Superset’s MCP delete tools make agent cleanup possible—but not consequence-free

The missing lifecycle step

Apache Superset has now documented two destructive MCP actions: delete_chart and delete_dashboard. The documentation merged on September 10 says chart deletion accepts an ID or UUID, while dashboard deletion accepts an ID, UUID or slug. Dashboard deletion removes the container but leaves its charts intact. Apache Superset documentation update

That matters because an analytics agent able to create exploratory assets but unable to remove them leaves administrators with a cleanup queue. The underlying implementation, merged in July, explicitly described that lifecycle gap and added both tools to Superset’s MCP server as mutating actions. Implementation pull request

What the guardrails actually do

Both tools delegate deletion to Superset’s existing chart and dashboard command layer rather than reimplementing authorization. The implementation requires the relevant class-level write permission and checks whether the caller is an owner, an administrator or an explicitly granted editor. It also marks each MCP operation as destructive and records attempts through Superset’s event logger. Implementation pull request

The response contract is designed for agent behavior, not just human debugging. A denied request sets permission_denied and tells the caller not to retry; database errors are returned without raw SQL or connection details. Boolean identifiers are rejected because Python could otherwise treat true as integer ID 1, creating a wrong-object deletion risk. Implementation diff

Deletion can also stop on dependencies. Charts or dashboards with attached alerts or reports cannot be removed until those links are cleared. When Superset’s SOFT_DELETE flag is enabled, the object goes to trash and can be restored by an owner or administrator; otherwise deletion is permanent. The response reports which path occurred. Apache Superset documentation update

The deployment playbook

Operators should treat these tools as a separate capability tier from read-only querying or preview generation. The safest rollout is to enable them only for service identities with narrow chart or dashboard edit scopes, turn on soft deletion where available, and alert on the mcp.delete_chart and corresponding dashboard audit events. Those are recommendations derived from the implementation’s permission, reversibility and logging boundaries—not defaults Superset claims to enforce automatically. Implementation pull request

There is one subtle review point: the new documentation says attached alerts and reports are checked before editorship. That ordering may reveal that a protected object has report dependencies before returning a permission denial, so security teams should test what unauthorized callers can infer in their own deployment. This is an operational inference from the documented sequence, not a reported Superset vulnerability. Apache Superset documentation update

The practical takeaway is straightforward: cleanup completes the agent lifecycle, but deletion deserves an explicit enablement decision. Preview-first creation limits bad writes; ownership checks, dependency blocks, soft deletion and audit events limit bad cleanup. None removes the need to scope the identity making the call.