{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "baserow", "name": "Baserow", "vendor": "Baserow B.V.", "vendorUrl": "https://baserow.io", "kind": "http-api", "category": "spreadsheets", "summary": "Baserow is an open-source database of typed rows in tables, sold as a hosted cloud and as software to self-host. Agents reach it through a REST API with database tokens and a built-in MCP server.", "url": "https://www.anchorterminal.com/tools/baserow", "markdownUrl": "https://www.anchorterminal.com/tools/baserow.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/baserow.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/baserow.json", "repo": "https://github.com/baserow/baserow", "license": "MIT for the core, including the REST API and the MCP server. Code under premium/ and enterprise/ is source-available under Baserow's own licences and needs a paid subscription in production. Docs are CC BY-SA 4.0", "transports": [ "http", "sse" ], "remoteUrl": "https://api.baserow.io", "packages": [], "auth": "api-key", "authNotes": "Self-serve. A signed-in user creates a database token in the workspace settings, choosing the tables it can reach and whether it may create, read, update or delete rows. Tokens don't expire and can be regenerated or deleted. They cover rows only, so changing tables or fields needs a JWT from `/api/user/token-auth/` with the account's email and password, which carries the user's full access. The MCP server has no token header or OAuth. Each endpoint is a URL holding a 32-character key that carries the creating user's access across one workspace, and deleting the endpoint revokes it. On Enterprise licences only workspace admins and builders can create database tokens.", "pricing": "freemium", "pricingNotes": "Free cloud plan with 3,000 rows and 2 GB of storage per workspace, so an agent can start without a contract. Premium is $10 a user a month billed yearly ($12 monthly) and Advanced $18 ($22 monthly), Enterprise through sales. API calls aren't priced, the MCP server is on every plan, and there's no separate sandbox. The self-hosted core is free with no row or request limits (checked 2026-10-08).", "priceSummary": "$10 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI description, the MCP docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 7, "popularity": { "githubStars": 6098, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://baserow.io/user-docs/database-api", "llmsTxt": "https://baserow.io/llms.txt", "openapi": "https://api.baserow.io/api/schema.json", "capabilities": [ "sheets.records", "sheets.read", "sheets.write", "sheets.tables", "sheets.formulas" ], "tags": [ "official", "hosted", "self-hosted", "open-source", "mcp", "free-tier", "api-key", "openapi", "llms-txt", "webhooks", "status-page", "soc2" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 63.6, "grade": "B", "agentReady": false, "rank": 306, "ranked": true, "rankOf": 722, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 72, "payments": 40, "reliability": 65, "schema": 77, "security": 54, "transparency": 65 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on Baserow Cloud's REST API and built-in MCP server, with the hosted lines. Better Stack status page at status.baserow.org with five components and 90 days of history (20). Backend API at 99.981 per cent over 90 days, with 6 minutes down on 1 October 2026, degraded real-time and MCP performance on 8 September and an error on public views on 23 September, all minor (20). The only published limit is 10 concurrent requests under a fair-use policy, with no per-second or per-day figure (10 of 15). The docs ask for retries with exponential backoff, but no Retry-After header or idempotency key is documented and the OpenAPI description has no 429 response for row calls (5 of 15). No SLA found, and the terms describe a best-efforts service (0). The REST API is generally available and the MCP docs carry no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "Public OpenAPI 3.0.3 description with 312 paths and 424 operations, and every MCP tool has a JSON Schema generated from a typed model (25). llms.txt exists but links to HTML marketing and docs pages, with no Markdown docs found (5 of 10). Endpoint descriptions are long and specific, and MCP tool descriptions say which tool to call first (15 of 20). Parameters are typed, but `filters` is a JSON string, row bodies depend on the table, and MCP rows are untyped objects keyed by field name (8 of 15). Curl examples in the docs and an enum of error codes on each response, 260 distinct codes in all (12 of 15). The description carries the release version and the changelog has Breaking API changes sections, with no API version in the path (12 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "The MCP server has 7 compact tools (25). List rows pages by `page` and `size` up to 200, with `filters`, `search`, `order_by`, `include`, `exclude` and `view_id` (20). Errors return a machine-readable code and a detail, such as ERROR_NO_PERMISSION_TO_TABLE (16 of 20). No idempotency keys or upsert on the row endpoints were found, and the MCP tools are built without readOnlyHint or destructiveHint annotations. Batch calls of 200 rows reduce the number of writes to retry (5 of 20). Few required parameters, but no official client library in any language was found (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 54, "points": 9.45, "reason": "Database tokens are limited to one workspace, chosen tables and create, read, update or delete, and can be regenerated or deleted, which would earn 30. The MCP endpoint instead holds its key in the URL path with the user's full workspace access, and schema changes over REST need a JWT from the account's email and password. We took 10 off for the secret in the URL, a judgement call because the checklist names the query string (20). Read-only tokens per table on REST. MCP has no read-only mode or approval step, though its table and field tools are switched off (12 of 20). Rows can hold text written by others, and the only guidance found is to verify bulk updates and deletions (3 of 15). Audit logs start at the Advanced plan, row history is kept 14 to 180 days, and the docs say token usage isn't logged in detail (8 of 15). SECURITY.md gives a reporting email, and the FAQ claims SOC 2 Type II and HIPAA. No security.txt, bug bounty or published advisory found (11 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "Graded on the hosted cloud. No x402, MPP or L402 found (0). Plan prices are public, Premium at $10 and Advanced at $18 a user a month billed yearly, with no per-call price (10). A Free plan with 3,000 rows per workspace. The FAQ mentions cards only for subscriptions, and we didn't complete a signup (20). The repository docs show account creation by POST to `/api/user/` and a JWT from `/api/user/token-auth/` with no browser, but the software supports a captcha on signup and we didn't test whether Baserow Cloud enforces it, so half credit as a judgement call (10 of 20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "Release 2.4.0 on 29 September 2026, 9 days before the check (30). Four releases in the last 90 days, 2.3.2, 2.3.3, 2.3.4 and 2.4.0 (20). The community forum shows staff replies within a day or two on recent threads. The GitHub issues page counted 1,199 open issues, and we didn't read reply times there (15 of 25). No official client library, and the only Baserow entry in the official MCP registry is a third party's (0 of 15). The repository has CI and daily backend test workflows and the changelog records dependency upgrades for security fixes. We didn't read the current CI result (7 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "note": "editorial 49, provenance 80", "reason": "The core, including the REST API and MCP server, is MIT. Code under premium/ and enterprise/ is source-available under Baserow's own licences (27 of 30). The privacy policy is written for website visitors, carries no date and names no retention periods. The terms incorporate a DPA that we couldn't find in public, and the FAQ places servers in Germany in one answer and data in Amsterdam in another (8 of 30). A deprecations page exists but lists only PostgreSQL versions. Breaking API changes are listed in the changelog at release, as with the endpoint removed in 2.4.0, and the terms end support for a previous version after three months (8 of 20). Hosting in Germany is stated, with the inconsistency above, and no sub-processor list was found (6 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "The MCP server has 7 compact tools (25). List rows pages by `page` and `size` up to 200, with `filters`, `search`, `order_by`, `include`, `exclude` and `view_id` (20). Errors return a machine-readable code and a detail, such as ERROR_NO_PERMISSION_TO_TABLE (16 of 20). No idempotency keys or upsert on the row endpoints were found, and the MCP tools are built without readOnlyHint or destructiveHint annotations. Batch calls of 200 rows reduce the number of writes to retry (5 of 20). Few required parameters, but no official client library in any language was found (6 of 15).", "maintenance": "Release 2.4.0 on 29 September 2026, 9 days before the check (30). Four releases in the last 90 days, 2.3.2, 2.3.3, 2.3.4 and 2.4.0 (20). The community forum shows staff replies within a day or two on recent threads. The GitHub issues page counted 1,199 open issues, and we didn't read reply times there (15 of 25). No official client library, and the only Baserow entry in the official MCP registry is a third party's (0 of 15). The repository has CI and daily backend test workflows and the changelog records dependency upgrades for security fixes. We didn't read the current CI result (7 of 10).", "payments": "Graded on the hosted cloud. No x402, MPP or L402 found (0). Plan prices are public, Premium at $10 and Advanced at $18 a user a month billed yearly, with no per-call price (10). A Free plan with 3,000 rows per workspace. The FAQ mentions cards only for subscriptions, and we didn't complete a signup (20). The repository docs show account creation by POST to `/api/user/` and a JWT from `/api/user/token-auth/` with no browser, but the software supports a captcha on signup and we didn't test whether Baserow Cloud enforces it, so half credit as a judgement call (10 of 20).", "reliability": "Graded on Baserow Cloud's REST API and built-in MCP server, with the hosted lines. Better Stack status page at status.baserow.org with five components and 90 days of history (20). Backend API at 99.981 per cent over 90 days, with 6 minutes down on 1 October 2026, degraded real-time and MCP performance on 8 September and an error on public views on 23 September, all minor (20). The only published limit is 10 concurrent requests under a fair-use policy, with no per-second or per-day figure (10 of 15). The docs ask for retries with exponential backoff, but no Retry-After header or idempotency key is documented and the OpenAPI description has no 429 response for row calls (5 of 15). No SLA found, and the terms describe a best-efforts service (0). The REST API is generally available and the MCP docs carry no beta label (10).", "schema": "Public OpenAPI 3.0.3 description with 312 paths and 424 operations, and every MCP tool has a JSON Schema generated from a typed model (25). llms.txt exists but links to HTML marketing and docs pages, with no Markdown docs found (5 of 10). Endpoint descriptions are long and specific, and MCP tool descriptions say which tool to call first (15 of 20). Parameters are typed, but `filters` is a JSON string, row bodies depend on the table, and MCP rows are untyped objects keyed by field name (8 of 15). Curl examples in the docs and an enum of error codes on each response, 260 distinct codes in all (12 of 15). The description carries the release version and the changelog has Breaking API changes sections, with no API version in the path (12 of 15).", "security": "Database tokens are limited to one workspace, chosen tables and create, read, update or delete, and can be regenerated or deleted, which would earn 30. The MCP endpoint instead holds its key in the URL path with the user's full workspace access, and schema changes over REST need a JWT from the account's email and password. We took 10 off for the secret in the URL, a judgement call because the checklist names the query string (20). Read-only tokens per table on REST. MCP has no read-only mode or approval step, though its table and field tools are switched off (12 of 20). Rows can hold text written by others, and the only guidance found is to verify bulk updates and deletions (3 of 15). Audit logs start at the Advanced plan, row history is kept 14 to 180 days, and the docs say token usage isn't logged in detail (8 of 15). SECURITY.md gives a reporting email, and the FAQ claims SOC 2 Type II and HIPAA. No security.txt, bug bounty or published advisory found (11 of 20).", "transparency": "The core, including the REST API and MCP server, is MIT. Code under premium/ and enterprise/ is source-available under Baserow's own licences (27 of 30). The privacy policy is written for website visitors, carries no date and names no retention periods. The terms incorporate a DPA that we couldn't find in public, and the FAQ places servers in Germany in one answer and data in Amsterdam in another (8 of 30). A deprecations page exists but lists only PostgreSQL versions. Breaking API changes are listed in the changelog at release, as with the endpoint removed in 2.4.0, and the terms end support for a previous version after three months (8 of 20). Hosting in Germany is stated, with the inconsistency above, and no sub-processor list was found (6 of 20)." }, "sources": [ { "what": "MCP server docs", "url": "https://baserow.io/user-docs/mcp-server", "seen": "2026-10-08" }, { "what": "Claude MCP setup", "url": "https://baserow.io/user-docs/claude-mcp", "seen": "2026-10-08" }, { "what": "database API docs", "url": "https://baserow.io/user-docs/database-api", "seen": "2026-10-08" }, { "what": "database tokens", "url": "https://baserow.io/user-docs/personal-api-tokens", "seen": "2026-10-08" }, { "what": "OpenAPI description", "url": "https://api.baserow.io/api/schema.json", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://baserow.io/llms.txt", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://baserow.io/pricing", "seen": "2026-10-08" }, { "what": "FAQ (rate limit, hosting, certifications, payment)", "url": "https://baserow.io/faq", "seen": "2026-10-08" }, { "what": "webhooks", "url": "https://baserow.io/user-docs/webhooks", "seen": "2026-10-08" }, { "what": "audit log", "url": "https://baserow.io/user-docs/admin-panel-audit-logs", "seen": "2026-10-08" }, { "what": "row change history", "url": "https://baserow.io/user-docs/row-change-history", "seen": "2026-10-08" }, { "what": "trust centre", "url": "https://baserow.io/product/security", "seen": "2026-10-08" }, { "what": "terms and conditions", "url": "https://baserow.io/terms-and-conditions", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://baserow.io/privacy-policy", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.baserow.org/", "seen": "2026-10-08" }, { "what": "repository (cloned at commit 0af9be4, 8 October 2026)", "url": "https://github.com/baserow/baserow", "seen": "2026-10-08" }, { "what": "MCP tool definitions in source", "url": "https://github.com/baserow/baserow/tree/develop/backend/src/baserow/contrib/database/mcp", "seen": "2026-10-08" }, { "what": "changelog", "url": "https://github.com/baserow/baserow/blob/develop/changelog.md", "seen": "2026-10-08" }, { "what": "release dates", "url": "https://github.com/baserow/baserow/blob/develop/changelog/releases.json", "seen": "2026-10-08" }, { "what": "licence", "url": "https://github.com/baserow/baserow/blob/develop/LICENSE", "seen": "2026-10-08" }, { "what": "security policy", "url": "https://github.com/baserow/baserow/blob/develop/SECURITY.md", "seen": "2026-10-08" }, { "what": "security advisories", "url": "https://github.com/baserow/baserow/security/advisories", "seen": "2026-10-08" }, { "what": "API deprecations", "url": "https://github.com/baserow/baserow/blob/develop/docs/apis/deprecations.md", "seen": "2026-10-08" }, { "what": "backend API docs (account creation, JWT)", "url": "https://github.com/baserow/baserow/blob/develop/docs/apis/rest-api.md", "seen": "2026-10-08" }, { "what": "configuration (captcha, PostHog)", "url": "https://github.com/baserow/baserow/blob/develop/docs/installation/configuration.md", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=baserow", "seen": "2026-10-08" }, { "what": "community forum, latest topics", "url": "https://community.baserow.io/latest.json", "seen": "2026-10-08" }, { "what": "forum thread on the SSE connector", "url": "https://community.baserow.io/t/mcp-connector-sse-is-depreciated-please-upgrade-to-streamable-http/13025", "seen": "2026-10-08" }, { "what": "PyPI package named baserow", "url": "https://pypi.org/pypi/baserow/json", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://baserow.io/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "RDAP for baserow.io", "url": "https://rdap.identitydigital.services/rdap/domain/baserow.io", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether signup on Baserow Cloud asks for a card, an email confirmation or a captcha. We didn't create an account, and the half credit for onboarding without a browser rests on the repository's API docs", "unchecked: the MCP server's live tool list on Baserow Cloud. The 7 tools come from the docs page and from the source at commit 0af9be4, which may be ahead of the cloud", "unchecked: reply times on GitHub issues and the current CI result. The GitHub API refused us, and the count of 1,199 open issues is read from the issues page", "unchecked: a SOC 2 report or HIPAA attestation. The FAQ states them and no report or auditor was named on the pages read", "No SLA, security.txt, bug bounty, sub-processor list, public DPA text, retention period, Retry-After header, idempotency key or official client library was found in the reviewed pages", "The privacy policy is written for website visitors and has no date. It's recorded in provenance because it is the only one and covers account registration", "The FAQ says servers are in Germany and also that all user data is stored in Amsterdam, Netherlands", "Release 2.4.0 removed `/api/workspaces/{id}/settings/generative-ai/` with notice only in that release's changelog. No deduction was taken because the endpoint is outside the row API and MCP server graded here", "The MCP key travels in the URL path, not the query string the checklist names. The 10-point deduction is a judgement call", "The lead was right on vendor, URL and interface, with one correction. Tokens are limited per workspace and table, not per database" ] }, "negative": 0, "verdict": "Database tokens are limited to chosen tables and to create, read, update or delete, and the REST API has a public OpenAPI description with batch calls of 200 rows. The MCP server authenticates with a key in its URL, runs over SSE only and has no read-only mode. Cloud requests are capped at 10 at a time.", "bestFor": "Teams that want Airtable-style typed tables they can also self-host, with row-level reads and writes by an agent through table-scoped tokens or a small MCP tool set.", "strengths": [ "Database tokens are limited to one workspace, to chosen tables and to create, read, update or delete, and can be regenerated or deleted", "Public OpenAPI 3.0.3 description at api.baserow.io/api/schema.json with 424 operations and an enum of error codes on each response", "The MCP server exposes 7 tools with typed inputs, and its descriptions tell the caller to read the table schema before writing", "List rows takes `include`, `exclude`, `size`, `filters`, `search`, `order_by` and `view_id`, so responses can be sized", "The core, including the REST API and the MCP server, is MIT-licensed and can be self-hosted with no row or request limits" ], "weaknesses": [ "The MCP endpoint's key sits in the URL path, and the docs say it grants full access to modify data in the workspace", "The MCP server speaks only the older SSE transport, with no OAuth, no read-only mode and no tool annotations", "Table and field changes over REST need a JWT obtained with the account's email and password, since database tokens cover rows only", "No SLA, security.txt, sub-processor list or published DPA text was found, and the privacy policy carries no date or retention periods", "No official client library was found, and Baserow isn't in the official MCP registry under its own namespace" ], "agentNotes": [ "Create a database token with only the tables and operations needed. It can't change tables or fields, which need a JWT from `/api/user/token-auth/`", "Send `Authorization: Token YOUR_DATABASE_TOKEN`, and add `user_field_names=true` or rows come back keyed as `field_123`", "Use the `/batch/` endpoints for up to 200 rows a call, and keep to 10 requests in flight on Baserow Cloud", "Treat the MCP URL as a password. Keep it out of logs and version control, and delete the endpoint to revoke it", "Over MCP, call `get_table_schema` before `create_rows` or `update_rows`, and page `list_table_rows` with `page` and `size`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.6 } ], "editorialScores": { "ergonomics": 72, "maintenance": 72, "payments": 40, "reliability": 65, "schema": 77, "security": 54, "transparency": 49 }, "provenanceScore": 80 }, "connect": { "http": "curl \\\n-X GET \\\n-H \"Authorization: Token YOUR_DATABASE_TOKEN\" \\\n\"https://api.baserow.io/api/database/fields/table/TABLE_ID/\"", "config": { "mcpServers": { "Baserow MCP": { "url": "YOUR_MCP_URL_HERE" } } } }, "letme": { "capability": "https://letme.dev/sheets.records", "tool": "https://letme.dev/baserow" }, "notable": [ "The MCP server is built into the product on every plan and lists 7 capabilities, create rows, delete rows, get table schema, list databases, list table rows, list tables and update rows (https://baserow.io/user-docs/mcp-server)", "Each MCP endpoint is a URL of the form https://api.baserow.io/mcp/\u003ckey\u003e/sse, and the docs say to treat it as a password because it grants full access to modify workspace data (https://baserow.io/user-docs/mcp-server)", "Database tokens never expire, are limited to one workspace and to chosen tables, and carry create, read, update and delete permissions set separately (https://baserow.io/user-docs/personal-api-tokens)", "Baserow Cloud allows 10 concurrent API requests under a fair-use policy, and the self-hosted version has no limit (https://baserow.io/user-docs/database-api)", "The OpenAPI description (version 2.4.0) has 312 paths and 424 operations, of which 17 accept a database token (https://api.baserow.io/api/schema.json)", "Release 2.4.0 is dated 29 September 2026, the fourth release in 90 days, and its changelog has a section headed Breaking API changes (https://github.com/baserow/baserow/blob/develop/changelog.md)", "The status page shows 99.981 per cent uptime for the backend API over 90 days, with 6 minutes down on 1 October 2026 and degraded MCP performance on 8 September (https://status.baserow.org/)", "On 5 October 2026 a forum user reported that Claude flags the SSE connector as deprecated, and staff said the report went to the developers (https://community.baserow.io/t/mcp-connector-sse-is-depreciated-please-upgrade-to-streamable-http/13025)" ], "area": "business", "details": [ { "label": "Surfaces graded", "value": "Baserow Cloud's REST API at https://api.baserow.io and the built-in MCP server at https://api.baserow.io/mcp/\u003ckey\u003e/sse. The same code can be self-hosted" }, { "label": "Free tier", "value": "Free cloud plan with 3,000 rows and 2 GB of storage per workspace, and the MCP server included. Self-hosted core is free with no row limit" }, { "label": "Rate limits", "value": "10 concurrent API requests on Baserow Cloud under a fair-use policy, no limit when self-hosted (vendor's figures)" }, { "label": "Batch size", "value": "Up to 200 rows per batch create, update or delete, and 200 rows per list page (default 100)" }, { "label": "Auth and scopes", "value": "Database token (`Authorization: Token`), permanent, one workspace, chosen tables, with create, read, update and delete set separately. JWT (`Authorization: JWT`) from email and password for everything else. MCP by a key in the endpoint URL" }, { "label": "Read and write", "value": "With a database token, rows (list, get, create, update, move, delete, batch), field list, table list and file upload. With a JWT, tables, fields, views, webhooks, snapshots and the rest of the 424 operations" }, { "label": "Filtering", "value": "`filters` (a JSON filter tree), `filter__{field}__{filter}`, `filter_type`, `search`, `order_by`, `include`, `exclude`, `view_id`, `page` and `size` on list rows" }, { "label": "MCP server", "value": "Built in, SSE transport, 7 tools (list_databases, list_tables, get_table_schema, list_table_rows, create_rows, update_rows, delete_rows). Seven more tools for tables and fields are in the source but switched off" }, { "label": "Change events", "value": "Webhooks per table for rows, fields and views created, updated or deleted, with conditional row updates and row-enters-view events. Cloud holds at most 5,000 pending calls per webhook" }, { "label": "Plan gates", "value": "Role-based permissions and audit logs from Advanced. Row change history kept 14 days on Free, 90 on Premium, 180 on Advanced and Enterprise" }, { "label": "SDKs", "value": "No official client library found. The `baserow` package on PyPI is by a third party and dates from 2022" }, { "label": "Deprecations", "value": "A deprecations page that lists only PostgreSQL versions. Breaking API changes are listed in each release's changelog" }, { "label": "Certifications", "value": "The FAQ says SOC 2 Type II, HIPAA and GDPR compliant (vendor's statement). No bug bounty or security.txt found" }, { "label": "SLA", "value": "None found. The terms describe a best-efforts service with no guarantee against interruptions" }, { "label": "Open source", "value": "Yes for the core under MIT, including the REST API and MCP server. The premium and enterprise directories carry their own paid licences" } ], "unitPrices": [ { "item": "Premium (cloud)", "unit": "seat-month", "usd": 10, "note": "billed yearly, $12 billed monthly, 50,000 rows per workspace" }, { "item": "Advanced (cloud)", "unit": "seat-month", "usd": 18, "note": "billed yearly, $22 billed monthly, 250,000 rows per workspace" } ], "provenance": { "legalEntity": "Baserow B.V.", "domain": "baserow.io", "domainRegistered": "2019-01-19", "endpointOnVendorDomain": true, "terms": "https://baserow.io/terms-and-conditions", "privacy": "https://baserow.io/privacy-policy", "statusPage": "https://status.baserow.org", "changelog": "https://github.com/baserow/baserow/blob/develop/changelog.md", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The General Terms and Conditions name Baserow B.V., a Dutch private company with its registered office at Keurenplein 4, Amsterdam, trade register number 81129254. The page carries no date.", "The privacy policy is the only one found. It is written for visitors to baserow.io, mentions account registration, carries no date and names no retention periods. The terms incorporate a Data Processing Agreement by reference, and no public copy was found.", "The REST API and the MCP server answer at api.baserow.io, a baserow.io subdomain. The status page is on a separate domain, status.baserow.org, hosted by Better Stack.", "baserow.io/.well-known/security.txt and api.baserow.io/.well-known/security.txt return 404. SECURITY.md in the repository gives an email address for vulnerability reports.", "RDAP for baserow.io gives a registration date of 2019-01-19." ], "score": 80, "checks": [ { "check": "Legal entity named", "value": "Baserow B.V.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "baserow.io, registered 2019-01-19 (7 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "api.baserow.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 3 of the 7 things a reader expects", "points": 6.6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 5 of the 8 things a reader expects", "points": 7.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.baserow.org", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://baserow.io/terms-and-conditions", "state": "read", "readAt": "2026-10-08", "words": 3487, "points": 6.6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Any dispute shall be submitted exclusively to the courts of Amsterdam.", "says": "Disputes go to the courts of Amsterdam" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "and (b) either party’s cumulative and aggregate liability under the agreement for direct damages exceed the fees (excluding VAT) paid to Baserow by the client under the agreement related to the specific Services in the 12 months preceding the event giving rise to the liability.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "At Baserow’s sole discretion, it can suspend the Services or use of Software if client fails to pay the subscription fees in time." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": false }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "Baserow may use without restriction the designs, algorithms, documentation, works and other information it learns of during the agreement.", "quote": "Baserow is entitled to use and/or exploit without any restriction, the parts, designs, algorithms, documentation, works, protocols, standards and other information that Baserow get knowledge of during the term of the agreement." }, { "date": "2026-10-08", "text": "Baserow states it is never obliged to recover corrupted or lost data.", "quote": "Baserow is never obliged to recover corrupted or lost data." }, { "date": "2026-10-08", "text": "No fees are refunded if the client stops using a subscription before its end date.", "quote": "No fees will be refunded if client stops using its subscription before the end date." } ] }, { "kind": "privacy", "url": "https://baserow.io/privacy-policy", "state": "read", "readAt": "2026-10-08", "words": 1460, "points": 7.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We use the information we collect in various ways, including to:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "CCPA Privacy Rights (Do Not Sell My Personal Information)", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Under the CCPA, among other rights, California consumers have the right to:" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "The policy applies only to visitors to the Baserow website and not to information collected through other channels.", "quote": "This policy is not applicable to any information collected offline or via channels other than this website." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/baserow.json", "live": { "slug": "baserow", "probe": { "target": "https://api.baserow.io", "method": "get", "lastAt": "2026-10-08T19:52:45.792220514Z", "lastOk": true, "lastStatus": 404, "lastMs": 114, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 99, "p95ms24h": 143, "samples24h": 27, "samples30d": 27, "days": [ { "date": "2026-10-08", "probes": 27, "ok": 27 } ] }, "vendorStatus": { "page": "https://status.baserow.org", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:38:16.274385747Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/baserow/baserow/develop/changelog.md", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:24:01.724744684Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2a6db4300826" }, { "url": "https://baserow.io/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:31.424595879Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9e86e4bd4127" }, { "url": "https://baserow.io/terms-and-conditions", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:33.545863734Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1d9e20c33e8e" } ], "updatedAt": "2026-10-08T19:52:45.792220514Z" } } }