Basedash MCP vs Marmot

Basedash MCP 55

Ten tools, grouped by the vendor into ask, build and look up. Their definitions' size couldn't be measured without a session, so 20 of 25 rather than 25. No paging, filters or size controls are documented for list_dashboards or list_charts; ask_question returns tables as CSV files rather than inline rows, and the client can page through the tool list, per the changelog of 14 August 2026 (5 of 20). The troubleshooting section names Forbidden or not-a-member, usage blocked and not-found or archived artifacts with what to do, and ask_question and get_data_sources return typed structured payloads since 5 June 2026 (10 of 20). edit_dashboard is annotated destructive and a failed dashboard or chart build is cleaned up, but no readOnlyHint on the look-up tools or idempotency on the create tools is documented (10 of 20). One or two required inputs per tool and nothing to install; the only official SDK is the React embedding SDK, which isn't for MCP (10 of 15). Total 55.

Marmot 84

Nine tools, six read and three write, with 6,962 characters of descriptions (about 1,700 tokens). There's no read-only subset or toolset switch, and the write tools stay listed for a read-only key and refuse at call time (22 of 25). Limit and offset on every list (default 20, max 100), filters by type, provider, tag and metadata, a summary instead of a list past 20 matches, and a lineage depth of 1 to 10 (20). Tool errors set isError and say what failed, why and which call to try. REST errors are a JSON error string with the status code, and plan limits return a structured limit_exceeded body with the current count and the cap (17 of 20). No readOnlyHint or destructiveHint and no idempotency keys. Writes preview before they apply, and tags already in place are ignored, so a repeat call is safe (10 of 20). Every tool works with empty arguments, and official SDKs exist for Python, TypeScript and Go (15).

Basedash MCP 57

The served tool definitions can be read only in a signed-in MCP session, which this run doesn't open. The docs and feature page list all ten tools with their inputs, which are required or optional, their scopes, what each returns and which one is annotated destructive, and the REST API counterpart has a public OpenAPI 3.1.0 file (50 paths, 91 operations). Judgement call, 10 of 25 for documented inputs without published JSON Schemas. llms.txt and Markdown copies of every docs page are served (10). Each tool's purpose is stated, with when to use MCP over the REST API and get_data_sources described as the call to make before asking; when not to call a build tool isn't stated (12 of 20). Inputs are a free-text question or instructions plus ids, with no enums or constraints documented (5 of 15). Example questions on the feature page and the launch posts, and troubleshooting for Forbidden or not-a-member, usage blocked and not-found errors, but no error payload shapes (10 of 15). A public dated changelog with MCP entries on 5 June, 14 August, 4 and 25 September and 7 and 9 October 2026, and a server.json version (1.1.0), but the registry entry is still 1.0.0 and the llms.txt of 7 October 2026 still describes two tools (10 of 15). Total 57.

Marmot 82

A Swagger 2.0 file for the REST API with 155 operations and API-key and Bearer security definitions, rendered at marmotdata.io/api, and every MCP tool has a typed JSON Schema inferred from Go structs (25). llms.txt and llms-full.txt, with a Markdown copy of every docs page (10). Each tool description has a usecase and an instructions block, says when to use it and points elsewhere when another tool fits ("For what a team OWNS, use find_ownership instead"). The docs page describes only 3 of the 9 tools (16 of 20). Inputs carry types but no property descriptions, enums or bounds. direction, action and owner_type are free strings, depth 1 to 10 is stated only in prose, and metadata_filters.value takes any type (6 of 15). JSON examples in every tool description, errors that say what failed and give example calls, 400, 401, 404 and 500 listed per operation in the spec, and SDK examples in Python, TypeScript and Go (13 of 15). Versioned docs for 0.8 to 0.11 and release notes on GitHub for every tag, but no changelog file and no breaking-change sections (12 of 15).

Basedash MCP 75

Read as a closed hosted service. The changelog's latest entry is 30 October 2026, and the latest MCP-specific entries are 7 and 9 October 2026 (chart placement on a dashboard tab, restyled MCP sign-in pages), all within 30 days (30). Weekly dated changelog entries, with MCP changes on 14 August, 4 and 25 September and 7 and 9 October 2026 (20). Support by email and by Slack on paid plans, with response times not tested (10 of 15). Active in the official MCP registry as com.basedash/mcp under the reverse-DNS namespace for basedash.com, though its description still names two tools (15). No package to judge; the registry entry lags the repository's server.json (0 of 10). Total 75.

Marmot 88

v0.11.1 tagged on 11 October 2026, 22 days before this check, with plugin releases tagged on 1 November (30). Since 4 August the server has tagged v0.11.0-preview1 to preview3 (3 to 10 September), v0.11.0 (23 September) and v0.11.1 (11 October), and the official MCP registry carries 0.11.1 (20). 20 open issues and 3 open pull requests. Recent issues have one to five comments, but we couldn't see who replied or how fast (15 of 25). Listed in the official MCP registry as io.github.marmotdata/marmot, a GitHub-verified namespace, with 0.11.1 published on 11 October 2026. Official SDKs for Python (0.3.0), TypeScript (0.2.0) and Go (15). Dependabot weekly for Go, npm, pip and Actions, and CI on every push. The e2e workflow is disabled (8 of 10).

Basedash MCP 70

Graded with the hosted lines, on the remote server at charts.basedash.com. Instatus status page at status.basedash.com with one component, App, and notices back to April 2021; the MCP server isn't a separate component (20). No notices since 14 March 2026 and 100.0 per cent shown for September, October and November 2026, so the last 90 days are clean (30). No rate limit is published for the MCP server. The public API allows 60 requests a minute by default, per the changelog of 7 August 2026, which we count in part since the MCP surface may differ (5 of 15). The OpenAPI file documents a 429 with RateLimitExceeded and retryAfterMs on all 91 operations and an Idempotency-Key on starting a chat, but nothing is documented for 429s or retries over MCP (5 of 15). No uptime SLA; the about page names priority support SLAs on Enterprise only (0). The server isn't labelled beta or preview and is on both paid plans (10). Total 70.

Marmot 60

We departed from the checklist. Marmot is mostly run self-hosted, and Marmot Cloud now runs it for you, so we scored both halves and took the mean. Self-hosted, on the local checklist. Release archives for Linux and macOS on amd64 and arm64, images on ghcr.io and a Helm chart, but no supported Postgres versions stated (the Compose example uses postgres:16) (15 of 20). The Test workflow runs Go and frontend tests against Postgres 16 on every push to main and the last ten runs passed. The e2e workflow is switched off with if: false (20 of 25). 20 open issues and 3 open pull requests, mostly requests for new functions. Two MRN bugs (#174, #177) have been open since 11 August (20 of 25). Semver tags with preview builds, but the release notes have no breaking-change section, and v0.11.0 dropped marmot plugin push (5 of 15). Version 0.11, pre-1.0 (0). That half comes to 60, per the 1 October check (CI runs and issues not re-read on 2 November, github.com refusing us; v0.11.1 on 11 October is still pre-1.0). Cloud, on the hosted checklist. A status page at status.marmotdata.io with two components, Marmot Cloud and Authentication, and 90-day bars (20). On 20 October 2026 an outage at the cloud provider made the console, sign-in and managed instances unavailable for 5 hours (06:01 to 11:01 UTC, critical impact), one major outage (10). The plans page that gave 10 lookups a second on Team is gone, and the current pricing and Cloud docs give asset limits but no request rates, while the self-hosted limiter's per-endpoint numbers live only in the source (5 of 15). The source answers 429 with Retry-After and RateLimit headers and the Python SDK raises RateLimitError, but the docs give no backoff or retry guidance (5 of 15). The pricing page now names a 99.5 per cent uptime SLA on Team, 99.9 on Scale and 99.95 on Enterprise (10). Cloud's docs moved out of the preview version into the 0.11 docs and the pricing page sells it, so it reads as generally available (10). That half comes to 60. The mean is 60.

Basedash MCP 68

OAuth on Basedash's own authorisation server, with the authorisation code grant and PKCE S256 only, refresh tokens, public clients, dynamic client registration, client ID metadata documents and a revocation endpoint. Three scopes separate asking, reading dashboards and writing them, and the token goes in the header only (30). Building needs mcp:dashboards:write on top of mcp:chat:ask, edit_dashboard is annotated destructive, no tool deletes, and Basedash's AI can change database rows only from the web app with an approval card, per the accuracy page. No server-side confirmation is documented for dashboard edits, and the consent screen on the feature page shows all three scopes together (15 of 20). Answers are drawn from connected company data, which can include text written by outsiders (tickets, CRM records synced by Fivetran), and no prompt-injection guidance was found. Hidden columns and row-level security narrow what reaches the model (5 of 15). The MCP server is a named audit log source, but AI tool calls and queries are recorded on Enterprise only; AI usage per person and feature is shown on every plan (10 of 15). No security.txt on www or charts, and no bug bounty or disclosure policy found. Basedash says it holds SOC 2 Type II, with the report under NDA, and runs third-party penetration tests (8 of 20). Total 68.

Marmot 61

API keys in the X-API-Key header, owned by a person or by a service account with its own roles, up to five per service account, each with an optional expiry and stored as a hash. Bearer tokens from marmot login last 24 hours and can be revoked one by one since v0.11.0, and MCP clients can use OAuth with dynamic client registration. No secret travels in a query string (30). Custom roles allow a view-only key, the MCP endpoint needs assets:view, glossary:view and teams:view, and writes need assets:manage. Writes need a second call with confirm true, but nothing checks that a person saw the preview (15 of 20). Tools return asset descriptions, glossary text and team members' emails from source systems and people, and we found no injection guidance. The two-step writes limit what injected text can change (4 of 15). MCP requests are logged with the caller only at debug level, which is off by default, and the write tools record no actor. Service accounts keep agents apart, and a per-agent audit trail and SIEM export are Enterprise-only on Cloud (4 of 15). A disclosure and research programme with scope and safe harbour at marmotdata.io/security, and GitHub private reporting. It pays in swag, security.txt returns 404, there's no SOC 2 or ISO 27001, and no advisories have been published (8 of 20).