Superset’s MCP theme tools turn BI styling into an agent security boundary

Apache Superset has documented three MCP tools for reusable dashboard themes: list_themes, get_theme_info, and create_theme. The change is small—eight lines in the user guide—but it exposes a useful operating rule for analytics agents: presentation configuration is still executable input and should be governed like any other write path.

What changed

The September 7 documentation commit adds a Themes section to Superset’s AI/MCP tool reference. Agents can discover themes, inspect their Ant Design token configuration by numeric ID or UUID, and create a reusable theme when the caller has write access.

This is documentation catching up with code rather than a new production release. The documentation pull request says the tools were originally added in pull request 41497, merged July 10. The live page is also explicitly labeled “Next” and “unreleased,” so operators should verify the tools against the version they actually deploy instead of treating the page date as a GA announcement.

The important boundary is not cosmetic

The original implementation pull request describes theme data as user-controlled input. create_theme accepts either a JSON object or JSON string, then uses the same sanitization and validation routine as Superset’s REST API before persistence. The implementation says that routine checks structure, sanitizes tokens against XSS, and validates font URLs. A failed validation writes no row, while successful user-created themes are stored as non-system themes.

There is a second boundary on the read path. Superset wraps both the theme name and the stored JSON data before returning them to an LLM context. That matters because an agent inspecting an existing theme is reading strings supplied by another user; a token value or theme name can be hostile input even if it is valid presentation data.

A deployment checklist

Teams exposing these tools should split the workflow into two capabilities:

• Allow list_themes and get_theme_info for discovery and migration planning.
• Grant create_theme only to identities that are expected to change shared presentation assets.
• Keep a human review step before a generated theme becomes the default or is applied broadly.
• Test malicious names, font URLs, SVG-like values, malformed JSON, and embedded instruction text at the MCP boundary.
• Confirm the deployed Superset build actually contains the tools; the current guide describes the unreleased Next branch.

The broader lesson is that an analytics agent’s write surface extends beyond SQL and dashboards. Shared themes can alter every report that references them, while their free-form fields can flow back into model context. Superset’s split between read-only discovery, write-gated creation, validation, and LLM-context wrapping is the right shape—even for something that looks like styling.