtable table.

Modifies existing data, requires dryRun diff review.

critical

delete_record

Deletes a record from an Airtable table.

Destructive operation, permanently removes data.

high

upsert

Updates or creates records based on merge fields.

Modifies or creates data based on merge conditions.

high

batch_upsert_records

Performs batch upsert operations with merge-on fields.

Batch modification or creation of data based on merge conditions.

safe

list_tables

Retrieves all tables within a specified Airtable base, including schema information.

Read-only operation, no data modification.

safe

get_base_schema

Retrieves the complete schema for a specified Airtable base.

Read-only operation, no data modification.

safe

list_field_types

Provides a reference guide for available field types in Airtable.

Read-only operation, no data modification.

safe

get_table_views

Lists all views associated with a specified table.

Read-only operation, no data modification.

high

create_table

Creates a new table within an Airtable base with custom field definitions.

Modifies the structure of the Airtable base.

high

update_table

Modifies the name and description of an existing table.

Modifies the structure of the Airtable base.

critical

delete_table

Deletes a table from an Airtable base.

Destructive operation, permanently removes a table.

high

create_field

Adds a new field to an existing table.

Modifies the structure of the Airtable base.

high

update_field

Modifies the properties and options of an existing field.

Modifies the structure of the Airtable base.

critical

delete_field

Deletes a field from an Airtable table.

Destructive operation, permanently removes a field.

moderate

batch_create_records

Creates up to 10 records at once in a specified table.

Creates new data in batches.

high

batch_update_records

Updates up to 10 records simultaneously in a specified table.

Modifies existing data in batches.

critical

batch_delete_records

Deletes up to 10 records in one operation from a specified table.

Destructive operation, permanently removes multiple records.

safe

list_webhooks

Lists all configured webhooks in the Airtable base.

Read-only operation, no data modification.

high

create_webhook

Sets up real-time notifications for changes in the Airtable base.

Creates a webhook that can trigger external actions.

high

delete_webhook

Removes a webhook configuration from the Airtable base.

Removes a webhook configuration.

safe

get_webhook_payloads

Retrieves the notification history for a specified webhook.

Read-only operation, no data modification.

moderate

refresh_webhook

Extends the expiration of a specified webhook.

Modifies the expiration of a webhook.

moderate

create_view

Creates a new view (grid, form, calendar, etc.) in a specified table.

Creates a new view.

safe

get_view_metadata

Retrieves metadata for a specified view, including filters.

Read-only operation, no data modification.

moderate

upload_attachment

Attaches files from URLs to a specified record.

Uploads attachments to a record.

high

create_base

Creates a new Airtable base with an initial structure.

Creates a new Airtable base.

safe

list_collaborators

Lists collaborators and their permissions for a specified Airtable base.

Read-only operation, no data modification.

safe

list_shares

Lists shared views and configurations for a specified Airtable base.

Read-only operation, no data modification.

safe

list_comments

Lists comments on a specified record.

Read-only operation, no data modification.

moderate

create_comment

Adds a new comment to a specified record.

Adds a new comment.

moderate

update_comment

Edits an existing comment on a specified record.

Modifies an existing comment.

moderate

delete_comment

Deletes a comment from a specified record.

Deletes a comment.

safe

whoami

Retrieves the current user's identity and scopes.

Read-only operation, no data modification.

safe

list_governance

Returns governance allow-lists and PII masking policies.

Read-only operation, no data modification.

safe

list_exceptions

Lists recent exceptions and remediation proposals.

Read-only operation, no data modification.

Safety Assessment

The Airtable MCP server offers extensive functionality but requires careful configuration to mitigate risks. It is relatively safe for read-only operations and data analysis. Risky operations like deleting records or modifying schemas should be carefully reviewed and governed.

Governance controls with allow-listing
PII masking capabilities
Exception tracking for auditing
Dry-run mode for create and update operations

Requires Airtable token with broad scopes
Potential for data modification and deletion
Webhook management can introduce external risks
AI analytics might expose sensitive data if not configured properly
No sandboxing

Client Compatibility

Claude Desktopfull

Cursoruntested

Windsurfuntested

VS Code (Copilot)untested

Security Notes

data.records:readdata.records:writedata.recordComments:readdata.recordComments:writeschema.bases:readschema.bases:writeuser.email:readwebhook:manage

Compromised Airtable token leads to full data access and modification.
Improperly configured webhooks can expose data to unauthorized endpoints.
Lack of input sanitization can lead to injection attacks.
AI analytics could inadvertently expose sensitive information.
Insufficient governance policies can lead to unintended data changes.

Best For

Teams using Airtable for data management
Organizations needing natural language access to Airtable data
Users who want to automate Airtable workflows
Scenarios requiring governance and compliance controls
Projects needing AI-powered analytics on Airtable data