← MCP Security Catalog

AITable MCP Server 1.0.3

npm · @apitable/aitable-mcp-server · latest release

Confirmed vulnerable
Security result
6
Observed tools
37
Version rating
100
Change risk

Independent inventory

Observed 2026-08-17T19:16:36.733Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
create_recordCreate a new record in the datasheet. Extract key information from user-provided text based on a predefined Fields JSON Schema and create a new record in the datasheet as a JSON object.
Input schema
{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "The ID of the datasheet where the new record will be created."
    },
    "fields": {
      "type": "object",
      "additionalProperties": {},
      "description": "A JSON object containing non-Attachment type field data. Keys represent field names and values represent field values. Omit unspecified fields in the API request. The structure of field values must conform to the Fields JSON Schema provided by the \"get_fields_schema\" tool."
    },
    "attachments_fields": {
      "type": "object",
      "additionalProperties": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "token": {
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "size": {
              "type": "number"
            },
            "mimeType": {
              "type": "string"
            },
            "height": {
              "type": "number"
            },
            "width": {
              "type": "number"
            },
            "url": {
              "type": "string"
            }
          },
          "required": [
            "token",
            "name",
            "size",
            "mimeType",
            "url"
          ],
          "additionalProperties": false
        }
      },
      "description": "A JSON object containing Attachment type field data. Keys represent field names and values are arrays of attachment objects. The structure of attachment objects must conform to the Fields JSON Schema provided by the \"get_fields_schema\" tool. You need to use the \"upload_file_via_url\" tool to obtain the attachment objects."
    }
  },
  "required": [
    "node_id",
    "fields"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
get_fields_schemaReturns the JSON schema of all fields within the specified database, This schema will be sent to LLM to help the AI understand the expected structure of the data.
Input schema
{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "The ID of the database to fetch records from."
    }
  },
  "required": [
    "node_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
list_recordsRead the records from a specified datasheet with support for pagination, field filtering, and sorting options.
Input schema
{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "The ID of the datasheet to fetch records from."
    },
    "sort": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "field": {
            "type": "string",
            "description": "field name"
          },
          "order": {
            "type": "string",
            "enum": [
              "asc",
              "desc"
            ],
            "description": "Sorting order, must be 'asc' or 'desc'"
          }
        },
        "required": [
          "field",
          "order"
        ],
        "additionalProperties": false
      },
      "description": "Sort the returned records."
    },
    "pageNum": {
      "type": "number",
      "default": 1,
      "description": "Specifies the page number of the page, which is used in conjunction with the pageSize parameter."
    },
    "pageSize": {
      "type": "number",
      "minimum": 1,
      "maximum": 1000,
      "default": 20,
      "description": "How many records are returned per page."
    },
    "fields": {
      "type": "string",
      "description": "The returned record results are limited to the specified fields by name. Multiple fields should be separated by commas without spaces (e.g. 'field1,field2,field3')."
    },
    "viewId": {
      "type": "string",
      "description": "When the viewId is explicitly specified, all records in the specified view will be returned in turn according to the sorting in the specified view."
    },
    "filterByFormula": {
      "type": "string",
      "description": "Filter the records by a formula. The formula should be in the format accepted by AITable, this is useful for filtering records based on specific criteria. e.g. '{field1}=\"value1\"' or 'AND({field1}=\"value1\", {field2}=\"value2\")'."
    }
  },
  "required": [
    "node_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
list_spacesFetches all workspaces that the currently authenticated user has permission to access.
Input schema
{
  "type": "object",
  "properties": {}
}
search_nodesRetrieve nodes based on specific types, permissions, and queries. Nodes in AITable can be of several types: datasheets (also known as sheets, or spreadsheets), form, dashboard, and folders.
Input schema
{
  "type": "object",
  "properties": {
    "space_id": {
      "type": "string",
      "description": "The ID of the workspace to fetch nodes from."
    },
    "node_type": {
      "type": "string",
      "description": "Filter the node list to only include nodes of the specified type. Common types include: \"Datasheet\", \"Form\", \"Automation\", \"Folder\", \"Mirror\""
    },
    "query": {
      "type": "string",
      "description": "A search query to filter nodes by name. If not specified, all nodes will be returned."
    }
  },
  "required": [
    "space_id",
    "node_type"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
upload_attachment_via_urlUpload an attachment to the AITable server using its web URL. Returns storage information that can be passed to create_record or update_record tools to associate with a specific records.
Input schema
{
  "type": "object",
  "properties": {
    "node_id": {
      "type": "string",
      "description": "The ID of the datasheet where the attachment will be attached after upload."
    },
    "attachment_url": {
      "type": "string",
      "description": "The complete web URL of the file to be uploaded."
    },
    "attachment_name": {
      "type": "string",
      "description": "Optional custom name for the attachment after upload."
    }
  },
  "required": [
    "node_id",
    "attachment_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

Compared with initial baseline using full_baseline.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: b583965d66b815d951070b5c0b5af53488f3dc323f8b12adb44bbd22cc49ffba

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.