Safe Kaggle MCP

io.github.parkseokjunePublished by GitHub account parkseokjunev0.4.1Updated Oct 24, 2026

Safety-first Kaggle MCP — confirm-gated destructive ops, submission budget, injection-fenced.

VerifiedSTDIODesktop onlyDeveloper ToolsData & AnalyticsAI & ML

Overview

AI-generated overview

A safety-first Kaggle MCP server that lets an assistant browse competitions, datasets, kernels and models, run EDA, and submit predictions with confirm gates…

What you can do
Connects an assistant to Kaggle for competitions, datasets, kernels (notebooks) and models. Tools cover competition landscape triage, dataset search and preview, compact EDA digests, train/test schema diff with target detection, submission preview and submit, best-score and leaderboard tracking, read-only discussion and write-up digests, kernel push/status/output, dataset versioning, and a session audit log. Irreversible actions such as submit, delete and public publish require a two-call preview then commit confirm token, and Kaggle-returned text is fenced as untrusted content.
When to use it
Use it when you want an assistant to drive a Kaggle workflow in plain language: triaging active competitions, downloading and exploring data, running notebooks on Kaggle compute, submitting predictions within a budget, and tracking scores or leaderboard movement. It suits autonomous loops where destructive steps must stay gated.
Requirements
Runs locally over stdio, installed from PyPI as safe-kaggle-mcp and launched with uvx (Python/uv runtime). Credentials are optional for read-only tools: either KAGGLE_USERNAME with KAGGLE_KEY, or a modern KGAT_ token read from ~/.kaggle/access_token. Network access to the Kaggle API is required. Optional switches: KAGGLE_MCP_ENABLE_DESTRUCTIVE, KAGGLE_MCP_ENABLE_PUBLISH, KAGGLE_MCP_SUBMISSION_CAP.
Before you install
It handles Kaggle credentials (KAGGLE_USERNAME, KAGGLE_KEY, KAGGLE_API_TOKEN); the README says credentials stay out of model context and are redacted. Destructive tools (delete dataset/model) and public publishing are off by default and enabled only via KAGGLE_MCP_ENABLE_DESTRUCTIVE and KAGGLE_MCP_ENABLE_PUBLISH, and each still needs a confirm token. Submissions consume a daily per-competition budget (KAGGLE_MCP_SUBMISSION_CAP, default 5) and are irreversible. Downloaded archives are written…

Installation

In SourceWeft

  1. Open Safe Kaggle MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

kaggle-mcp

[CI] [PyPI] [smithery] [Python] [License: MIT]

A safety-first Model Context Protocol server connecting Claude (Desktop / Code) to Kaggle — competitions, datasets, kernels (notebooks), and models.

safe-kaggle-mcp is the only Kaggle MCP built safety-first. Every irreversible action — submit, delete, public-publish — is gated behind a two-call preview→commit confirm token, a per-competition submission budget surfaced in every response, and off-by-default destructive flags, while all Kaggle-returned text is fenced in <untrusted-content> and your credentials never enter the model context. Other servers chase tool count and the official remote server wins on zero-install convenience — but none of them, official included, gate a single destructive call, cap submissions, or harden against prompt injection. It trades raw breadth for the one thing an autonomous agent with your Kaggle account actually needs: it cannot quietly burn your daily submissions, leak your key, publish your private work, or be hijacked by a poisoned discussion thread.

bash
claude mcp add --transport stdio kaggle -- uvx --from safe-kaggle-mcp kaggle-mcp

How it compares

Featuresafe-kaggle-mcpTypical community serverOfficial remote / Composio
Two-call preview→commit confirm tokens (submit/delete/publish)✅ Yes❌ No (single-shot)❌ No (single-shot)
Per-competition submission budget surfaced to the agent✅ Yes (default 5/day)❌ No❌ No (opaque server quota)
Prompt-injection hardening (<untrusted-content> fencing)✅ Yes❌ No❌ No
Private-by-default + off-by-default destructive/publish flags✅ Yes⚠️ Optional is_private param❌ No
No in-chat authenticate() + 40-hex credential redaction✅ Yes❌ Some leak the key into context⚠️ OAuth keeps key out, no redaction
Zip-slip-safe / sandboxed downloads✅ Yes❌ No❌ Can't sandbox local writes
Callable local EDA tool (compact pandas digest, never raw rows)✅ Yes (dataset + competition)❌ EDA prompt at best❌ No
Competition train/test schema diff + target auto-detect✅ Yes❌ No❌ No
Competition landscape triage (days-left, budget, metric)✅ Yes❌ Thin raw list❌ Raw fields, no digest
Submission best-score digest (metric-aware best/trend/failures)✅ Yes❌ Raw list❌ Raw list
Leaderboard delta tracking (local snapshots + rank moves)✅ Yes❌ No❌ No API endpoint either
Session audit ledger of mutating actions (redacted)✅ Yes❌ No❌ No
Read-only discussion + write-up digest, injection-fenced✅ Yes (untrusted-fenced)⚠️ Yes but unfenced (Galaxy-Dawn)⚠️ Unfenced
One-call competition kickoff (data + EDA + baseline plan)✅ Yes❌ No❌ No
Output discipline (ranked/capped tables, pagination, top-N)✅ Yes❌ Undocumented❌ Client's job
Modern KGAT_ token + legacy username/key auth✅ Both⚠️ Mostly legacy-only✅ OAuth 2.0
InstallLocal stdio (PyPI + git, uvx)Local (pip/uv)✅ Zero-install remote
Raw tool breadth41 tools (no benchmark listing — API exposes none)up to ~51~35–57

The two honest places we don't lead: the official remote server is zero-install, and the broadest community server (Galaxy-Dawn, ~51 tools) has more raw endpoints (e.g. benchmarks). Where they expose ~10 forum tools unfenced, we expose read-only discussion search + read with every body fenced as <untrusted-content> — and no posting tool, because the API has none.

What you can do with it

Drive your whole Kaggle workflow from a Claude chat, in plain language:

Ask Claude…What happens under the hood
"Triage active competitions — prize, metric, days left."kaggle_competition_landscape (one digested, deadline-sorted report)
"Download titanic data, infer the target, and do an EDA."kaggle_eda_competition → train/test schema diff (auto-target) + compact pandas digest
"Find a good Titanic dataset and show me what it looks like."kaggle_search_datasets → kaggle_dataset_preview (capped, untrusted-fenced rows)
"Summarize the iris dataset."kaggle_eda_dataset → shape, dtypes, missingness, target dist, top correlations
"Submit predictions.csv to titanic and tell me the score."kaggle_preview_submission → kaggle_submit_to_competition (token + budget gate) → kaggle_get_submission_score
"Is it worth iterating — what's my best score so far?"kaggle_submission_best_score (metric-aware best/trend/failures + today's budget)
"Did anyone pass me on the leaderboard since last check?"kaggle_leaderboard_track (snapshot deltas, who passed you)
"What techniques are people discussing for this competition?"kaggle_search_discussions → kaggle_get_discussion (read-only, every post untrusted-fenced)
"Find the winning solution write-ups for this competition."kaggle_search_writeups → kaggle_get_discussion
"Kick off this competition for me."kaggle_competition_kickoff — one call: metric + rules + data download + train/test EDA (auto-target) + baseline plan + budget
"What mutating actions have I taken this session?"kaggle_audit_log (redacted ledger of every submit/create/delete)
"Run this notebook on Kaggle's free GPU and get the output."kaggle_push_kernel → kaggle_kernel_status → kaggle_kernel_output
"Save my engineered features as a private dataset version."kaggle_version_dataset — private by default

Higher-order workflows the agent chains itself: an autonomous competition loop (download → train → submit → read score → iterate, within the daily budget), Kaggle as a remote GPU/TPU backend, and cross-run memory via private dataset versions. Every irreversible step is gated, so the agent can run autonomously without risking your account.

What it won't do (honest limits)

Some competitors advertise capabilities the public Kaggle API can't actually deliver. We refuse to ship dishonest stubs:

  • No posting to forums/discussions. The API can read topics but has no create/reply/vote endpoint — so we don't pretend to.
  • No private-leaderboard or final-rank prediction. Private scores are withheld until the deadline; our tools label scores as public-only.
  • No historical leaderboard from Kaggle. There's no such endpoint — kaggle_leaderboard_track diffs against snapshots you captured locally, and says so.
  • No hidden test labels / private splits. We only ever serve files the competition exposes.

Install

bash
# fastest: install + register with Claude Codeclaude mcp add --transport stdio kaggle -- uvx --from safe-kaggle-mcp kaggle-mcp
# or straight from this repo (no PyPI):claude mcp add --transport stdio kaggle -- uvx --from git+https://github.com/parkseokjune/kaggle-mcp kaggle-mcp
# or for developmentuv sync --extra dev && uv run kaggle-mcp

The PyPI distribution is safe-kaggle-mcp (the name kaggle-mcp was taken); the command it installs is still kaggle-mcp, so launch it with uvx --from safe-kaggle-mcp kaggle-mcp.

Get a token at https://www.kaggle.com/settings → API → Create New Token. Both schemes work (resolved in order):

bash
# 1) legacy username/key (env or ~/.kaggle/kaggle.json)export KAGGLE_USERNAME=your_userexport KAGGLE_KEY=your_40_char_key
# 2) current API token (KGAT_...): the client reads it automaticallymkdir -p ~/.kaggle && echo "KGAT_..." > ~/.kaggle/access_token && chmod 600 ~/.kaggle/access_token

Claude Desktop — edit claude_desktop_config.json, then fully restart:

json
{ "mcpServers": { "kaggle": {  "command": "uvx", "args": ["--from", "safe-kaggle-mcp", "kaggle-mcp"],  "env": { "KAGGLE_USERNAME": "your_user", "KAGGLE_KEY": "your_key" } } } }

Safety switches (default OFF → read-only / private posture)

Env varDefaultEffect when 1
KAGGLE_MCP_ENABLE_DESTRUCTIVE0Exposes kaggle_delete_dataset / kaggle_delete_model
KAGGLE_MCP_ENABLE_PUBLISH0Allows creating public datasets
KAGGLE_MCP_SUBMISSION_CAP5Per-competition daily submission budget

Even when enabled, each destructive call still needs a one-time confirm_token from its *_preview_* tool, and is recorded in kaggle_audit_log.

Tools

41 tools across account, competitions, datasets, discussions, kernels, models — plus kaggle:// resources (metadata, leaderboard, rules) and /kaggle-eda, /kaggle-submit-checklist, /kaggle-landscape, /kaggle-solution-research prompts. Run kaggle_status to see your auth + submission budget.

Verified live against the Kaggle API (kaggle 2.2.2) with both auth schemes; 53 offline + 6 live read-only tests pass.

Develop

bash
uv run pytest                              # offline unit + integration testsKAGGLE_LIVE=1 uv run pytest tests/test_live_readonly.py   # live read-only smoke (needs creds)uv run mcp dev src/kaggle_mcp/server.py    # MCP Inspector

License

MIT

Source: README.md at commit 33a5e69

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts