> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Metabase AI Connector

> Connect Rootly AI to Metabase so investigations can search your semantic layer and run current, permission-scoped analytics queries.

## Overview

The **Metabase** connector gives Rootly AI read-only, on-demand access to the analytics context your responders already use. During an investigation, Rootly AI can search Metabase tables and metrics, inspect metadata, construct a structured query, and run it against your connected data sources.

That makes business and operational questions available alongside incident context. For example, Rootly AI can answer *"How many customers are affected in this region?"* or *"Did checkout volume change when the errors began?"* using current Metabase results.

Rootly does not ingest Metabase dashboards, questions, metadata, or query results into its persistent AI facts graph. The connector queries Metabase only when an investigation needs the context, so Metabase remains the source of truth and results do not become stale copies.

<Note>
  Access is scoped to the Metabase user who authorizes the connection. Rootly AI can only discover and query content that person can access in Metabase.
</Note>

***

## Before You Start

You need:

* A public Metabase instance reachable over HTTPS.
* An administrator to enable **AI features** and the **MCP server** under **Admin → AI → MCP** in Metabase.
* A Metabase user who can authorize the connection and has access to the databases, tables, metrics, and collections Rootly AI should query.
* Permission in Rootly to manage AI connectors.

Metabase serves its MCP endpoint at `/api/metabase-mcp`. You can enter either your instance URL, such as `https://metabase.example.com`, or the complete endpoint, such as `https://metabase.example.com/api/metabase-mcp`. Rootly normalizes both forms to the complete endpoint.

Rootly requests these Metabase OAuth scopes:

* `agent:query`
* `agent:query:construct`
* `agent:query:execute`
* `agent:resource:read`
* `agent:search`

These scopes support only the reviewed metadata and structured-query tools listed below. Rootly does not request Metabase content-management or raw-SQL access.

<Warning>
  Use a narrowly scoped Metabase account. The OAuth grant carries that user's Metabase permissions, so connecting with a broadly privileged administrator exposes correspondingly broad analytics context to Rootly AI.
</Warning>

<Note>
  If a self-hosted instance must be restricted at the network layer, expose it through a public HTTPS load balancer, allow-list Rootly AI's outbound IP ranges, and deny other traffic. Contact Rootly support for the current outbound IP allow-list.
</Note>

***

## Setup

<Steps>
  <Step title="Open the Metabase Card">
    Go to **Configuration → AI → Connectors** and click **Connect** on the **Metabase** card.
  </Step>

  <Step title="Enter Your Metabase URL">
    Enter the public HTTPS URL for your Metabase instance or its complete `/api/metabase-mcp` endpoint, then continue.
  </Step>

  <Step title="Authorize Rootly">
    Rootly discovers Metabase's OAuth endpoints, registers as a client, and redirects you to a Metabase consent page. Sign in as the user whose permissions Rootly AI should use, review the requested access, and click **Authorize**.
  </Step>

  <Step title="Complete the Connection">
    After Metabase redirects back, Rootly validates the token by discovering the approved tool catalog. The card shows **Connected** only after that validation succeeds.
  </Step>
</Steps>

Rootly uses OAuth 2.0 with Dynamic Client Registration and PKCE. You do not need to create or paste an API key, client ID, or client secret.

***

## What Rootly AI Can Query

Rootly exposes five read-only Metabase tools:

| Tool              | What it does                                                                                                                      |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `search`          | Finds tables and metrics with keyword or natural-language search.                                                                 |
| `read_resource`   | Reads metadata for resources such as databases, schemas, tables, fields, metrics, models, questions, dashboards, and collections. |
| `construct_query` | Builds a structured query against a table or metric and returns an opaque query handle.                                           |
| `execute_query`   | Runs a previously constructed query and returns its results and column metadata.                                                  |
| `query`           | Runs a structured query or continues through a paginated result set.                                                              |

Rootly does **not** expose Metabase's content-creation, update, deletion, raw SQL, or interactive visualization tools. The connector cannot create questions or dashboards, update Metabase content, or invoke `execute_sql`.

<Tip>
  Metabase metadata makes the connector more useful. Clear table and field names, descriptions, semantic types, verified models, and curated metrics help Rootly AI select the right source and construct better queries.
</Tip>

***

## Data Handling and Permissions

* **On-demand only.** Rootly AI calls Metabase during an investigation or direct question; it does not run a background ingestion job.
* **No persistent Metabase facts.** Rootly does not copy dashboards, questions, metadata, or query results into the AI facts graph.
* **Metabase permissions apply.** Search, resource reads, and query execution run as the user who approved the OAuth grant.
* **Read-only tool allowlist.** Rootly exposes only the five reviewed tools above, even if Metabase advertises additional tools later.
* **Encrypted credentials.** OAuth credentials are encrypted at rest and scrubbed when the connection is disconnected or replaced.
* **AI traces may contain results.** Connector responses can appear in Rootly AI's model and observability traces. See [Data Privacy for Rootly AI](/ai/data-privacy-for-rootly-ai) for retention details.

***

## Managing the Connection

Open the Metabase card to reconnect or disconnect it. A Rootly team has one active Metabase connection.

When you reconnect with a different URL or Metabase user, Rootly validates the new OAuth grant and tool catalog before replacing the working connection. If validation fails, the existing connection remains available.

Disconnecting removes the stored OAuth credentials and prevents future Metabase queries. It does not change or delete anything in Metabase.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="The connection fails before the Metabase login page opens" icon="triangle-exclamation">
    Confirm the URL is public HTTPS and that it resolves to your Metabase instance. Private addresses, `localhost`, embedded credentials, query strings, fragments, and unrelated URL paths are rejected. In Metabase, verify that **AI features** and **Admin → AI → MCP → Enable MCP server** are both enabled.
  </Accordion>

  <Accordion title="OAuth succeeds, but Rootly cannot validate the connection" icon="plug-circle-xmark">
    Rootly validates the connection by listing Metabase's MCP tools after the redirect. Confirm that `/api/metabase-mcp` is reachable from the public internet and that your Metabase Site URL matches the public address. A reverse proxy that blocks the MCP endpoint or OAuth metadata endpoints can also cause validation to fail.
  </Accordion>

  <Accordion title="Rootly AI cannot find a table, metric, question, or dashboard" icon="magnifying-glass">
    The authorizing user's Metabase permissions control what Rootly can see. Sign in to Metabase as that user and confirm the resource is visible. If a different account should supply the connection, reconnect and authorize as that account.
  </Accordion>

  <Accordion title="Queries stopped working after the connection was established" icon="key">
    The OAuth grant may have been revoked or the user's Metabase access may have changed. Review **Admin → AI → MCP → Authorizations** in Metabase, then reconnect the Rootly connector to issue a fresh grant.
  </Accordion>

  <Accordion title="A Metabase result is missing from an investigation" icon="circle-question">
    Rootly AI calls connectors only when the current question needs them. Try asking a question that explicitly names the relevant Metabase metric, table, dashboard, or business measure. Also confirm that the authorizing user can access it.
  </Accordion>
</AccordionGroup>

***

## Related Pages

<CardGroup cols={3}>
  <Card title="Connectors" icon="sparkles" href="/ai/connectors/overview">
    Browse all Rootly AI connectors and how investigations use them.
  </Card>

  <Card title="Data Privacy for Rootly AI" icon="shield" href="/ai/data-privacy-for-rootly-ai">
    Review encryption, retention, trace handling, and model controls.
  </Card>

  <Card title="Metabase MCP Server" icon="arrow-up-right-from-square" href="https://www.metabase.com/docs/latest/ai/mcp">
    Configure and audit the MCP server in Metabase.
  </Card>
</CardGroup>