The server itself exposes 30 tools, and some of them can write to your Cube account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Cube.

How is this different from connecting Cube MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Cube MCP API changes?

We track the Cube MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Cube tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Cube?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Cube MCP server myself?

No. TrustGate connects to the Cube MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Cube directly.

Connect Cube MCP to your AI agents, securely.

One secured endpoint for every Cube call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Cube MCP now

What your agents can ask once Cube MCP is connected.

Select the tools your AI agents can call

30 tools from the Cube MCP schema.

Showing 30 tools

listDeploymentsreadLists every deployment reachable over MCP, already filtered by the admin's deployment-access settings and the user's permissions, with each deployment's agents.
loadQueryResultsreadPaginates through the results of a previous query on the same deployment context.
chathigh riskAsks a question of a Cube agent, optionally targeting a deployment, agent or dev branch. Annotated read-only, but that covers only the MCP call: the agent behind it has the same write-capable tools as Analytics Chat, and its own folder actions run with no confirmation step.
searchDataModelreadSearches the semantic model by similarity to discover queryable views, measures and dimensions, returning compact records to reference in runQuery. A dev branch can be searched instead of the deployed model.
runQueryreadRuns a PostgreSQL-dialect Cube SQL query against the SQL API, returning a schema, a page of rows and pagination counts. It can target a dev branch instead of the deployed model.
readWorkbookreadReads a workbook: its name and its current dashboard draft and published configs.
readReportreadReads one workbook report or standalone exploration by ID, with its title, SQL, chart spec, placement and shareable URL.
createWorkbookwriteCreates a new empty workbook, the container that holds reports and a dashboard. Requires the Explorer role or higher.
createReportwriteSaves a query plus its visualization, either inside a workbook or as a standalone exploration filed in a workspace folder.
updateReporthigh riskEdits an existing report or exploration in place, keeping its reportId. Annotated destructive, so honoring clients always prompt.
deleteReporthigh riskDeletes a workbook report or exploration. Annotated destructive, so honoring clients always prompt.
manageFoldershigh riskLists, creates, renames, moves or deletes workspace folders. Its delete skips the content-permission check the Workspace page applies, which is the one documented permission bypass on this connection.
updateDashboardhigh riskSaves the dashboard layout to the workbook draft, replacing the full widget set. It does not go live.
publishDashboardhigh riskPublishes the current draft to make it live. Idempotent: republishing an unchanged draft is a no-op.
listDataModelFilesreadLists the semantic model source files, raw YAML, JavaScript or Python, on the deploy branch or a dev branch.
readDataModelFilereadReads one model source file's raw source, from the deploy branch or a dev branch.
getDataModelChangesreadShows the diff of the dev branch against its parent, for review before committing.
getBranchDiffreadShows what any branch changed against the deploy branch: the changed-file list with per-file line counts, plus the unified diff.
getDeploymentEnvreadLists the deployment's environment variables with every secret-looking value replaced by ENCRYPTED, so configuration can be verified without exposing values.
startDataModelEditwriteEnters development mode, starts a dev worker and returns the dev branch name that every model write tool requires. It is the only entry point to editing.
writeDataModelFilehigh riskCreates or overwrites a model source file on the dev branch as a whole-file replacement, recompiles the model and reports validity. It rejects any branch that is not a dev branch.
deleteDataModelFilehigh riskDeletes a model source file on the dev branch. It rejects any branch that is not a dev branch.
getBranchStatereadReports the branch this session works on, the branch shown in the Cube UI, the deploy branch, and whether the session's branch has uncommitted edits.
commitToNewBranchwriteCommits the dev branch's edits to a new branch instead of its parent, optionally opening a pull request.
switchUserBranchwriteSwitches the user's own Cube UI over to a branch, the same action as its branch switcher.
commitDataModelChangeshigh riskCommits the dev branch's edits onto the branch it was created from, including the deploy branch, live, when the call sets the publish confirmation flag. It is annotated write rather than destructive, so a client is not guaranteed to prompt first.
mergeToDefaultBranchhigh riskMerges a committed branch into the deploy branch, making it live for everyone. Annotated destructive, and no tool reverts it afterwards.
discardDataModelChangeshigh riskResets the dev branch to its parent or a given commit hash, throwing away pending edits. It resets the dev branch only, so it is not an undo for a merge.
getPreAggregationStatusreadLists the data model's pre-aggregations with their definitions, how many partitions exist and were built, when the newest build landed, and the exact error if one failed.
buildPreAggregationwriteQueues an on-demand build of one pre-aggregation and returns once accepted; the build runs asynchronously. It runs real queries against the data warehouse and writes through the export bucket for external pre-aggregations, so it costs money per build.

What Cube MCP exposes

Cube MCP groups its 30 tools into 6 categories, each with a suggested starting policy.

All 30 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Dashboard Authoring	Reading a workbook with its draft and published dashboard configs, creating workbooks and reports, reading and updating individual reports, deleting reports, managing workspace folders, saving a dashboard layout to the draft and publishing the draft live	Read / Write	Drafts are the safety net: updateDashboard only writes the draft and the live dashboard keeps serving until publishDashboard. Never recreate a report to change it, since a widget points at a specific reportId and replacing it orphans every widget
Data Model Editing	Listing and reading semantic model source files, entering development mode to get a dev branch, writing and deleting model files on that branch, reviewing the pending diff against the parent or any branch against the deploy branch, and listing deployment environment variables	Read / Write	File writes never touch production: startDataModelEdit is the only entry point and the write tools reject any branch that is not a dev branch. getDeploymentEnv redacts anything credential-shaped to ENCRYPTED before it leaves Cube
Commits & Branches	Reporting the session's branch, the UI's branch, the deploy branch and whether edits are uncommitted, committing dev-branch edits onto the parent or a new branch with an optional pull request, merging a committed branch into the deploy branch, discarding pending edits and switching the Cube UI's branch	Read / Write	mergeToDefaultBranch is destructive and prompts, and nothing reverts it afterwards. commitDataModelChanges is the quieter route to production and is not annotated destructive, so gate it on the confirmation flag rather than on the tool name
Deployments & Chat	Listing the deployments and agents reachable over MCP, asking a question of a Cube agent optionally targeting a specific deployment, agent or dev branch, and paginating through a previous query's results	Read / Write	chat's read-only annotation covers the MCP call, not the agent behind it, which holds write-capable tools and whose folder actions run unconfirmed. A conversation is pinned to the branch that answered its first message
Query & Discovery	Searching the semantic model by similarity to find queryable views, measures and dimensions, and running PostgreSQL-dialect SQL against the SQL API with pagination	Read	Read-only and bounded by the user's permissions including row-level security. Call searchDataModel before runQuery with the same branch so the members found are the ones the query will see
Pre-aggregations	Listing the data model's pre-aggregations with partition counts, build times and exact errors, and queuing an on-demand build of one	Read / Write	buildPreAggregation runs real queries against the data warehouse and, for external pre-aggregations, writes through the export bucket, so each build consumes warehouse resources and costs money

Connect Cube MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Cube
Find Cube in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Cube MCP or block it. You allow the exact tools each agent can call, one by one.

Cube MCP	30 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 30 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Cube MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Cube MCP30 documented tools at cubecloud.dev/mcp, one endpoint for every account, deployment and region. OAuth Authorization Code with PKCE, stateless, following the 2026-07-28 spec. Cube annotates nine tools destructive. Which tools a user sees depends on their role: a Viewer never sees the model-editing, commit or pre-aggregation tools at all.
Coding assistants	Connection & credentialsper user	Dashboard Authoring9 tools
Internal copilots	Tool access policiesdeny by default	Data Model Editing8 tools
Workflow automations	Request & response inspectioninline	Commits & Branches6 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools7 tools