dataframe-detective-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@dataframe-detective-mcpload sales.csv and show me total revenue by region"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
dataframe-detective-mcp
An MCP server that lets any MCP client (Claude Desktop, Claude Code, Cursor, ...) load tabular files, profile them and answer questions with sandboxed pandas code. Extracted from the Mistral Data Detective multi-agent project. The client's own LLM writes the pandas code; the server only validates and executes it.
Tool | What it does |
| Load CSV/TSV/Excel/JSON/Parquet from the allowed root; converts |
| Manage datasets held in memory (max. 20) |
| Schema, ranges, example values, first rows |
| Missing values, duplicates, outliers, correlations, skew, top/bottom categories (via dataframe-autoprofile) |
| Run pandas code in a restricted subprocess (via safe-pandas-exec); answer goes into |
Install & configure
pip install git+https://github.com/Giorgio089/dataframe-detective-mcpClaude Desktop / Claude Code config:
{
"mcpServers": {
"dataframe-detective": {
"command": "dataframe-detective-mcp",
"env": { "DDMCP_ROOT": "/path/to/your/data" }
}
}
}Env var | Default | Meaning |
| current directory | Only files below this directory can be loaded (symlinks are resolved) |
|
| Maximum file size |
Related MCP server: Pandas-MCP Server
Security
Files outside DDMCP_ROOT and unknown file types are refused. Code from query_dataset is validated and run in a
resource-limited subprocess, which is defence in depth and not a hard security boundary; see the security notes in
safe-pandas-exec. Do not point this at
data or clients you do not trust without additional isolation (container, no network).
MIT licensed.
Available Tools
6 toolsdescribe_datasetC
Schema, dtypes, value ranges and first rows of a loaded dataset.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies the target must already be loaded but says nothing about read-only safety, failure modes for an unloaded/unknown name, cost, or whether output is truncated for large datasets. An output schema exists, so return-shape detail is not required, but the operational behavior is undocumented.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, listing the concrete outputs. It is efficient, though the extreme terseness is part of why other dimensions are under-served.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, one undocumented parameter, and a crowded sibling set including profile_dataset, this fragment is not enough to invoke or route correctly. The output schema covers return values, but the description omits the operational and selection context an agent needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never explains the single 'name' parameter. The phrase 'of a loaded dataset' weakly hints that the name identifies an already-loaded dataset, but it does not confirm whether this is the name from load_dataset or list_datasets, nor any format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description enumerates what the tool returns (schema, dtypes, value ranges, first rows), which conveys a descriptive/inspection purpose, but it is a noun phrase with no verb and never distinguishes itself from the sibling profile_dataset, which likely reports similar statistics. An agent cannot tell describe_dataset and profile_dataset apart from the text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives (profile_dataset, query_dataset), and no stated prerequisites beyond the implicit hint in 'loaded dataset'. The agent must infer that load_dataset must run first and cannot tell why it would choose this over profile_dataset.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_datasetsA
List the datasets currently loaded in memory.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. "Currently loaded in memory" is genuine behavioral disclosure — it reveals that results are session state populated by load_dataset, not a catalog of all available data. It stops short of stating whether results are paginated or whether the list is empty when nothing is loaded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the scope qualifier front-loaded and no filler. Every word contributes to identifying the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and with no parameters and no annotations there is little else required. The one omission is any pointer that the listing reflects prior load_dataset calls, though "loaded in memory" gestures at it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a parameterless tool applies. Nothing in the schema is left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (List) plus resource (datasets) with a scoping qualifier ("currently loaded in memory") that distinguishes it from the other dataset tools. It does not, however, explicitly name a sibling or contrast itself with describe_dataset/query_dataset, which an agent might confuse for listing purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the name and the "loaded" qualifier make it fairly obvious this is a session-inventory call, but the description never says when to prefer it over describe_dataset or query_dataset, nor that it should follow load_dataset. For a zero-parameter tool this is a modest gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
load_datasetB
Load a CSV/TSV/Excel/JSON/Parquet file under the allowed root and keep it in memory.
With clean_numbers=True, columns such as "1.234,50 €" or "12%" are converted to numbers. Returns the dataset name and its schema.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| path | Yes | ||
| clean_numbers | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and does disclose real behavior: the file is held in memory, restricted to an allowed root, and clean_numbers alters column types with concrete examples. It omits permissions/auth, size limits, and failure behavior for unsupported or out-of-root paths.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and scope; the clean_numbers example is the only elaboration and it earns its place. No redundant or padded text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The explicit output schema means return values (dataset name and schema) need not be repeated. Still, with no annotations and 0% parameter coverage, the unexplained 'name' parameter and absent failure/permission behavior leave gaps for a load-and-retain-in-memory tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains clean_numbers well with concrete examples ('1.234,50 €', '12%') and scopes path to the allowed root, but 'name' is never mentioned and path's expected format is left unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (load) and resource (CSV/TSV/Excel/JSON/Parquet files) plus a key trait (kept in memory under an allowed root). An agent can distinguish it from unload_dataset, but the description never names or contrasts siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: you must load a dataset before describing/querying/profiling it. There is no explicit when-to-use, when-not-to-use, or named alternative guidance, so the agent has to infer the workflow position.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
profile_datasetC
Rule-based findings: missing values, duplicates, outliers, strong correlations, skew, top/bottom categories.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Rule-based' usefully implies deterministic, non-ML output, but nothing is said about cost, whether the full dataset is scanned, memory limits, or whether the operation is read-only. For a potentially expensive profiling pass this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense fragment with no filler and the substance front-loaded. It is terse to the point of being a list rather than a sentence, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the enumerated findings arguably restate return content rather than adding context. The description therefore covers analysis scope but omits the input (which dataset) and any behavioral or usage context, leaving an agent able to guess the call but not to reason about it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'name' has 0% schema description coverage and the description never references it, not even to say it is the dataset identifier. Unlike the zero-parameter baseline, one undocumented required parameter leaves real ambiguity about what value to supply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description enumerates what the profiling produces (missing values, duplicates, outliers, correlations, skew, category extremes) but never states the action or resource in verb+resource form, and never mentions that it operates on a dataset. It is distinguishable from a generic describe only by inference; no sibling such as describe_dataset is contrasted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all, no statement of when profiling is preferable to describe_dataset or query_dataset, and no prerequisites or exclusions. Usage is only implied by the listed findings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_datasetA
Run pandas code against a dataset in a restricted subprocess.
df, pd and np are preloaded. Do not import anything. Put the answer, as a string, in a variable called result.
Use f-strings (str.format is blocked). Example:
result = df.groupby('channel')['revenue'].sum().sort_values(ascending=False).head(5).to_string()
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| name | Yes | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the sandbox ('restricted subprocess'), the preloaded namespaces, the import ban, the str.format block, and the result-variable contract. It still omits failure behavior (exceptions, timeouts) beyond the schema's default timeout.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded one-line purpose followed by tightly ordered constraints and a concrete example; no filler sentences and every line earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return-format explanation is unnecessary, and the description adequately covers the sandbox contract that an agent needs to write working code. It falls short only on identifying what `name` refers to and how the timeout interacts with execution.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It thoroughly explains `code` (result convention, f-strings, example) but leaves `name` and `timeout_seconds` undocumented — `name` is only loosely implied by 'against a dataset', and the timeout is never mentioned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb+resource ('Run pandas code against a dataset') plus the execution mechanism ('restricted subprocess'), which cleanly separates it from siblings like describe_dataset or profile_dataset that also touch datasets but do not execute user code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives strong operational guidance for the code parameter (preloaded names, no imports, put the answer in `result`), but it never says when to choose this tool over describe_dataset/profile_dataset or when a natural-language alternative is preferable. Usage is implied rather than routed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unload_datasetC
Remove a dataset from memory.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and delivers almost nothing: it does not say whether this frees memory only or also deletes persistent data, what happens if the name is unknown, or whether it is idempotent. 'From memory' is the only behavioral clue.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short, front-loaded sentence with zero filler. It is efficient, though the brevity reflects under-specification rather than disciplined economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. However, for a state-mutating tool with no annotations and an undocumented required parameter, the definition omits critical context: reversibility, error behavior, and what 'name' means.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single parameter 'name' has no description in the schema. The description does not compensate — it never explains what 'name' refers to (loaded dataset handle, path, alias?) or any format or matching rules.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: removing/unloading a dataset from memory. The phrase 'from memory' implicitly contrasts with load_dataset, but the description does not explicitly name that sibling or otherwise route between the two, so it falls short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this versus load_dataset, list_datasets, or the other siblings, and no prerequisites (e.g., must the dataset be loaded first?). The agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
describe_dataset - First observed
list_datasets - First observed
load_dataset - First observed
profile_dataset - First observed
query_dataset - First observed
unload_dataset
TDQS
Scored across 6 tools
Each tool has a fairly distinct role: load/unload/list manage dataset lifecycle, describe vs profile inspect content, and query runs arbitrary code. The main ambiguity is between describe_dataset and profile_dataset, which both summarize a dataset, though the descriptions differentiate schema/stats from rule-based findings.
All tools follow a strict verb_noun snake_case pattern (load_dataset, list_datasets, unload_dataset, describe_dataset, profile_dataset, query_dataset). The naming is predictable and the resource (dataset) is constant across tools.
Six tools is well-scoped for an in-memory dataframe analysis server. Each tool covers a distinct lifecycle or inspection action with no obvious redundancy or bloat.
The surface covers the full load/list/describe/profile/query/unload lifecycle and query_dataset acts as an escape hatch for arbitrary analysis. Minor gaps exist around exporting/saving results or persisting derived datasets, but core workflows are covered.
Maintenance
Related MCP Connectors
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Ask questions about a CSV in plain English and get answers, charts and cleaned data back.
- OleanderOAuthdev.oleander
The all-in-one data stack for agents. Upload files, run SQL, evolve tables, and render charts.
Related MCP Servers
- AlicenseBqualityCmaintenanceLoads CSV files into a temporary SQLite database and provides comprehensive data analysis tools via MCP, enabling AI assistants to query, analyze, and export data using natural language.14MIT
- AlicenseNot gradedqualityDmaintenanceEnables LLMs to safely execute pandas code for data analysis and generate interactive visualizations through MCP protocol.MIT
- AlicenseAqualityCmaintenanceEnables data analysis on CSV/Excel files using pandas. Supports profiling, column interpretation, sandboxed code execution, and interactive chart generation.41MIT
- FlicenseNot gradedqualityDmaintenanceEnables querying CSV or Excel data using natural language through MCP tools, running pandas operations on an uploaded dataset.-