qseow-mcp

An MCP server for Qlik Sense Enterprise on Windows (client-managed).

The glue layer for a Qlik support agent. Qlik Cloud ships a native MCP endpoint; the client-managed estate — where a large share of enterprise Qlik still runs — has nothing equivalent. This server exposes the on-prem API surface (Repository/QRS, Engine/QIX, Proxy) as Model Context Protocol tools, so an agent can do what a support engineer does when a number is wrong: walk KPI → object → sheet → app → script → source, evaluating definitions at every step — plus govern, query, and build against the site.

Status: 0.5.2, pre-release. All 44 tools exercised end-to-end against Qlik Sense May 2026 (15.13.8) on a single-node site, in BOTH certificate and JWT auth modes (including the full mutation lifecycle: copy → set_script → reload → publish → delete, and task start-to-finish). Tool names and shapes may still change.

qseow-mcp is an independent open-source project by Terenzi LLC. It is not affiliated with, endorsed by, or sponsored by QlikTech International AB. Qlik®, Qlik Sense®, and related marks are trademarks of QlikTech International AB, used here only to identify the software this server interoperates with.

Install

Claude Desktop — one-click. Download qseow-mcp-<version>.mcpb from the latest release and double-click it. Claude Desktop prompts for your hostname and certificate paths; there is no JSON to edit and no npm install to run.

Any MCP client — via npx. No clone, no build:

{
  "mcpServers": {
    "qseow": {
      "command": "npx",
      "args": ["-y", "qseow-mcp"],
      "env": {
        "QSEOW_HOST": "sense.example.com",
        "QSEOW_CERT_PATH": "/absolute/path/to/client.pem",
        "QSEOW_CERT_KEY_PATH": "/absolute/path/to/client_key.pem",
        "QSEOW_ROOT_CERT_PATH": "/absolute/path/to/root.pem"
      }
    }
  }
}

Claude Code, same thing in one line:

claude mcp add qseow --scope user \
  -e QSEOW_HOST=sense.example.com \
  -e QSEOW_CERT_PATH=/absolute/path/to/client.pem \
  -e QSEOW_CERT_KEY_PATH=/absolute/path/to/client_key.pem \
  -- npx -y qseow-mcp

Certificates come from QMC → Certificates → Export (choose PEM). For JWT instead of certificates, see Authentication.

It starts read-only. Mutating tools are not registered at all until you set QSEOW_ALLOW_MUTATIONS=true, so the tool list a client sees is genuinely read-only until you decide otherwise.

Tools by persona

Expose only what a given deployment needs with QSEOW_TOOL_GROUPS.

Analyst — ask questions of data (Engine/QIX)

Every value-returning analytics tool ships a trust envelope: expression validation warnings (a misspelled field returns null/0 without erroring — the engine's worst habit) and the active selections the value was computed under, so a filtered number can never masquerade as the unfiltered truth.

Inspector — the troubleshooting loop (ships with the analyst group)

Published-app caveat: the engine hides a published app's script and lineage from user identities (internal certificate identities bypass this). The support-agent pattern is copy_app → trace the owned copy — the copy carries the same script and definitions.

Developer — build and ship apps (Engine + QRS)

Admin — govern the site (QRS)

Mutating tools (set_script, reload_app, create_app, copy_app, publish_app, delete_app, start_task, end_user_sessions, create_sheet, add_sheet_object) are gated at registration: unless QSEOW_ALLOW_MUTATIONS=true, they are never registered, so a read-only deployment advertises a genuinely read-only tool surface in tools/list. Default is read-only.

Every tool carries MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients that honor them can apply their own policy — e.g. reload_app/set_script/start_task are flagged destructive; selection tools are non-destructive session-state mutations.

Credential redaction applies to every QRS egress path: list_data_connections and generic qrs_search (any entity type, condensed or full:true) recursively mask credential-bearing fields (password, passphrase, clientsecret, ...) and secrets embedded in connection strings (PWD=..., apikey=...). Empty/null credential fields pass through unmasked — "no credential present" is a legitimate signal.

All list tools are paged (offset/limit, envelope {total, offset, returned, truncated, items}) so a site with thousands of apps or users cannot blow the client's context window.

Render verification

Modern Sense visualizations are nebula.js supernovas rendered by the client, not the engine — a hypercube the engine accepts and evaluates perfectly still renders blank if the supernova's default property blocks are missing (it throws Cannot read properties of undefined in the browser; the engine never knows). The builder ships those blocks per type, and validate_sheet flags objects that lack them.

Because engine-side validation cannot prove pixels, two scripts close the loop: scripts/viz_matrix.mjs builds one of every supported type against a live site, and scripts/render_proof.mjs drives a real headless browser over the result at sheet-tile sizes and reports what actually drew.

All 12 supported types are render-verified on Qlik Sense May 2026, at sheet-tile sizes, in a real browser client: kpi, gauge, barchart, linechart, combochart, piechart, scatterplot, treemap, table, pivot-table, listbox, text-image.

Getting a chart's real property contract

When a supernova refuses to draw, do not reverse-engineer its properties from error messages — some charts throw nothing useful. Instead ask the client what it writes:

node scripts/harvest_client_props.mjs treemap ./truth.json

This scans every readable app for client-authored objects of that type and dumps their properties. Qlik's shipped monitoring apps (Content / Operations / License Monitor) are a good source. This is how the last two broken types were fixed, each in a single pass after repeated guesswork had failed:

• treemap needed qMode: "K" (tree mode — the same class of trap as pivot-table needing "P") plus a far leaner property set than the generic builder produced. Harvested from Qlik's shipped Content Monitor app.
• gauge needed gaugetype, angle, autoOrientation, paletteProgressColor and segmentInfo — properties no error message ever named, because gauge fails silently. Harvested from a gauge authored in the Sense client for the purpose.