SkaleData DocsConnect Claude chat to SkaleData
Add SkaleData as a custom connector in Claude, sign in as yourself, and let Claude work with your clusters, apps, Superset, Airflow, and Airbyte with your own permissions.
Claude chat can sign in to SkaleData as you. You add SkaleData as a custom connector in Claude, sign in with your SkaleData account, and choose the organization Claude acts in. Claude then works with your clusters, apps, Superset, Airflow, and Airbyte with the same roles and workspace access you have in the SkaleData console.
Claude chat on claude.ai is the supported sign-in client today. To connect another MCP client, such as Claude Code, use an API key instead: see Connect other MCP clients with an API key.
Before you begin
- An org admin has turned on MCP data egress for your organization. While it's off, SkaleData refuses every tool call. Before you turn it on, read What data leaves your cloud.
- You've signed in to the SkaleData console at least once with the account you'll connect, and you're a member of the organization you'll choose.
- For Superset tools, the app runs the MCP server. Someone with the operator role or higher turns on Run the MCP server for the app. See Superset settings for AI clients.
Add the connector
The SkaleData MCP server URL is:
https://mcp.skaledata.run/mcpHow you add it depends on your Claude plan. Claude's own guide, Add a connector that isn't in the directory, has the current steps for each plan.
- Free, Pro, or Max: in Claude, go to Customize > Connectors, click Add custom connector, enter the URL, and then click Add.
- Team or Enterprise: a Claude Owner adds the connector once for the whole Claude organization, in Organization settings > Connectors. Each member then connects with their own SkaleData account from Customize > Connectors.
If Claude asks how to authenticate, choose these settings:
- Authentication: Sign in now or Sign in when needed.
- OAuth client: Use Claude's published identity. Leave the OAuth client ID and secret empty.
- Request headers: none. Don't add an API key to a signed-in connector.
Sign in and choose an organization
- In Claude, click Connect on the SkaleData connector. Claude opens the SkaleData sign-in page.
- Sign in with the account you use for the SkaleData console.
- On the consent screen, choose the SkaleData organization that Claude acts in.
- Approve the permissions the screen asks for. SkaleData needs all of them.
Claude lists the SkaleData tools when the connection works. To check, ask Claude something like "Which SkaleData clusters can I see?"
Your approval on the consent screen lets Claude act as you in that one organization. It doesn't replace your organization's MCP data egress setting: a tool call needs both.
Claude keeps the list of SkaleData tools from when the connector connected. When SkaleData adds tools, Claude doesn't see them until you connect again. To get new tools, disconnect the SkaleData connector in Customize > Connectors, and then connect it again.
Switch to another organization
A connection acts in the one organization you chose when you signed in. To use another organization, disconnect the connector in Claude, connect again, and choose the other organization on the consent screen.
What Claude can do as you
Claude has your permissions, no more:
- Your role and workspace access apply. Claude sees the clusters, apps, and deploys that your role and workspace grants let you see. A change, such as deploying an image, needs the same role it needs in the console.
- Superset runs as you. When Claude uses a Superset tool, SkaleData opens the app as you, so Superset applies your own Superset permissions. Charts, dashboards, and saved queries that Claude creates belong to you, as if you'd made them yourself.
- Airflow runs as you. When Claude uses an Airflow tool, SkaleData opens the app as you, so Airflow applies your Airflow role for that app. Runs that Claude triggers name you as the triggering user. See Airflow tools.
- Airbyte has no roles. Anyone who can open an Airbyte app can use every Airbyte tool, including the ones that delete data. Airbyte records each change as its built-in default user, and SkaleData's audit record names you. See Airbyte tools.
- Saved queries work. Claude can save a SQL query to your Saved Queries list, if the app allows raw SQL tools. API-key connections can't, because they don't act as a person.
- Changes are audited as you. SkaleData records each change that a tool makes with your email address. What the audit log records lists the fields.
Some things a signed-in connector can't do, whatever your role:
- Change organization settings, including MCP data egress.
- Create, list, or revoke API keys.
- Manage members, workspaces, or billing.
- Change an app's MCP or raw SQL settings.
Do these in the SkaleData console.
Superset settings for AI clients
Each Superset app has its own settings, in the app's Resources tab under MCP server. Changes take effect when you click Save & Apply and the app finishes applying.
| Setting | What it does | Default |
|---|---|---|
| Run the MCP server | Lets AI clients connected through SkaleData use this app's Superset tools. | Off |
| Allow raw SQL tools | Also allows the tools that run or save SQL that the AI client writes, such as superset_execute_sql and superset_save_sql_query. Only a person signed in to the console can change it. | Off |
Airflow tools
Airflow tools work only when you sign in through Claude. API keys can't use them, because a key doesn't act as a person with an Airflow role. An Airflow app has no MCP setting to turn on.
| Tool | What it does | Airflow role it needs |
|---|---|---|
airflow_list_dags, airflow_get_dag | Lists DAGs, or gets one DAG, with its schedule, owners, tags, and whether it's paused. | Viewer |
airflow_list_dag_runs, airflow_get_dag_run | Lists a DAG's runs, or gets one run, with its state, timing, and who triggered it. | Viewer |
airflow_list_task_instances, airflow_get_task_log | Lists a run's task instances, and reads a task's log. | Viewer |
airflow_list_import_errors | Lists DAG files that Airflow couldn't import, with their stack traces. | Viewer |
airflow_trigger_dag_run | Triggers a run of a DAG, optionally with run parameters. | User |
airflow_clear_task_instances | Clears a run's task instances so that Airflow runs them again. A dry run lists what it would clear and changes nothing. | User |
airflow_pause_dag, airflow_unpause_dag | Pauses or unpauses a DAG. | User |
An Op or Admin role can do everything that a User role can. Each change tool tells Claude to get your approval before it makes the change.
Your Airflow role comes from the app's User Management tab in the SkaleData console. Org members who aren't listed there get the app's default role for unlisted members. A role change reaches Claude within about six minutes.
If the app's image doesn't support per-user roles, the User Management tab says so. That's the case for an app that runs an external image, or that has identity turned off. Airflow then gives everyone who can open the app the Admin role, so SkaleData limits it:
- Only org admins can open the app, in the console or through Claude. For anyone else, SkaleData refuses the sign-in, and the Airflow tools refuse too.
- For an org admin, Claude can use the read tools, but not the change tools. SkaleData refuses the change tools before anything reaches Airflow. To make a change, use the Airflow UI.
To lift both limits, an org admin switches the app to the SkaleData Airflow image with identity on. After the app is updated, sign-in returns within a few minutes, and the change tools can take up to four more minutes to work again.
Airbyte tools
Airbyte tools work only when you sign in through Claude. API keys can't use them: Airbyte records every change as one built-in user, so SkaleData's audit record is the only record of who made a change, and it must name a person. An Airbyte app has no MCP setting to turn on.
Airbyte has no roles of its own, so anyone who can open the Airbyte app from the SkaleData console can use every tool in this table, including the destructive ones. That includes members with the viewer role in the app's workspace. To limit who can change an Airbyte app through Claude, limit who can open it.
| Tool | What it does | Kind |
|---|---|---|
airbyte_list_connections, airbyte_get_connection | Lists an app's connections, or gets one, with its status, schedule, source, destination, and streams, and a link to it in the Airbyte UI. | Read |
airbyte_list_sources, airbyte_list_destinations | Lists sources or destinations, with their names and connector types. Never returns their settings. | Read |
airbyte_get_source, airbyte_get_destination | Gets one source or destination, with its settings, secrets removed. See Airbyte secrets and settings. | Read |
airbyte_secret_entry_link | Returns a link to Airbyte's own form, where you create a source or destination, or enter its settings and secrets. | Read |
airbyte_list_streams | Lists the streams a source offers, with the sync modes that the source and a destination support together. | Read |
airbyte_list_jobs, airbyte_get_job | Lists a connection's jobs, newest first, or gets one job, with its status, timing, rows and bytes synced, and the failure messages of its newest 10 attempts. | Read |
airbyte_get_job_log | Reads the log of one attempt of a job, up to 24,000 bytes at a time: the end of the log by default, or from a line number. | Read |
airbyte_trigger_sync | Starts a sync of a connection, as Sync now in Airbyte does. For streams with an overwrite sync mode, a sync replaces their data in the destination. | Destructive change |
airbyte_cancel_job | Cancels a running or pending job. | Destructive change |
airbyte_clear_streams | Clears 1 to 20 named streams of a connection, or all of them. Airbyte deletes the data those streams synced to the destination, and the next sync reads them from the start. | Destructive change |
airbyte_create_connection | Creates a connection from an existing source to an existing destination in the same workspace. | Change |
airbyte_update_connection | Changes a connection's name, schedule, status, namespace settings, or schema-change behavior, or starts or stops syncing up to 20 streams. | Destructive change |
airbyte_delete_connection | Deletes a connection. | Destructive change |
Each change tool tells Claude to get your approval before it makes the change. airbyte_list_streams and airbyte_create_connection can take up to 90 seconds, because Airbyte may read the source's streams again first.
Airbyte handles changes in these ways:
- A sync is refused while one runs. If you start a sync while the connection is syncing, Airbyte refuses it with HTTP 409, and nothing changes.
- A new clear, or a delete, cancels a clear in progress. If a clear is still running when you start another clear or delete the connection, Airbyte cancels the running clear.
- Cancel stops the connection's current job. Airbyte cancels whatever job the connection is running when the cancel arrives, not necessarily the job you name. So SkaleData reads the job just before it sends the cancel, and refuses a job that has already finished. If the job finishes in that moment, Airbyte can cancel the connection's next job instead, and the result says that Airbyte didn't confirm the cancel.
- Delete marks the connection deleted. Airbyte sets the connection's status to
deprecatedand stops its syncs. Its source, its destination, and the data already synced stay.airbyte_list_connectionslists a deleted connection only when Claude asks for deleted connections too. - A sync or clear result confirms that the job started, not that it finished. To follow the job, ask Claude to check it with
airbyte_get_job. - New streams sync with
full_refresh_overwriteunless you choose a sync mode. A connection created without a list of streams syncs every stream that Airbyte selects in that mode, which replaces each stream's table in the destination at every sync. The same default applies to a stream thatairbyte_update_connectionstarts syncing. - Some connection settings stay in the Airbyte UI. The tools can't set tags, mappers, or field selection.
airbyte_update_connectionrefuses to change the streams of a connection whose streams have mappers.
Airbyte secrets and settings
Claude can't create a source or destination, or change its settings. The settings Claude reads come back with secrets removed, but job logs don't:
- Enter settings and secrets in the Airbyte UI. No tool accepts settings or secrets. To create a source or destination, or to change its settings, ask Claude for a link:
airbyte_secret_entry_linkreturns one to Airbyte's own form. Don't paste a password, key, or token into the chat. - Open the app from the console first. An Airbyte link opens only while you're signed in to that app in your browser. If Airbyte doesn't open, open the app from the SkaleData console, and then open the link again.
- Settings come back with secrets removed.
airbyte_get_sourceandairbyte_get_destinationreturn settings such as a host or a database name. Each setting that the connector marks secret shows only as{"secret": true}. SkaleData leaves out values that Airbyte masked, and settings whose names containpass,secret,token,key,credential,private,cert,jdbc_url_params,connection_string, ordsn, and names them inwithheld_fields. If SkaleData can't read the connector's spec, or can't check all of it for secrets, the tool returns no settings at all. - Job logs and failure messages aren't checked for secrets.
airbyte_get_job_logandairbyte_get_jobreturn what Airbyte recorded. If a connector prints a secret, such as a password in a connection error, Claude can see it.
How access ends
| What happens | When Claude's access changes |
|---|---|
| An org admin turns off MCP data egress | The next tool call is refused. |
| You're removed from the organization or banned, or your role changes | Within about a minute. After a removal or ban, every request is refused. After a role change, your new role applies. |
| You lose a workspace grant | Within about a minute. |
| You disconnect the connector in Claude, or the sign-in is revoked | Claude stops using the connection. SkaleData can't revoke an access token that's already issued, so a token issued before you disconnected stays valid at SkaleData until it expires, up to one day after it was issued. |
To end one person's access without waiting for their token to expire, remove them from the SkaleData organization. Access ends within about a minute. To stop every AI client in the organization at the next tool call, turn off MCP data egress. That affects everyone in the organization, not just one person.
To disconnect, go to Customize > Connectors in Claude, and then remove or disconnect the SkaleData connector.
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| "MCP data egress is disabled for this organization" | Your organization hasn't allowed data to leave for AI clients. | Ask an org admin to turn on Allow MCP data egress in the SkaleData console, under Organization > General. |
| A generic connector error right after you sign in | SkaleData refused the sign-in, and Claude shows the refusal as a generic error. Usually you haven't signed in to the SkaleData console with this account yet, or you aren't a member of the organization you chose. | Sign in to the SkaleData console once with the same account, check that you're a member of the organization, and then connect again. |
| A generic connector error on a connection that used to work | SkaleData refused the sign-in, and Claude shows the refusal as a generic error. Usually you were removed from the organization. | Ask an org admin whether you're still a member. |
| "SkaleData no longer accepts this sign-in" | Your sign-in is no longer valid, for example after your role changed. | Try again; Claude refreshes the sign-in. If it still fails, disconnect and connect again. |
| "This sign-in doesn't grant SkaleData access" | A permission on the consent screen wasn't approved. | Disconnect, connect again, and approve every permission. |
| Claude can't find a cluster or app you expect | The connection acts in a different organization, or your role and workspace grants don't include it. | Check which organization you chose. To switch, disconnect and connect again. |
| "SkaleData won't open this Superset app as you" | Your role or workspace grants don't allow you to open the app. The message says why. | Ask an admin of the app's workspace for access. |
| "MCP is not enabled on this Superset app" | The app doesn't run the MCP server. | Ask someone with the operator role or higher to turn on Run the MCP server. |
| "Raw SQL is not enabled on this Superset app" | The tool runs or saves SQL, and the app doesn't allow raw SQL tools. | Ask someone with the operator role or higher to turn on Allow raw SQL tools, or open the query in SQL Lab yourself. |
| "Your Airflow role doesn't allow you to …" | Airflow refused the change because of your role for this app. | Ask an org admin to change your role in the app's User Management tab. |
| "SkaleData won't open this Airflow app as you: This app can't enforce workspace roles, so only org admins can open it" | The app runs an external image or has identity turned off, and you aren't an org admin. | Ask an org admin to switch the app to the SkaleData Airflow image with identity on. |
| "Airflow app … doesn't enforce per-user Airflow roles" | The app runs an external image or has identity turned off, so SkaleData refuses the change tools on it. The read tools still work. | Make the change in the Airflow UI, or ask an org admin to switch the app to the SkaleData Airflow image with identity on. |
| "Airflow tools need a person signed in through an AI client such as Claude" | The connection uses an API key. | Connect Claude chat with your SkaleData account, as this page describes. |
| "Airbyte tools need a person signed in through an AI client such as Claude" | The connection uses an API key. | Connect Claude chat with your SkaleData account, as this page describes. |
| "SkaleData won't open this Airbyte app as you" | Your role or workspace grants don't allow you to open the app. The message says why. | Ask an admin of the app's workspace for access. |
| "Airbyte app … refused to start a sync of connection … because it conflicts with the app's current state (HTTP 409)" | The connection is already syncing. | Wait for the running job to finish, or cancel it with airbyte_cancel_job, and then start the sync again. |
| "Airbyte job … has already finished" | The job you asked to cancel has already finished, so SkaleData didn't send the cancel. | Nothing to do. To see the job's status, ask Claude to check it with airbyte_get_job. |
| "Airbyte connection … is already deleted" | The connection you asked to change or delete is already deleted. | Nothing to do. |
| "… isn't a stream of connection …" or "… isn't a stream of source …" | A stream name or namespace doesn't exactly match one the connection or source has. | Ask Claude to check the exact names and namespaces with airbyte_get_connection or airbyte_list_streams. |
| "Connection … has streams with mappers" | The connection's streams have mappers, which the tools can't keep while they change the streams. | Change the connection's streams in the Airbyte UI. |
| "The gateway returns none of this source's settings" or "… this destination's settings" | SkaleData couldn't read the connector's spec, or couldn't check all of it for secrets. | See the settings in the Airbyte UI, through the link in the result. |
| A link from Claude doesn't open the Airbyte page it names | The link opens only while you're signed in to that Airbyte app in your browser. | Open the app from the SkaleData console, and then open the link again. |
| Claude says it has no SkaleData tool that this page lists | Claude keeps the list of tools from when the connector connected, and SkaleData added the tool later. | Disconnect the SkaleData connector in Claude, and then connect it again. |
| "SkaleData sign-in is unavailable. Try again shortly." | SkaleData couldn't check the sign-in. | Try again in a few seconds. |
Workspace API keys
Create an API key that works in one workspace only, for CI and automation that shouldn't reach the rest of your organization.
Connect other MCP clients with an API key
Connect Claude Code or another MCP client to the SkaleData MCP gateway with an org-wide API key, and what changes when the client acts as a key instead of a person.