Malloy Publisher MCP
Malloy Publisher serves one data model to agents over MCP and to apps over REST, with queries in Malloy
- 132 ★ on the repository
- Last commit
Extended access
Why this level
- The server reads the connected databases and warehouses and hands query results to agents, so connection rights decide what the agent sees
- Access control relies on a gateway in front of the server and without it nobody tells users apart
Install
- Works in
Manual install
npx @malloy-publisher/server@latest --port 4000Open `http://localhost:4000`: the DuckDB examples run with no credentials.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads the connected databases and warehouses and hands query results to agents, so connection rights decide what the agent sees
- Access control relies on a gateway in front of the server and without it nobody tells users apart
This is third-party code. Review the repository files before installing.
What it does
An analytics server for the Malloy language. You write down what your data means: sources, joins, measures and who may see what. An agent builds the model with the bundled skills, and Publisher serves it over MCP to Claude, Cursor and Codex and over REST to applications and BI tools. Queries are Malloy and run against the model without touching raw tables, so there are no wrong joins or invented columns, and the same question returns the same numbers tomorrow. Modeling, a query engine, materialization, access control and an API ship in one server. DuckDB is built in for CSV, Parquet, JSON and Excel, with connections to BigQuery, Snowflake, Postgres, Databricks and MotherDuck. The `#(authorize)` and `#(access_filter)` annotations decide who sees what, and `#@ persist` materializes an expensive source into a table.
Who it is for. Analysts and developers who want to give agents and BI tools one reviewed data model and drop hand-written SQL.
Good fit when
- An agent writes SQL with wrong joins and you need a model that rules out invented columns
- The same metrics must compute identically in chat, reports and applications
- You need access control: who sees which rows through `#(access_filter)`
- An expensive source should be materialized on a schedule with one `#@ persist` annotation
Not a fit when
- Your data is described only in SQL and dbt and you do not plan to rewrite it in Malloy
- You need a public service with no gateway: access control assumes a microservice behind your gateway
- Node.js 20 cannot be installed: the server refuses to start on older versions
Example request
Connect to Malloy Publisher and show monthly revenue from the storefront model with no hand-written SQLMCP
- Transport
- http
- Authentication
- not required
Environment variables
MCP_PORT- MCP port, 4040 by default
Limitations
- Node.js 20 or newer is required, and the server will not start on older versions. Building from a clone needs Bun 1.3.13 or newer, while the Docker image carries its own runtime.
- Access control assumes a microservice behind your gateway that authenticates users and sets the `givens`: the server does not check users itself.
- The server does not write `.mcp.json` everywhere: in a git working tree, your home directory and a directory that already has one it skips the write and says so in the startup log.
- The first run of the examples fetches packages from GitHub.
- Cursor, VS Code, Codex and Claude Desktop take the MCP address `http://localhost:4040/mcp` in their own configuration.
How to disable. Stop the server process and delete the `.mcp.json` it wrote. For Claude Code run `claude mcp remove malloy -s user`. Packages and models live in your project folder.
FAQ
How do I connect Malloy Publisher to Claude Code?
Start the server and run `claude mcp add --transport http malloy http://127.0.0.1:4040/mcp -s user`. Other clients use the same address.
How can I try it without my own data?
Run `npx @malloy-publisher/server@latest --port 4000` and open `http://localhost:4000`: three examples, `storefront`, `governed-analytics` and `html-data-app`, run on DuckDB with no credentials.
How do I create a package with my own data?
Run `npm create @malloy-publisher/malloy-package@latest sales` and `npm start`. The command writes a package and a small workspace in the current folder.
Which databases are supported?
DuckDB is built in for CSV, Parquet, JSON and Excel. Others connect: BigQuery, Snowflake, Postgres, Databricks, MotherDuck and more.
How do I install the Malloy skills?
Run `npx -y @malloy-publisher/skills@latest install` to copy the skills into the project. They can also be read with no install from the unpkg link.
Discussion
No questions or reviews yet.
Related
MCP serversThe MCP server of the Duckle platform: an agent builds, checks and runs DuckDB ETL pipelines on your machine
DuckDB / MotherDuck MCP Server
DuckDB / MotherDuck Local MCP Server
An MCP server for SQL analytics on DuckDB: local files, in-memory databases, S3-hosted databases and MotherDuck
A text-to-SQL MCP server: an agent asks a database in words, gets SQL plus a trace, and a stated refusal when data is missing.
The Dex plugin: an agent explores a database, builds dbt models and a semantic layer and tracks schema drift under cost control
A temporary DuckDB sandbox: an agent loads a CSV and queries the data over MCP or REST without touching the production database
The Byaan MCP server lets Claude Code and Cursor put questions to your databases and returns queries with read-only results.
README in short
The README explains that one server replaces five projects: modeling, query engine, materialization, access control and API. Requirements, running the examples, creating your own package and connecting agents over MCP follow.