Superset 6.1.0 covers charts, SQL, dashboards, and MCP
Superset 6.1.0 is a browser-based business intelligence application for teams working with SQL data. Its visual chart builder sits beside SQL Lab, shared dashboards, datasets, a light semantic layer, and an API. Any SQL-speaking store can fit when it has a Python DB-API driver and SQLAlchemy dialect. This is useful when analysts need room to explore but administrators still have to control which data and actions each role can reach.
Our commit f2610e9 checkout contained 10,740 files, about 1,424,478 source lines, and 288.1 MB before installation. The size is visible in the architecture: a Flask backend, React frontend, Webpack assets, chart plugins, migrations, database connectors, and deployment material all live here. A team changing chart behavior or security policy is taking on a large application, with review and upgrade work to match.
Superset 6.1.0 production needs several services
Superset 6.1.0's architecture separates the application from its metadata database, then adds caching and worker or scheduler processes for selected features. A PyPI install creates only the application. The official architecture page says configuration of cache, worker, and beat for that route is not covered there. PostgreSQL and MySQL are the tested metadata stores, while SQLite is discouraged in production for security, scale, and data-integrity reasons.
The 162-package environment used 476 MB before any warehouse driver chosen for a real deployment. Operators still need a unique secret key, database credentials, migrations, users, roles, and backups. Async SQL or scheduled reports can bring Redis, Celery, a scheduler, and a browser into the stack. The supplied Docker Compose files create supporting services, but Superset says that single-host route lacks high availability and is not recommended for production.
What happened when we ran it
Our sandbox installed Superset in 88 seconds and built it in 13 seconds. We cloned commit f2610e9 on August 22, 2026, then used an unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and the Python 3.12 uv image named in our measurement setup. Installation added 162 packages and completed successfully, so the repository can reach a finished build in that clean environment.
Pytest exited 1 after 86 seconds. It recorded 1 passed, 0 failed, 1 skipped, and 200 collection or setup errors out of 201 before stopping. The log repeatedly showed SQLite querying a missing table named css_templates. That establishes the absent test database state, but it does not explain why the table was absent. Pip-audit also found 1 known vulnerability without naming its package or severity.
Superset 6.1.0 does not replace warehouse permissions
Superset 6.1.0's security guide says the application is not a database firewall. Its secret key signs session cookies and protects stored database credentials, while application roles govern features and datasets. Those controls sit above the actual warehouse account. A broad credential behind a restricted dashboard can still expose more than intended through SQL Lab or another permitted route, so adoption should include least-privilege database users and adversarial role tests.
Our audit's 1 known vulnerability needs package and severity identification before release; the count alone cannot tell an operator whether the affected code ships. Data correctness deserves the same discipline. Open issue 44079 reports that 6.1.0 cannot display a numeric value beyond 64 bits in SQL Lab or a chart, producing a BigInt conversion error. The reporter's workaround is casting the value to text, which is poor consolation if large numeric identifiers are normal data.
Superset 5.0+ gives AI clients a separate MCP process
Superset 5.0+ includes an MCP server that runs beside the main application and can list dashboards, query datasets, execute SQL, and create charts. It requires Python 3.11+ and the fastmcp package. The documented production path validates bearer tokens and maps claims to Superset users; development mode impersonates one configured user. Exposing that mode outside a local machine would give every request the same account's permissions.
The repository contains 48 CI workflow files, yet MCP consumers should still regression-test the exact write tools they enable. Open issue 44176 reports that editing one field through update_chart can replace an omitted color scheme and row limit with defaults. In its reproduction, a row limit of 50 became 10,000. Until that issue is resolved in the version you run, an AI-driven chart edit needs a before-and-after diff and a narrowly scoped user.
September activity shows health and unfinished edges
GitHub showed 74,723 stars, 169 open issues, and 616 open issues plus pull requests on September 12, 2026. The last push was that same day. Release 6.1.0 was published May 13, so the newer code and issue activity are better evidence of ongoing maintenance than the release date alone. The open queue includes fresh reports across charts, semantic views, MCP, and SQL behavior, which fits a project with this much surface area.
The 13-second build makes a source trial inexpensive, while 200 setup errors make a clean database bootstrap a release gate for contributors. Superset is the right choice when a platform team can own those details and analysts need more range than a simpler question builder provides. Smaller teams should start with Metabase; operations teams centered on metrics, logs, and traces should start with Grafana.