Quadratic
REMOTE · MCP.QUADRATICHQ.COM
AI access to Quadratic spreadsheets: open files, run Python/SQL, query connected databases.
Available components
Last scanned (23 hours ago)
Scores higher than 60% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Data and Analytics
Recent critical change
Authorization (6 Aug 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (auth). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability55
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 12104 tokens (~1344/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- New tool “doc_write”, which the server declares destructive security
- New tool “slide_write”, which the server declares destructive security
- Tool “files_read” rewrote its description, which is the text the model reads security
- Tool “files_write” rewrote its description, which is the text the model reads security
- Schema quality: 1625 → 1344 ▲ functional
- New tool “doc_read” functional
- New tool “slide_read” functional
- 27 Oct 26 −1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “files_write” rewrote its description, which is the text the model reads security
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Aug 26 0
- Tool “write_data” rewrote its description, which is the text the model reads security
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 13 Aug 26 0
- Tool “read_data” rewrote its description, which is the text the model reads security
- “read_data” reworded the description of “action” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://mcp.quadratichq.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.quadratichq.com | CN=Amazon RSA 2048 M04,O=Amazon,C=US | 31 Oct 2026 | 16 May 2027 | RSA 2048 | SHA256-RSA | 8cf3aba2b15bd465c62373a59cbd2bf |
| SANs: *.quadratichq.com | ||||||
| CN=Amazon RSA 2048 M04,O=Amazon,C=US (CA) | CN=Amazon Root CA 1,O=Amazon,C=US | 23 Aug 2022 | 23 Aug 2030 | RSA 2048 | SHA256-RSA | 773124f2a952e3ed18a58bdb85d1bc0ce5f27 |
| CN=Amazon Root CA 1,O=Amazon,C=US (CA) | CN=Starfield Services Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US | 25 May 2015 | 31 Dec 2037 | RSA 2048 | SHA256-RSA | 67f944a2a27cdf3fac2ae2b01f908eeb9c4c6 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.quadratichq.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| quadratichq.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.quadratichq.com/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.quadratichq.com/mcp | HTTPS enforced |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
auth ~222
Authenticate the MCP session with Quadratic. Actions: • login() — Start an OAuth device authorization flow. Returns a URL the user must open in a browser to authorize. The flow is completed by confirm_login. • confirm_login(device_code) — Complete an in-progress login by polling for user authorization. If the response indicates the user has not yet authorized, this action can be called again with the same device_code to continue polling. confirm_login is idempotent: if a later tool call reports "Not authenticated on this connection", call confirm_login again with the same device_code to re-establish auth (some clients use a new session per request, so the session that ran the tool may differ from the one that logged in). • set_token(token, email?) — Set a JWT directly (used when the OAuth device flow is not available). • logout() — Clear saved authentication for the current session.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: login, confirm_login, set_token, or logout |
| params | – | – | Parameters for the action (see tool description) |
No output schema declared.
No examples provided.
doc_read ~283
Read-only queries on the open document (a file whose kind is DOC). No data is modified. Safe to auto-approve. Open the document first with files_write(open_file). Call as {"action": "<name>", "params": {...}}. Blocks are named by a path "<section>.<block>" (e.g. "0.3") and carry a hash; doc_write needs the hash to change or delete a block. Actions: • doc_outline() — Headings with their paths and hashes, plus block count, word count and block types. Start here for long documents. • read_doc(format?, from?, limit?) — Blocks in order, each {path, hash, type, content}. format: "markdown" (default) or "json" (ProseMirror JSON). Paginate with from (default 0) and limit (default 200, max 1000); next_from is null on the last page. • search_doc(query, limit?, case_sensitive?, whole_word?, regex?) — Text matches, each with the block's path and hash and a snippet. • context() — The full guide to documents: block model, Markdown support, placeholders, batches.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: read_doc, doc_outline, or search_doc |
| params | – | – | Parameters for the action (see tool description) |
No output schema declared.
No examples provided.
doc_write ~429
Edits to the open document (a file whose kind is DOC). Edits apply live for anyone viewing the document. Requires edit access. Call as {"action": "<name>", "params": {...}}. Read the document first (doc_read): paths shift as blocks are added or removed, and replace_blocks / delete_blocks must pass each block's hash from that read — if a block changed since, the edit is refused and nothing changes. Every edit returns the paths and hashes of the blocks it wrote, and saved: false if it hadn't been confirmed yet (it is still applied). content is Markdown by default (headings, emphasis, links, lists, quotes, code, tables, images, ---), or ProseMirror JSON with format: "json". Keep any <qd-node .../> placeholders from read_doc when writing content back; they stand for footnotes, comments and other content Markdown can't express. Actions: • append(content, format?) — Add blocks at the end. • insert_blocks(position, path?, hash?, content, format?) — position: "start", "end", "before" or "after"; before/after need the anchor block's path. • replace_blocks(blocks, content, format?) — Replace consecutive blocks in one section; blocks: [{path, hash}, ...]. • delete_blocks(blocks) — Delete consecutive blocks in one section; blocks: [{path, hash}, ...]. • find_replace(find, replace, case_sensitive?, whole_word?, regex?) — Replace text throughout; replacements keep the formatting of the text they replace. • batch(operations) — Up to 100 edits as one all-or-nothing change: {"operations": [{"action": "<name>", "params": {...}}, ...]}. Paths in later operations refer to the document as earlier ones left it.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: insert_blocks, replace_blocks, delete_blocks, find_replace, append, or batch |
| params | – | – | Parameters for the action (see tool description). For batch: {operations: [{action, params}, ...]} |
No output schema declared.
No examples provided.
files_read ~162
Read-only file metadata operations on Quadratic files the user has access to. No data is modified. Requires authentication. Files are spreadsheets (kind GRID, edited with read_data / write_data), documents (kind DOC, edited with doc_read / doc_write) or presentations (kind SLIDE, edited with slide_read / slide_write). Actions: • list_files(kinds?) — List accessible files with their kind. kinds: ["GRID"], ["DOC"] or ["SLIDE"] limits the list to those kinds. • get_file_info(file_id) — Get metadata for a single file, including its kind and web URL.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: list_files or get_file_info |
| params | – | – | Parameters for the action (see tool description) |
No output schema declared.
No examples provided.
files_write ~263
File management operations that create or modify state: create a new file, open an existing file to start an editing session, or close a session. Requires authentication. Actions: • open_file(file_id?, file_name?) — Open a spreadsheet, document or presentation by UUID or name and start an editing session. Returns the file's kind and web URL. Use read_data / write_data on a spreadsheet, doc_read / doc_write on a document and slide_read / slide_write on a presentation. The open is remembered for your user across MCP sessions (last open wins) — clients that use a new session per request do not need to re-open after auth(confirm_login). • create_file(file_name, team_uuid?, kind?) — Create a new blank spreadsheet (kind "GRID", the default), document (kind "DOC") or presentation (kind "SLIDE"). If team_uuid is omitted, the user's first team is used. Returns the new file's UUID and web URL; the file must be opened with open_file before it can be edited. • close_file(file_id) — Close an active editing session.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: open_file, create_file, or close_file |
| params | – | – | Parameters for the action (see tool description) |
No output schema declared.
No examples provided.
read_data ~1,513
Read-only queries on the open spreadsheet. No data is modified. Safe to auto-approve. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs reads in parallel; individual failures are reported per-entry without short-circuiting. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference • get_cell_data(selection, page?, sheet_name?) — Returns cell values for a selection in A1 notation. Supports comma-separated ranges to fetch multiple areas in ONE call, including across different sheets. Examples: "A1:B10, D1:E10", "TableName, OtherTable", "'Sheet1'!A1:B10, 'Sheet2'!C1:D10". Table names are globally unique so they work without sheet prefixes. For cell ranges on other sheets use 'SheetName'!Range. Only use when you need the full dataset (aggregations, lookups, analysis). The file summary already includes sample rows. Results may be paginated — use page (0-based) for additional pages. • has_cell_data(selection, sheet_name?) — Check if any cells in a selection have data. Returns true if ANY cell contains data. Use before creating/moving tables or code to avoid spill errors. All ranges MUST be on the same sheet. • get_code_cell_value(code_cell_position?, code_cell_name?, sheet_name?) — Get full code from an existing Python, JavaScript, or connection code cell. Do NOT use for formula cells — formulas are already in get_cell_data results and the file summary. • get_text_formats(selection, page?, sheet_name?) — Get text formatting info. Use table column refe…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: get_cell_data, has_cell_data, get_code_cell_value, get_text_formats, get_validations, get_conditional_formats, text_search, get_sheet_info, get_spreadsheet_context, read_data, outl… |
| params | – | – | Parameters for the action (see tool description). For batch: {actions: [{action, params}, ...]} |
No output schema declared.
No examples provided.
slide_read ~416
Read-only queries on the open presentation (a file whose kind is SLIDE). No data is modified. Safe to auto-approve. Open the presentation first with files_write(open_file). Call as {"action": "<name>", "params": {...}}. Slides and shapes have stable ids; slide_write addresses edits by them. Shape positions and sizes (xfrm: x, y, cx, cy, rot) are in EMU (914400 per inch, 12700 per point) unless units is "in" or "pt". Actions: • deck_outline() — Every slide's id, index, layout, title, shape count, whether it has notes and open comments, plus slide size, footer, comment count and available layouts. Start here. • read_deck(format?, units?, from?, limit?, slide_ids?) — Slides with their shapes (type sp / pic / cxnSp / tbl, xfrm, placeholder, geometry, text, fill, line, table style/column widths/row heights/cells), notes and comments, plus the theme (colors and fonts) and footer. format: "markdown" (default) or "json" (ProseMirror JSON). Paginate with from (default 0) and limit (default 50, max 500), or pass slide_ids; next_from is null on the last page. • search_deck(query, limit?, case_sensitive?, whole_word?, regex?) — Text matches across shapes, table cells and notes, each with slide id, shape id and a snippet. • read_comments(slide_id?, include_resolved?) — Comment threads (author, text, replies, resolved, anchor shape) for the deck or one slide. • context() — The full guide to presentations: slides, shapes, units, layouts, Markdown text, batches.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: read_deck, deck_outline, search_deck, or read_comments |
| params | – | – | Parameters for the action (see tool description) |
No output schema declared.
No examples provided.
slide_write ~1,471
Edits to the open presentation (a file whose kind is SLIDE). Edits apply live for anyone viewing the presentation. Requires edit access. Call as {"action": "<name>", "params": {...}}. Read the presentation first (slide_read deck_outline or read_deck) to get slide and shape ids. Every edit returns what it wrote (new ids, placeholder shapes, z-order) and saved: false if it hadn't been confirmed yet (it is still applied). Text content is Markdown by default (paragraphs, - bullets with two-space nesting, 1. numbering, **bold**, *italic*, ~~strike~~, <u>, <sup>, <sub>, links), or ProseMirror JSON with format: "json". Lengths are EMU unless units is "in" or "pt". Layouts: title, obj (Title and Content, the default), secHead, twoObj, twoTxTwoObj, titleOnly, blank, objTx, picTx — names or labels. Actions: • add_slide(layout?, after_slide_id?, index?, title?, body?, notes?, format?) — Add a slide and fill its title/body placeholders. Returns the slide id and its shapes. • delete_slides(slide_ids) / duplicate_slides(slide_ids) / move_slide(slide_id, index). • update_slide(slide_id, layout?, background?, transition?, hidden?, notes?, format?) — null clears background or transition; a new layout keeps placeholder text. reset_slide(slide_id) — Put placeholders back where the layout has them (PowerPoint's Reset). • set_text(slide_id, shape_id? | placeholder?, cell?, content, format?) — Replace a shape's text; placeholder is "title", "subtitle" or "body"; cell: {row, col} for a table. • format_text(slide_id, shape_id? | placeholder?, cell?, paragraphs?, match?, case_sensitive?, whole_word?, regex?, style) — Format text in place without retyping it. style: {bold?, italic?, underline?, strike?, superscript?, subscript?, font_family?, font_size_pt?, color?, highlight?, caps: "all" | "small"?, letter_spacing_pt?, link?, align: "left" | "center" | "right" | "justify"?, line_height?, space_before_pt?, space_after_pt?, indent_pt?, list: "none" | "bullet" | "number"?}; null clears a p…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add_slide, delete_slides, move_slide, duplicate_slides, update_slide, reset_slide, set_text, format_text, add_shape, update_shape, delete_shapes, duplicate_shapes, reorder_shapes,… |
| params | – | – | Parameters for the action (see tool description). For batch: {operations: [{action, params}, ...]} |
No output schema declared.
No examples provided.
write_data ~3,376
Write operations on the open spreadsheet. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Numbers, booleans, and nulls in cell values are coerced to strings. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs writes sequentially; errors short-circuit the batch. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference Cell Data: • set_cell_values(top_left_position, cell_values, sheet_name?) — Sets cell values as a 2D string array (first row = headers). top_left_position: single cell in A1 notation. Don't place over existing data unless requested. Values replace existing content; use empty string to clear. For merged cells, place at the anchor (top-left) cell. Prefer this over add_data_table for tabular data; only use add_data_table when the user explicitly asks for a data table or the file already uses data tables. When writing tabular data as plain cells, format the header row afterward with set_text_formats (at least bold) so it's visually distinct — plain cells don't auto-style headers like data tables do. Don't use for formulas or code. • delete_cells(selection, sheet_name?) — Delete cell values in a selection (A1 notation). Don't delete cells referenced by code cells unless explicitly asked. To delete table columns: "TableName[Column Name]". To delete tables: "TableName". • move_cells(source_selection_rect, target_top_left_position, sheet_name?) — Move a rectangular block of cells. Target is the top-left corner (single cell). For spilled code cells, move just the anchor cell. • add_data_t…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: set_cell_values, delete_cells, move_cells, add_data_table, set_code_cell_value, set_formula_cell_value, rerun_code, set_text_formats, set_borders, merge_cells, unmerge_cells, add_s… |
| params | – | – | Parameters for the action (see tool description). For batch: {actions: [{action, params}, ...]} |
No output schema declared.
No examples provided.
How do I install the Quadratic MCP server?
Quadratic is a hosted endpoint at https://mcp.quadratichq.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.quadratichq.com
claude mcp add --transport http quadratichq-quadratic-mcp 'https://mcp.quadratichq.com/mcp'
What is the Quadratic MCP server?
Quadratic is an MCP server listed in the public MCP registry as io.github.quadratichq/quadratic-mcp. AI access to Quadratic spreadsheets: open files, run Python/SQL, query connected databases. This page covers its hosted endpoint (https://mcp.quadratichq.com/mcp).
Is the Quadratic MCP server safe to use?
Quadratic scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Quadratic MCP server expose?
Quadratic exposes 9 tools: auth, doc_read, doc_write, files_read, files_write, and 4 more. Their descriptions and schemas cost roughly 8,135 tokens of context every time the server is loaded.
Does the Quadratic MCP server require authentication?
No. We connected to Quadratic without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Quadratic MCP server still maintained?
Quadratic is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.