Disclaimer: mcp-server-sigma is an independent open-source community project and is not affiliated with, endorsed by, or supported by Sigma Computing, Inc. "Sigma Computing" is a registered trademark of Sigma Computing, Inc.

Only the latest release receives security fixes. Upgrade to the newest version on Releases or PyPI.

Please do NOT open public issues for security vulnerabilities.

Report security vulnerabilities privately via GitHub Security Advisories.

You will receive an acknowledgement within 5 business days and a status update within 15 business days. If a patch is warranted, we will publish a fix and credit you in the release notes!

This MCP server holds credentials scoped to your entire Sigma organization. Please review the following recommendations before deployment.

SIGMA_CLIENT_ID and SIGMA_CLIENT_SECRET operate at the organization level. We strongly recommend creating a dedicated API Client in Sigma for this server rather than reusing administrator credentials, allowing you to scope permissions and rotate keys independently.

For multi-tenant token exchange, this server signs an HS256 JWT using your client secret as the HMAC key to exchange for tenant-scoped access tokens via Sigma's documented RFC 8693 flow.

• Never commit secrets to git.
• Keep secrets in environment variables or your MCP host's secret manager.
• Client secrets are automatically redacted from error messages and logs by _redact_secrets().

When connecting this server to autonomous agents or public assistant interfaces, run with SIGMA_MCP_READONLY=1:

SIGMA_MCP_READONLY=1 sigma-mcp

This lists only the 90 tools annotated readOnlyHint=True and refuses every other tool at call time, including through the Tool Search call_tool proxy. The gate reads the readOnlyHint annotation and nothing else; a tool without the hint is treated as a write. A refusal is a SafetyViolationError (a FastMCP ToolError), so the client receives a tools/call result with isError: true. SIGMA_MCP_READONLY=1 composes with every profile.

• Single Delete Operations: Require explicit confirm=True on all atomic delete/deactivate endpoints (workspace_delete_workspace, workspace_delete_file, etc.).
• Bulk Destructive Tools: admin_bulk_deactivate_members and admin_bulk_remove_team_members are listed in the full profile but refused at call time (isError: true) unless SIGMA_MCP_ALLOW_BULK_DESTRUCTIVE=1. No job profile lists them.
• Bulk Deactivation Protections: Includes dry_run=True default, confirm=False gate, rejection of catch-all regexes (.*, .+), and a 10-member safety cap.

When using network transport (--transport streamable-http), bind to 127.0.0.1 or place an authenticating HTTPS proxy in front of the listener. When SIGMA_MCP_AUTH_TOKEN is set, every HTTP entry point (sigma-mcp, fastmcp run, http_app()) requires Authorization: Bearer <token>. sigma-mcp refuses to start (exit code 2) an HTTP bind to any host other than 127.0.0.1, ::1 or localhost without a token, unless SIGMA_MCP_ALLOW_UNAUTHENTICATED_BIND=1 accepts it (for example behind a gateway that authenticates for you).

Each release's wheel, sdist and GHCR image carry a GitHub build provenance attestation, created by a separate attest job that holds only contents: read, id-token: write and attestations: write (no PyPI, Release or GHCR credentials). Verify before installing:

gh attestation verify mcp_server_sigma-<version>-py3-none-any.whl --repo christianclaudio/mcp-server-sigma
gh attestation verify oci://ghcr.io/christianclaudio/mcp-server-sigma:<version> --repo christianclaudio/mcp-server-sigma

Job profiles are tool allowlists; any of them can be combined with SIGMA_MCP_READONLY=1. Tool Search and Code Mode attach only on full.