Feature

safe-kaggle-mcp

Typical community server

Official remote / Composio

Two-call preview→commit confirm tokens (submit/delete/publish)

✅ Yes

❌ No (single-shot)

❌ No (single-shot)

Per-competition submission budget surfaced to the agent

✅ Yes (default 5/day)

❌ No

❌ No (opaque server quota)

Prompt-injection hardening (<untrusted-content> fencing)

✅ Yes

❌ No

❌ No

Private-by-default + off-by-default destructive/publish flags

✅ Yes

⚠️ Optional is_private param

❌ No

No in-chat authenticate() + 40-hex credential redaction

✅ Yes

❌ Some leak the key into context

⚠️ OAuth keeps key out, no redaction

Zip-slip-safe / sandboxed downloads

✅ Yes

❌ No

❌ Can't sandbox local writes

Callable local EDA tool (compact pandas digest, never raw rows)

✅ Yes (dataset + competition)

❌ EDA prompt at best

❌ No

Competition train/test schema diff + target auto-detect

✅ Yes

❌ No

❌ No

Competition landscape triage (days-left, budget, metric)

✅ Yes

❌ Thin raw list

❌ Raw fields, no digest

Submission best-score digest (metric-aware best/trend/failures)

✅ Yes

❌ Raw list

❌ Raw list

Leaderboard delta tracking (local snapshots + rank moves)

✅ Yes

❌ No

❌ No API endpoint either

Session audit ledger of mutating actions (redacted)

✅ Yes

❌ No

❌ No

Read-only discussion + write-up digest, injection-fenced

✅ Yes (untrusted-fenced)

⚠️ Yes but unfenced (Galaxy-Dawn)

⚠️ Unfenced

One-call competition kickoff (data + EDA + baseline plan)

✅ Yes

❌ No

❌ No

Output discipline (ranked/capped tables, pagination, top-N)

✅ Yes

❌ Undocumented

❌ Client's job

Modern KGAT_ token + legacy username/key auth

✅ Both

⚠️ Mostly legacy-only

✅ OAuth 2.0

Install

Local stdio (PyPI + git, uvx)

Local (pip/uv)

✅ Zero-install remote

Raw tool breadth

41 tools (no benchmark listing — API exposes none)

up to ~51

~35–57

Ask Claude…

What happens under the hood

"Triage active competitions — prize, metric, days left."

kaggle_competition_landscape (one digested, deadline-sorted report)

"Download titanic data, infer the target, and do an EDA."

kaggle_eda_competition → train/test schema diff (auto-target) + compact pandas digest

"Find a good Titanic dataset and show me what it looks like."

kaggle_search_datasets → kaggle_dataset_preview (capped, untrusted-fenced rows)

"Summarize the iris dataset."

kaggle_eda_dataset → shape, dtypes, missingness, target dist, top correlations

"Submit predictions.csv to titanic and tell me the score."

kaggle_preview_submission → kaggle_submit_to_competition (token + budget gate) → kaggle_get_submission_score

"Is it worth iterating — what's my best score so far?"

kaggle_submission_best_score (metric-aware best/trend/failures + today's budget)

"Did anyone pass me on the leaderboard since last check?"

kaggle_leaderboard_track (snapshot deltas, who passed you)

"What techniques are people discussing for this competition?"

kaggle_search_discussions → kaggle_get_discussion (read-only, every post untrusted-fenced)

"Find the winning solution write-ups for this competition."

kaggle_search_writeups → kaggle_get_discussion

"Kick off this competition for me."

kaggle_competition_kickoff — one call: metric + rules + data download + train/test EDA (auto-target) + baseline plan + budget

"What mutating actions have I taken this session?"

kaggle_audit_log (redacted ledger of every submit/create/delete)

"Run this notebook on Kaggle's free GPU and get the output."

kaggle_push_kernel → kaggle_kernel_status → kaggle_kernel_output

"Save my engineered features as a private dataset version."

kaggle_version_dataset — private by default

Env var

Default

Effect when 1

KAGGLE_MCP_ENABLE_DESTRUCTIVE

0

Exposes kaggle_delete_dataset / kaggle_delete_model

KAGGLE_MCP_ENABLE_PUBLISH

0

Allows creating public datasets

KAGGLE_MCP_SUBMISSION_CAP

5

Per-competition daily submission budget