mcp-server-sigma

📊 mcp-server-sigma

Supercharge your AI Agents with native Sigma Computing superpowers! ⚡

An enterprise-grade Model Context Protocol (MCP) server with 263 tools covering connections, workbooks, data models, members, teams, deployments, webhooks, multi-tenant operations, and composite workflow recipes straight to your favorite AI assistant.

---

⚠️ Disclaimers & Safety Warnings

[!IMPORTANT]

Community Project Disclaimer

mcp-server-sigma is an independent open-source community project. It is not affiliated with, sponsored by, endorsed by, or supported by Sigma Computing, Inc. *"Sigma Computing"* is a trademark of Sigma Computing, Inc.

[!WARNING]

Credentials & Safety Notice

This server uses API credentials scoped to your Sigma organization. Tools can mutate workbooks, users, teams, and data models.

- Read-Only Mode: To run safely without mutation risk, set SIGMA_MCP_READONLY=1 or --profile readonly (lists the 120 tools annotated readOnlyHint=true and refuses every other call).

- Destructive Safety Gates: All single-delete tools require explicit confirm=True; without it they change nothing and return a normal result (isError: false) asking the caller to re-call with confirm=true. Missing or invalid arguments return a tool error (isError: true) the model can correct, and so do other failed calls such as a member not found, an export that times out, or a rejected bulk-deactivate pattern (see docs/errors.md). A batch tool whose every item failed returns isError: true with "type": "batch_failed"; a partial success stays a normal result with "status": "partial_success", a _count, failed_count, results and errors, where each entry has id, status and result or error, alongside the field names each tool returned before; failed items that earlier releases listed in results are still there too (see docs/errors.md). Bulk destructive operations (admin_bulk_deactivate_members, admin_bulk_remove_team_members) are listed in full but refused at call time unless SIGMA_MCP_ALLOW_BULK_DESTRUCTIVE=1.

- Read SECURITY.md before deploying to production.

---

💡 Why This Exists

Sigma Computing has a unique architectural asymmetry that shapes how you automate it:

1. Data Models are 100% Code-Representable: You can programmatically construct data models, define columns, joins, and SQL logic, update JSON specs, and swap warehouse sources via API.
2. Workbook Layouts are primarily UI-driven: While Sigma has introduced Beta endpoints for workbook specifications (/v2/workbooks/spec), programmatically constructing layout elements from scratch remains highly complex.

The canonical path to automated BI dashboards is: Build the layout once in the Sigma UI, save it as a template, then instantiate and source-swap it programmatically forever after! 🎨 ➡️ 🤖

Our composite recipe tools (like workbooks_deploy_template_to_folder and elements_swap_workbook_sources) automate this exact pattern in a single MCP tool call (returning structured step progress or partial failure details if an intermediate step fails):

graph TD

UI["Sigma UI"] -->|"1. Build Layout Once & Save"| TPL["Sigma Template"] Agent["AI Agent / LLM"] -->|"2. Call workbooks_deploy_template_to_folder"| MCP["mcp-server-sigma"] MCP -->|"POST /v2/templates/{id}/instantiate"| API1["Instantiate Workbook"] MCP -->|"POST /v2/workbooks/{id}/swap_sources"| API2["Swap Warehouse Sources"] API2 -->|"Delivered"| Dest["Target Customer Folder"]

---

📦 Quickstart & Installation

1. Install via pip or uv

pip install mcp-server-sigma

or with uv

uv pip install mcp-server-sigma

Or run via Docker

docker run --rm -i --env-file .env \

ghcr.io/christianclaudio/mcp-server-sigma:latest

The image's default command is stdio. To serve Streamable HTTP from the container, bind 0.0.0.0 inside it and pass a token. Keep the token off the command line (it shows up in shell history and ps): put SIGMA_MCP_AUTH_TOKEN in .env, or export it and pass the name alone with -e:

export SIGMA_MCP_AUTH_TOKEN="$(openssl rand -hex 32)"  # or read it from your secret store

docker run --rm -p 8000:8000 --env-file .env \ -e SIGMA_MCP_AUTH_TOKEN \ ghcr.io/christianclaudio/mcp-server-sigma:latest \ --transport streamable-http --host 0.0.0.0 --port 8000 --allowed-host mcp.example.com

2. Set Environment Variables

export SIGMA_CLIENT_ID="your-client-id"

export SIGMA_CLIENT_SECRET="your-client-secret" export SIGMA_API_BASE_URL="https://api.us-a.aws.sigmacomputing.com"

[!TIP]

Use the API base URL assigned to your organization's region.

---

🔌 Integration Guides for AI Assistants & IDEs

mcp-server-sigma works seamlessly with all major AI assistants, IDEs, and CLI tools via standard stdio or streamable-http.

🧡 Claude Desktop & Claude Code

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{

"mcpServers": { "sigma": { "command": "sigma-mcp", "env": { "SIGMA_CLIENT_ID": "your-client-id", "SIGMA_CLIENT_SECRET": "your-client-secret", "SIGMA_API_BASE_URL": "https://api.us-a.aws.sigmacomputing.com" } } } }

For Claude Code CLI:

claude mcp add sigma -- sigma-mcp

♊ Google Antigravity & Gemini CLI

Add to your project's .agents/mcp_config.json (or global ~/.gemini/config/mcp_config.json):

{

"mcpServers": { "sigma": { "command": "sigma-mcp", "args": [], "env": { "SIGMA_CLIENT_ID": "your-client-id", "SIGMA_CLIENT_SECRET": "your-client-secret", "SIGMA_API_BASE_URL": "https://api.us-a.aws.sigmacomputing.com" } } } }

</details>

🤖 OpenAI Codex & Local HTTP Clients

Run in network transport mode (Streamable HTTP) for local CLI & agent extensions:

# Source environment variables from a protected file or secret manager

source .env

Launch server on HTTP localhost port 8000 for local clients

sigma-mcp --transport streamable-http --host 127.0.0.1 --port 8000

Point your local Codex / Streamable HTTP client to http://127.0.0.1:8000/mcp. When SIGMA_MCP_AUTH_TOKEN is set, the client must send Authorization: Bearer ; requests without it, or with a different token, get HTTP 401.

HTTP transports follow the MCP guidance that a local server binds to localhost, and require a bearer token whenever the server is reachable beyond it:

• On 127.0.0.1, ::1 or localhost (the --host default is 127.0.0.1), HTTP runs with or without SIGMA_MCP_AUTH_TOKEN; without it, a warning says requests are not authenticated.
• On any other host (0.0.0.0, ::, a LAN address), the server refuses to start (exit code 2) unless SIGMA_MCP_AUTH_TOKEN is set, or SIGMA_MCP_ALLOW_UNAUTHENTICATED_BIND=1 accepts an unauthenticated bind (logged as a warning), for example behind a gateway that authenticates for you.
• The token is attached when the server is built, so fastmcp run src/sigma_mcp/server.py:mcp --transport http and an ASGI host mounting mcp.http_app() enforce it too. Those entry points do not know the bind host, so they cannot refuse a public bind; use sigma-mcp for that policy.
• In the default (stateful) HTTP mode, a session idle for 30 minutes expires: its next request gets HTTP 404 and the client must start a new session. Change this with FastMCP's session_idle_timeout (on http_app()) or FASTMCP_HTTP_SESSION_IDLE_TIMEOUT (seconds, or none to never expire); see the FastMCP 4.1.0 release and #5229.

*Note for hosted ChatGPT Actions or Custom GPTs:* Hosted cloud services cannot reach localhost. Place an authenticating HTTPS proxy (e.g., ngrok, Cloudflare Tunnel, or Caddy with TLS and Auth) in front of the server before connecting cloud services.

⚡ VS Code (Cline, Roo Code, GitHub Copilot Agent Mode, Continue)

Cline / Roo Code Settings (cline_mcp_settings.json):

{

"mcpServers": { "sigma": { "command": "sigma-mcp", "env": { "SIGMA_CLIENT_ID": "your-client-id", "SIGMA_CLIENT_SECRET": "your-client-secret", "SIGMA_API_BASE_URL": "https://api.us-a.aws.sigmacomputing.com" } } } }

Continue.dev Config (~/.continue/config.yaml):

mcpServers:

• name: sigma command: sigma-mcp env: SIGMA_CLIENT_ID: "your-client-id" SIGMA_CLIENT_SECRET: "your-client-secret" SIGMA_API_BASE_URL: "https://api.us-a.aws.sigmacomputing.com"

</details>

💻 Cursor & Windsurf

Add to ~/.cursor/mcp.json:

{

"mcpServers": { "sigma": { "command": "sigma-mcp", "env": { "SIGMA_CLIENT_ID": "your-client-id", "SIGMA_CLIENT_SECRET": "your-client-secret", "SIGMA_API_BASE_URL": "https://api.us-a.aws.sigmacomputing.com" } } } }

</details>

🐙 GitHub Copilot CLI & Workspace Agent

Add .github/mcp.json to your repository:

{

"mcpServers": { "sigma": { "type": "local", "command": "sigma-mcp", "env": { "SIGMA_CLIENT_ID": "${COPILOT_MCP_SIGMA_CLIENT_ID}", "SIGMA_CLIENT_SECRET": "${COPILOT_MCP_SIGMA_CLIENT_SECRET}", "SIGMA_API_BASE_URL": "https://api.us-a.aws.sigmacomputing.com", "SIGMA_MCP_READONLY": "1" }, "tools": ["workbooks_get_workbook", "workbooks_list_workbooks", "datasets_get_data_model"] } } }

*Note for Copilot Cloud Agents:* Cloud code-review integrations must be configured through Repository Settings > Copilot > MCP