Your BI agent needs to read Tableau. It has to query a published data source before a pipeline review, pull the numbers behind an executive dashboard, and check whether last night's extract refresh actually finished. Tableau ships both an official MCP server (hosted at mcp.tableau.com and self-hostable) and a mature API surface spanning REST, the VizQL Data Service, Metadata, and Pulse. They cover overlapping but not identical territory, and they do not put you on the same auth path. For Tableau specifically, the auth fork is the part most teams get wrong. Here's how to pick.
Tableau MCP is Tableau's official Model Context Protocol server, an open-source project maintained by Tableau under github.com/tableau/tableau-mcp. It ships in two forms. The hosted service runs as a managed endpoint on every Tableau Cloud pod at a single URL, https://mcp.tableau.com, with pod-aware routing and no infrastructure to deploy. The self-hosted build (Docker or Node) is for Tableau Server customers, or Cloud customers who need to run the server inside their own network.
Both forms proxy each tool call to the same underlying Tableau APIs (REST, VizQL Data Service, Metadata, Pulse) using the signed-in user's access token, so existing per-user permissions apply automatically. Official docs: tableau.github.io/tableau-mcp/docs/intro.
Tableau is not a single API. Agents reason about four surfaces. The REST API handles content: workbooks, views, data sources, projects, users, groups, jobs, tasks, publishing, and permissions, on a date-versioned contract (currently the 3.2x line). The VizQL Data Service (VDS) is the headless query layer, returning JSON from published data sources without rendering a viz. The Metadata API is a GraphQL surface for lineage and catalog. The Pulse API exposes metric definitions and insights.
Auth accepts a Personal Access Token, a username and password, or a JSON Web Token issued by a Connected App or Unified Access Token, exchanged at sign-in for an X-Tableau-Auth credentials token. Official docs: help.tableau.com/current/api/rest_api/en-us/REST/rest_api.htm.
The hosted MCP covers most of what a BI agent needs day to day: asking questions of a governed data source, browsing content, discovering Pulse metrics, and checking refresh jobs. The gaps show up when the agent has to publish content, move data at volume, trace lineage in depth, or react to events.
The MCP catalog is broad but fixed. It is a request-and-response surface: the agent asks, a tool answers. It does not publish content, run Hyper extract file operations, expose the complete Metadata GraphQL query surface, or manage webhook subscriptions. Those are direct-API capabilities.
Two constraints are worth stating plainly. The hosted MCP is Tableau Cloud only; Server customers must self-host. And some hosted tools are gated by SKU, so a tool the docs list can still return an entitlement error at call time if the signed-in user's site lacks it. If your agent's job is configuring the environment, publishing artifacts, or subscribing to change events, the MCP is not the right layer for that part of the work.
This is the section that decides most Tableau builds, and it is more nuanced than the "MCP is OAuth-only" pattern seen with other tools.
The hosted MCP is OAuth 2.1 and interactive. Every user completes a browser sign-in against their own Tableau Cloud identity; there is no static-credential option. That is correct for a user-present assistant, and a hard blocker for an agent running with no human in the loop.
The self-hosted MCP is different. It accepts Personal Access Tokens, Connected Apps using direct trust (JWT), Unified Access Tokens, OAuth, and passthrough. Several of those are non-interactive, so a self-hosted MCP can run headlessly, at the cost of you owning the server.
The direct API is the most flexible. A JWT issued by a Connected App gives you scoped, per-user, server-to-server access with a single sign-in request and no browser, which is the right pattern for background execution.
Tableau's model runs every call as the authenticated user, so field-level security, row-level security, and content permissions apply on every tool call. That is architecturally correct. It also means a multi-tenant B2B agent holds one credential per user, per site. The hosted MCP OAuth flow gives you a token per user; the direct-API PAT or JWT gives you a credential per user. In neither case does the path itself store, rotate, or revoke those credentials for you.
On the hosted MCP path, Tableau owns hosting, scaling, routing, and continuous tool updates. You still own per-user credential storage, refresh, revocation on disconnect, and tenant isolation. You also inherit an unversioned tool contract: because the hosted service ships changes continuously, tool schemas can move without a version you pin to.
On the direct-API path you own more and control more. You select endpoints across four surfaces, each with its own error and retry behavior, and you handle the full credential lifecycle. In exchange you pin an explicit REST API version and migrate on your own schedule, which matters when an unexpected schema change would be an incident rather than an inconvenience.
Agentic workflows issue many sequential calls per user action, so limits arrive faster than with a traditional integration. On Tableau Cloud, REST API usage is capped at 40,000 calls per user per site per hour, and requests to endpoints that start long-running jobs are limited to 20 concurrent at a time, with a 429 response when you exceed either. MCP tool calls proxy to the same APIs, so they consume the same budget. Monitor usage from day one; neither path exempts you from the limit.
Use Tableau MCP when:
Use the Tableau API directly when:
Both paths hand you a credential per user. Neither hands you a vault, refresh orchestration, or a revocation flow. Picture a BI agent serving 40 analysts across 8 Tableau sites: that is 40 credentials to store encrypted, 40 session tokens to refresh before they expire, and 40 to revoke when someone leaves. The MCP OAuth token and the direct-API PAT differ in type; the infrastructure they demand is identical.
Scalekit's Tableau connector closes that gap for the direct-API path. You store each user's Personal Access Token once as a connected account, and Scalekit signs in on their behalf and refreshes the Tableau session token automatically, renewing it when it is within five minutes of expiry, so your code never calls the sign-in endpoint. Credentials live in a per-tenant, AES-256 token vault, resolved server-side at request time and never placed in the LLM context. What the user can't do in Tableau, the agent can't do, because the agent acts as that user.
The value of the vault for a Tableau agent is narrow and concrete: the agent calls a tool, gets a result, and never sees a token. Credentials never touch the agent runtime.
Scalekit's Tableau connector wraps the REST API and the VizQL Data Service behind a set of prebuilt, LLM-ready tools, so you build the agent rather than the tooling. The tool names below are the exact strings you pass to execute_tool.
For binary exports (PNG, PDF, Excel, .twbx, .tdsx) and any REST endpoint without a dedicated tool, the connector exposes a proxy call that injects the X-Tableau-Auth session token for you. Full tool reference: docs.scalekit.com/agentkit/connectors/tableau.
The sequence is discovery, then scope, then execution. listScopedTools returns only the tools the current user's connected account is authorized to call, not a flat catalog, and the filter narrows that surface further to the tools this agent actually needs. The connection name string, tableau, must match the connection you configured in the Scalekit dashboard; a mismatch here is the most common integration error. Then the agent runs its normal loop and calls executeTool.
The same connected-account model backs the Python and Node SDKs, LangChain, Google ADK, OpenAI, and Claude Managed Agents. Getting-started guide: docs.scalekit.com/agentkit/quickstart.
If you would rather hand your agent an MCP endpoint than wire tools directly, Scalekit's Virtual MCP Server gives you a scoped, user-specific MCP endpoint with no server to deploy, host, or maintain. You create it once per agent role and declare exactly which connections and tools it exposes; the agent sees only what you allow, not everything the connector exposes.
The response returns a static mcp_server_url of the form https://yourcompany.scalekit.com/mcp/v3/servers/<server-id>. One server definition serves every user. Per-user isolation is handled by session tokens: before each run you confirm the user's connection is active, mint a short-lived token scoped to that user's connected account, and pass it as a bearer credential. The endpoint is static; the identity is per-user. A full end-to-end walkthrough lives at docs.scalekit.com/agentkit/examples/claude-managed-agents, and setup steps at docs.scalekit.com/agentkit/mcp/configure-mcp-server.
A BI agent rarely touches Tableau alone; it also reads a CRM, posts to Slack, and files tickets. Across those tools, shared credentials break attribution: every call in the audit log reads as a service account. Scalekit resolves the real per-user credential on each call, so audit logs attribute every Tableau action to the user who authorized it, with the tool that ran and what came back, retained for 90 days and exportable to your SIEM. That is the difference between "the agent queried a data source" and "user_abc queried the Q3 revenue data source at 18:29, scoped to their permissions." For multi-tenant products, that record is what a security reviewer asks to see.
The connector covers content browsing, VizQL queries, jobs, users, and proxied REST calls, but not everything (for example, content publishing or Hyper extract operations are not prebuilt tools today). If your agent needs a tool that is not yet available, request it: join the Scalekit community on Slack at join.slack.com/t/scalekit-community or talk to the team at scalekit.com/demo-agent-actions.
If your agent is interactive and user-present on Tableau Cloud, and its job is data Q&A, content browsing, and Pulse discovery, the hosted MCP is the fastest working path, with per-user permissions enforced for you. If your agent runs headless, publishes content, moves data at volume, needs the full Metadata surface or webhooks, or runs on Tableau Server, build against the direct API with Connected Apps JWT. Most production Tableau agents end up running both: the assistant on MCP, the pipeline on the API. Either way, every user still carries their own Tableau credential, and that credential layer is the part that needs production-grade infrastructure.
Browse the Scalekit Tableau connector: scalekit.com/connectors/tableau. Connector docs: docs.scalekit.com/agentkit/connectors/tableau.
