Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Quadratic

REMOTE · MCP.QUADRATICHQ.COM · SCANNED SEP 20

AI access to Quadratic spreadsheets: open files, run Python/SQL, query connected databases.

0 this week 74 Trust /100

Recent critical change

Authorization (6 Aug 2026). See the changelog before you install this server.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security57
Transport & Reachability100
Schema Quality & AI Usability59
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 7848 tokens (~1569/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the Quadratic MCP server?

Quadratic is a hosted endpoint at https://mcp.quadratichq.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.quadratichq.com

# add to Claude Code
claude mcp add --transport http quadratichq-quadratic-mcp 'https://mcp.quadratichq.com/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "quadratichq-quadratic-mcp": {
      "url": "https://mcp.quadratichq.com/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "quadratichq-quadratic-mcp": {
      "type": "http",
      "url": "https://mcp.quadratichq.com/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.quadratichq-quadratic-mcp]
url = "https://mcp.quadratichq.com/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "quadratichq-quadratic-mcp": {
      "type": "remote",
      "url": "https://mcp.quadratichq.com/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add quadratichq-quadratic-mcp --url 'https://mcp.quadratichq.com/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  quadratichq-quadratic-mcp:
    url: "https://mcp.quadratichq.com/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "quadratichq-quadratic-mcp": {
      "Transport": "http",
      "Url": "https://mcp.quadratichq.com/mcp"
    }
  }
}
# add to Vellum
assistant mcp add quadratichq-quadratic-mcp -t streamable-http -u 'https://mcp.quadratichq.com/mcp'
// mcp.json
{
  "mcpServers": {
    "quadratichq-quadratic-mcp": {
      "type": "http",
      "url": "https://mcp.quadratichq.com/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 27 Aug 26 0
    • Tool “write_data” rewrote its description, which is the text the model reads security
  • 26 Aug 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 +1
    • Stability: 0.97 → pass security
  • 23 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Aug 26 0
    • Tool “read_data” rewrote its description, which is the text the model reads security
    • “read_data” reworded the description of “action” cosmetic
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 6 Aug 26 0
    • Authorization: unverified → fail critical
    • New tool “auth”, which the server declares destructive security
    • New tool “files_write”, which the server declares destructive security
    • New tool “write_data”, which the server declares destructive security
    • Schema quality: unverified → fail functional
    • Schema quality: 2478 → 1517 functional
    • Tool coverage: unverified → 100 functional
    • First check of Tool coverage: 100 functional
    • Schema quality: poor → good functional
    • New tool “files_read” functional
    • New tool “read_data” functional
  • 31 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://mcp.quadratichq.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=*.quadratichq.com CN=Amazon RSA 2048 M04,O=Amazon,C=US 30 Nov 2025 29 Dec 2026 RSA 2048 SHA256-RSA b8837a578a1e34114c02cf2b9ffb9be
SANs: *.quadratichq.com
CN=Amazon RSA 2048 M04,O=Amazon,C=US (CA) CN=Amazon Root CA 1,O=Amazon,C=US 23 Aug 2022 23 Aug 2030 RSA 2048 SHA256-RSA 773124f2a952e3ed18a58bdb85d1bc0ce5f27
CN=Amazon Root CA 1,O=Amazon,C=US (CA) CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US 25 May 2015 31 Dec 2037 RSA 2048 SHA256-RSA 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.quadratichq.com. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
quadratichq.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.quadratichq.com/mcp Verified 200
http (plaintext) http://mcp.quadratichq.com/mcp HTTPS enforced
MCP tools · 5 exposed · ~5,370 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
auth ~222

Authenticate the MCP session with Quadratic. Actions: • login() — Start an OAuth device authorization flow. Returns a URL the user must open in a browser to authorize. The flow is completed by confirm_login. • confirm_login(device_code) — Complete an in-progress login by polling for user authorization. If the response indicates the user has not yet authorized, this action can be called again with the same device_code to continue polling. confirm_login is idempotent: if a later tool call reports "Not authenticated on this connection", call confirm_login again with the same device_code to re-establish auth (some clients use a new session per request, so the session that ran the tool may differ from the one that logged in). • set_token(token, email?) — Set a JWT directly (used when the OAuth device flow is not available). • logout() — Clear saved authentication for the current session.

NameTypeReqDescription
actionstringyesAction to perform: login, confirm_login, set_token, or logout
paramsParameters for the action (see tool description)

No output schema declared.

No examples provided.

files_read ~88

Read-only file metadata operations on Quadratic files the user has access to. No data is modified. Requires authentication. Actions: • list_files() — List all accessible files. • get_file_info(file_id) — Get metadata for a single file.

NameTypeReqDescription
actionstringyesAction to perform: list_files or get_file_info
paramsParameters for the action (see tool description)

No output schema declared.

No examples provided.

files_write ~171

File management operations that create or modify state: create a new file, open an existing file to start an editing session, or close a session. Requires authentication. Actions: • open_file(file_id?, file_name?) — Open a file by UUID or name and start an editing session. Returns the file's web URL. • create_file(file_name, team_uuid?) — Create a new blank spreadsheet. If team_uuid is omitted, the user's first team is used. Returns the new file's UUID and web URL; the file must be opened with open_file before it can be edited. • close_file(file_id) — Close an active editing session.

NameTypeReqDescription
actionstringyesAction to perform: open_file, create_file, or close_file
paramsParameters for the action (see tool description)

No output schema declared.

No examples provided.

read_data ~1,513

Read-only queries on the open spreadsheet. No data is modified. Safe to auto-approve. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs reads in parallel; individual failures are reported per-entry without short-circuiting. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference • get_cell_data(selection, page?, sheet_name?) — Returns cell values for a selection in A1 notation. Supports comma-separated ranges to fetch multiple areas in ONE call, including across different sheets. Examples: "A1:B10, D1:E10", "TableName, OtherTable", "'Sheet1'!A1:B10, 'Sheet2'!C1:D10". Table names are globally unique so they work without sheet prefixes. For cell ranges on other sheets use 'SheetName'!Range. Only use when you need the full dataset (aggregations, lookups, analysis). The file summary already includes sample rows. Results may be paginated — use page (0-based) for additional pages. • has_cell_data(selection, sheet_name?) — Check if any cells in a selection have data. Returns true if ANY cell contains data. Use before creating/moving tables or code to avoid spill errors. All ranges MUST be on the same sheet. • get_code_cell_value(code_cell_position?, code_cell_name?, sheet_name?) — Get full code from an existing Python, JavaScript, or connection code cell. Do NOT use for formula cells — formulas are already in get_cell_data results and the file summary. • get_text_formats(selection, page?, sheet_name?) — Get text formatting info. Use table column refe…

NameTypeReqDescription
actionstringyesAction to perform: get_cell_data, has_cell_data, get_code_cell_value, get_text_formats, get_validations, get_conditional_formats, text_search, get_sheet_info, get_spreadsheet_context, read_data, outl…
paramsParameters for the action (see tool description). For batch: {actions: [{action, params}, ...]}

No output schema declared.

No examples provided.

write_data ~3,376

Write operations on the open spreadsheet. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Numbers, booleans, and nulls in cell values are coerced to strings. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs writes sequentially; errors short-circuit the batch. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference Cell Data: • set_cell_values(top_left_position, cell_values, sheet_name?) — Sets cell values as a 2D string array (first row = headers). top_left_position: single cell in A1 notation. Don't place over existing data unless requested. Values replace existing content; use empty string to clear. For merged cells, place at the anchor (top-left) cell. Prefer this over add_data_table for tabular data; only use add_data_table when the user explicitly asks for a data table or the file already uses data tables. When writing tabular data as plain cells, format the header row afterward with set_text_formats (at least bold) so it's visually distinct — plain cells don't auto-style headers like data tables do. Don't use for formulas or code. • delete_cells(selection, sheet_name?) — Delete cell values in a selection (A1 notation). Don't delete cells referenced by code cells unless explicitly asked. To delete table columns: "TableName[Column Name]". To delete tables: "TableName". • move_cells(source_selection_rect, target_top_left_position, sheet_name?) — Move a rectangular block of cells. Target is the top-left corner (single cell). For spilled code cells, move just the anchor cell. • add_data_t…

NameTypeReqDescription
actionstringyesAction to perform: set_cell_values, delete_cells, move_cells, add_data_table, set_code_cell_value, set_formula_cell_value, rerun_code, set_text_formats, set_borders, merge_cells, unmerge_cells, add_s…
paramsParameters for the action (see tool description). For batch: {actions: [{action, params}, ...]}

No output schema declared.

No examples provided.

Common questions

What is the Quadratic MCP server?

Quadratic is an MCP server listed in the public MCP registry as io.github.quadratichq/quadratic-mcp. AI access to Quadratic spreadsheets: open files, run Python/SQL, query connected databases. This page covers its hosted endpoint (https://mcp.quadratichq.com/mcp).

Is the Quadratic MCP server safe to use?

Quadratic scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Quadratic MCP server expose?

Quadratic exposes 5 tools: auth, files_read, files_write, read_data, write_data. Their descriptions and schemas cost roughly 5,370 tokens of context every time the server is loaded.

Does the Quadratic MCP server require authentication?

No. We connected to Quadratic without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Quadratic MCP server still maintained?

Quadratic is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.