Thoughtspot

[ThoughtSpot]

ThoughtSpot MCP Server
[MCP Server] [Static Badge] [GitHub branch check runs] [Coverage Status] [Discord: ThoughtSpot]

ThoughtSpot Spotter MCP Server provides a set of tools for querying and retrieving relevant data from your ThoughtSpot instance. Spotter connects to your ThoughtSpot instance, handles authentication securely, and returns live answers from your own data.

• ThoughtSpot Spotter MCP Server documentation
• Create a free ThoughtSpot account
• What is ThoughtSpot?
• Get support on Discord
• Privacy statement

Table of Contents

• Manual client registration
  • Associating with a ThoughtSpot instance
• Contributing
  • Local Development

Manual client registration

For MCP hosts which do not(yet) support Dynamic client registration, or they require statically adding Oauth Client Id etc. Go to this page, to register a new client and copy the details over. The most relevant values are Oauth Client Id and Oauth Client Secret which should be added when adding ThoughtSpot as an MCP connector in the MCP client (ChatGPT/Claude etc). The generated client details are only available when they are generated and are NOT available later for reference.

Associate with a ThoughtSpot instance

Manual client registration also allows to associate with a specific ThoughtSpot instance, so that your users do not have to enter the Thoughtspot instance URL when doing the authorization flow. While registering the Oauth client add ThoughtSpot URL to the appropriate value.

Restrict instances per domain

When the Worker serves several custom domains, you can limit which ThoughtSpot instances each domain accepts with the INSTANCE_ALLOWLIST_BY_HOST environment variable. Its value is a JSON object that maps a hostname to its allowed instance URLs:

{"mcp.example.com": ["https://instance-a.thoughtspot.cloud", "https://instance-b.thoughtspot.cloud"]}

On a listed hostname:

• The authorization page shows a dropdown of the allowed instances instead of a free-text field.
• POST /authorize rejects any other instance with a 400.
• MCP requests (/mcp, /sse, /token/*, /bearer/*) for any other instance get a 403.

Hostnames that aren't listed behave as before. If the value is not valid JSON, the server rejects requests with a 500 instead of lifting the restriction.

Contributing

Local Development

1. Install dependencies:
   sh

   npm install

2. Set up environment variables:
   • Copy .dev.vars and fill in your ThoughtSpot instance URL and access token.
   • To test OAuth over plain HTTP on a host other than localhost (for example a hosts-file alias like http://myserver.com:8787), also add OAUTH_ALLOW_INSECURE_DEV_COOKIE=true. Browsers otherwise drop the OAuth binding cookie on such hosts and the flow fails with a 403. Never set this in a deployed environment.
3. Start the development server:
   sh

   npm run dev

Adding New Tools

When adding new MCP tools to the server:

1. Define schemas and tools in src/servers/tool-definitions.ts
2. Implement handlers in src/servers/mcp-server.ts
3. Update version registry in src/servers/version-registry.ts:
   • Add new tools to appropriate version(s) in VERSION_REGISTRY
   • For new stable features, update DEFAULT_VERSION
   • For beta features, add to the beta version entry
4. Add tests for new tools and version configurations
5. Update documentation in README.md

Important: The version registry controls which tools are available in each API version. Make sure to add new tools to the correct version configuration to ensure they're accessible to users.

MCP Server, © ThoughtSpot, Inc. 2026