SkaleData DocsWhat data leaves your cloud
What an AI client connected through the SkaleData MCP gateway receives, what your organization's MCP data egress setting controls, and what SkaleData records.
When you connect an AI client, such as Claude, to SkaleData, the client calls tools on the SkaleData MCP gateway. Each tool's result goes to the AI client and on to your AI provider, such as Anthropic for Claude. Some results contain data from your databases. This page explains what leaves, what controls it, and what SkaleData keeps.
Read it before you turn on MCP data egress for your organization.
How a tool call travels
- The AI client sends a tool call to the SkaleData MCP gateway at
https://mcp.skaledata.run/mcp, signed in as a person or with an API key. - The gateway checks that your organization's MCP data egress is on. It reads the setting fresh on every call.
- The gateway calls the SkaleData API with the caller's own permissions. For Superset, Airflow, and Airbyte tools, it also calls your app, in your cloud, through the SkaleData data-plane proxy.
- The gateway returns the result to the AI client, which passes it to your AI provider's model as part of the conversation.
SkaleData doesn't store tool results. What your AI provider does with them is governed by your agreement with that provider.
What reaches your AI provider
Everything a tool returns reaches your AI provider. Each result has a size limit, and a tool returns only the fields it needs, but within those limits the result can include the following:
| Tools | What the result can contain |
|---|---|
Cluster, app, deploy, version, and usage tools (skaledata_*) | Names and IDs of clusters and apps, their status, cloud region, versions, outbound IP address, container registry URL, error messages, who started each deploy, app health signals, and plan usage figures. |
| Superset read tools | Names and descriptions of databases, datasets, charts, and dashboards; column names and types; and chart data and previews, which are values from your databases. |
| Superset change tools | IDs and links for the charts, dashboards, and datasets they create or change. |
| Raw SQL tools, if the app allows them | Query results from superset_execute_sql, and SQL Lab links that can contain the SQL. |
| Airflow tools | DAG IDs, descriptions, owners, tags, schedules, and file names; run and task states and timing; run notes; each run's configuration (conf); who triggered each run; DAG import errors with their stack traces; and task logs, which contain anything a task prints. |
| Airbyte tools | Names and IDs of connections, sources, destinations, and workspaces; connector types; schedules; stream names and namespaces, with their sync modes, cursor and primary-key fields, and field counts; job status and timing, rows and bytes synced, and failure messages; links to the Airbyte UI; source and destination settings with secrets removed, such as hosts and usernames; and job logs, which contain anything a connector prints. |
Treat anything a Superset user can see in a chart or a query, anything an Airflow task writes to its log, anything an Airbyte connector writes to its job log, and every Airbyte source and destination setting that SkaleData doesn't remove, as something that can reach your AI provider. How Airbyte settings come back explains which settings SkaleData removes.
What controls the flow
Three settings decide what an AI client can do. A tool call needs every one that applies.
| Setting | Where | Who can change it | Default |
|---|---|---|---|
| Allow MCP data egress | Organization > General > MCP data egress | An org admin, signed in to the console | Off |
| Run the MCP server | A Superset app's Resources tab > MCP server | The operator role or higher in the app's workspace | Off |
| Allow raw SQL tools | A Superset app's Resources tab > MCP server | The operator role or higher, signed in to the console | Off |
MCP data egress is your organization's consent for data to leave for AI clients. While it's off, the gateway refuses every tool call from your organization, for both API keys and people signed in through Claude, and runs nothing. An API key or an AI client can't change it.
Airflow and Airbyte apps have no MCP setting of their own, so you can't turn off their tools for one app. To stop them, turn off MCP data egress, or remove a person's access to the app.
Run the MCP server decides whether an app's Superset tools work at all. Allow raw SQL tools additionally allows the tools that run or save SQL written by the AI client. Without it, the AI client can still read chart data and datasets, but it can't run its own SQL.
When a person signs in through Claude, they also approve the connection on a consent screen. That approval is theirs, for the one organization they choose. It doesn't replace or override the organization's egress setting.
What the audit log records
SkaleData records every tool call that changes something, before the change is made. If SkaleData can't write the record, the change isn't made. Tool calls that only read aren't recorded.
The audited tools are skaledata_deploy_image and these Superset tools: superset_generate_chart, superset_update_chart, superset_generate_dashboard, superset_add_chart_to_existing_dashboard, superset_generate_explore_link, superset_update_chart_preview, superset_execute_sql, superset_save_sql_query, superset_create_virtual_dataset, and superset_register_table. These Airflow tools are audited too: airflow_trigger_dag_run, airflow_clear_task_instances (including dry runs), airflow_pause_dag, and airflow_unpause_dag. So are these Airbyte tools: airbyte_trigger_sync, airbyte_cancel_job, airbyte_clear_streams, airbyte_create_connection, airbyte_update_connection, and airbyte_delete_connection.
Each record holds:
- Who: the API key's ID, or the email address of the person signed in through Claude.
- Where: your organization, and the app's public ID.
- What: the tool's name and a short list of arguments: IDs, true-or-false flags, and sizes. For example, a SQL tool records the database ID and
sql_bytes, the length of the SQL in bytes. An image deploy records the image tag and digest. An Airflow trigger records the DAG ID, the run ID, and how many keys the run configuration has, but not the keys or their values. - Outcome: requested, succeeded, or failed, with a short failure code or message.
- When: when the call was requested and when it finished.
A record never holds query text, query results, chart or dashboard names, table names, chart data, connector settings, or secrets. The one exception is Airbyte stream names, which often match table names in your source: a clear of named streams, and an update that starts or stops syncing streams, record the exact name and namespace of each stream they name. A clear of every stream records only all_streams, not the streams it clears.
Airbyte audit arguments
An Airbyte change records only the arguments in this table, besides the app and cluster. Free text, such as a connection's name, prefix, or cron expression, is never recorded: name_set, prefix_set, and cron_set record only whether one was set.
| Tool | Arguments recorded |
|---|---|
airbyte_trigger_sync | connection_id and job_type |
airbyte_cancel_job | job_id and connection_id |
airbyte_clear_streams | connection_id, all_streams, and, unless it clears every stream, streams: the name and namespace of each stream it clears |
airbyte_create_connection | source_id, destination_id, stream_count (a count: the streams named, or the source's streams when none are named), schedule_type, cron_set, status, name_set, prefix_set, and namespace_definition when set |
airbyte_update_connection | connection_id; fields_changed, the names of the settings it changes; streams_enabled and streams_disabled, the name and namespace of each stream it starts or stops syncing; and status and schedule_type when set |
airbyte_delete_connection | connection_id, source_id, and destination_id |
What SkaleData stores
- Audit records, as described in the previous section.
- Operational logs that name the tool, whether it succeeded, and how long it took, with a short hash of the credential. They don't include tool arguments, SQL, or results.
- Nothing from your databases. The gateway doesn't keep tool results. It holds short-lived credentials in memory for a few minutes at most, and it caches API keys and Claude sign-in tokens only as hashes.
Raw SQL is off by default
Every Superset app starts with Allow raw SQL tools off. With it off, the AI client can't run, save, or link to SQL it writes. Turning it on lets the AI client run any SQL the signed-in person, or the API key's shared identity, can run in Superset, and the results go to your AI provider. Turn it on only for apps where that's acceptable.
Turn off MCP data egress
To stop all AI client access for your organization:
- In the SkaleData console, go to Organization > General.
- In MCP data egress, turn off Allow MCP data egress.
The next tool call from any AI client is refused. Turning it off doesn't ask for confirmation, and you can turn it on again at any time.
To stop access for one Superset app instead, turn off Run the MCP server for that app, and then click Save & Apply.