Skip to main content

​
Overview

The Metabase connector gives Rootly AI read-only, on-demand access to the analytics context your responders already use. During an investigation, Rootly AI can search Metabase tables and metrics, inspect metadata, construct a structured query, and run it against your connected data sources. That makes business and operational questions available alongside incident context. For example, Rootly AI can answer “How many customers are affected in this region?” or “Did checkout volume change when the errors began?” using current Metabase results. Rootly does not ingest Metabase dashboards, questions, metadata, or query results into its persistent AI facts graph. The connector queries Metabase only when an investigation needs the context, so Metabase remains the source of truth and results do not become stale copies.
Access is scoped to the Metabase user who authorizes the connection. Rootly AI can only discover and query content that person can access in Metabase.

​
Before You Start

You need:
  • A public Metabase instance reachable over HTTPS.
  • An administrator to enable AI features and the MCP server under Admin → AI → MCP in Metabase.
  • A Metabase user who can authorize the connection and has access to the databases, tables, metrics, and collections Rootly AI should query.
  • Permission in Rootly to manage AI connectors.
Metabase serves its MCP endpoint at /api/metabase-mcp. You can enter either your instance URL, such as https://metabase.example.com, or the complete endpoint, such as https://metabase.example.com/api/metabase-mcp. Rootly normalizes both forms to the complete endpoint. Rootly requests these Metabase OAuth scopes:
  • agent:query
  • agent:query:construct
  • agent:query:execute
  • agent:resource:read
  • agent:search
These scopes support only the reviewed metadata and structured-query tools listed below. Rootly does not request Metabase content-management or raw-SQL access.
Use a narrowly scoped Metabase account. The OAuth grant carries that user’s Metabase permissions, so connecting with a broadly privileged administrator exposes correspondingly broad analytics context to Rootly AI.
If a self-hosted instance must be restricted at the network layer, expose it through a public HTTPS load balancer, allow-list Rootly AI’s outbound IP ranges, and deny other traffic. Contact Rootly support for the current outbound IP allow-list.

​
Setup

1

Open the Metabase Card

Go to Configuration → AI → Connectors and click Connect on the Metabase card.
2

Enter Your Metabase URL

Enter the public HTTPS URL for your Metabase instance or its complete /api/metabase-mcp endpoint, then continue.
3

Authorize Rootly

Rootly discovers Metabase’s OAuth endpoints, registers as a client, and redirects you to a Metabase consent page. Sign in as the user whose permissions Rootly AI should use, review the requested access, and click Authorize.
4

Complete the Connection

After Metabase redirects back, Rootly validates the token by discovering the approved tool catalog. The card shows Connected only after that validation succeeds.
Rootly uses OAuth 2.0 with Dynamic Client Registration and PKCE. You do not need to create or paste an API key, client ID, or client secret.

​
What Rootly AI Can Query

Rootly exposes five read-only Metabase tools: Rootly does not expose Metabase’s content-creation, update, deletion, raw SQL, or interactive visualization tools. The connector cannot create questions or dashboards, update Metabase content, or invoke execute_sql.
Metabase metadata makes the connector more useful. Clear table and field names, descriptions, semantic types, verified models, and curated metrics help Rootly AI select the right source and construct better queries.

​
Data Handling and Permissions

  • On-demand only. Rootly AI calls Metabase during an investigation or direct question; it does not run a background ingestion job.
  • No persistent Metabase facts. Rootly does not copy dashboards, questions, metadata, or query results into the AI facts graph.
  • Metabase permissions apply. Search, resource reads, and query execution run as the user who approved the OAuth grant.
  • Read-only tool allowlist. Rootly exposes only the five reviewed tools above, even if Metabase advertises additional tools later.
  • Encrypted credentials. OAuth credentials are encrypted at rest and scrubbed when the connection is disconnected or replaced.
  • AI traces may contain results. Connector responses can appear in Rootly AI’s model and observability traces. See Data Privacy for Rootly AI for retention details.

​
Managing the Connection

Open the Metabase card to reconnect or disconnect it. A Rootly team has one active Metabase connection. When you reconnect with a different URL or Metabase user, Rootly validates the new OAuth grant and tool catalog before replacing the working connection. If validation fails, the existing connection remains available. Disconnecting removes the stored OAuth credentials and prevents future Metabase queries. It does not change or delete anything in Metabase.

​
Troubleshooting

Confirm the URL is public HTTPS and that it resolves to your Metabase instance. Private addresses, localhost, embedded credentials, query strings, fragments, and unrelated URL paths are rejected. In Metabase, verify that AI features and Admin → AI → MCP → Enable MCP server are both enabled.
Rootly validates the connection by listing Metabase’s MCP tools after the redirect. Confirm that /api/metabase-mcp is reachable from the public internet and that your Metabase Site URL matches the public address. A reverse proxy that blocks the MCP endpoint or OAuth metadata endpoints can also cause validation to fail.
The authorizing user’s Metabase permissions control what Rootly can see. Sign in to Metabase as that user and confirm the resource is visible. If a different account should supply the connection, reconnect and authorize as that account.
The OAuth grant may have been revoked or the user’s Metabase access may have changed. Review Admin → AI → MCP → Authorizations in Metabase, then reconnect the Rootly connector to issue a fresh grant.
Rootly AI calls connectors only when the current question needs them. Try asking a question that explicitly names the relevant Metabase metric, table, dashboard, or business measure. Also confirm that the authorizing user can access it.

Connectors

Browse all Rootly AI connectors and how investigations use them.

Data Privacy for Rootly AI

Review encryption, retention, trace handling, and model controls.

Metabase MCP Server

Configure and audit the MCP server in Metabase.