Metabase

Open source software is in for a rough 2026 summer. If you’re an Open Source maintainer, there’s something afoot you should already know about. If you’re an OSS user , you should be aware of it as it’ll explain some behavior around you that might otherwise seem odd. TL;DR: High volume, LLM-powered scanning for security vulnerabilities is going to uncover lots of security issues in anything with public source code. This all started a few months ago Historically, Metabase averaged 10 submissions per month to our [email protected], most of which were trivial or not actually vulnerabilities. Many were false positives from scanning tools, and we spent most of our time explaining to the reporter that what they found wasn’t actually a problem. At the turn of the year, things changed. Starting in January, we’ve been averaging 10 submissions per week, and many of these are legit. Most are not serious, and we’ve quietly fixed them, thanked the researcher, and went our merry way. However, it

We ran the Metabase AI Hackathon to celebrate every AI feature in Metabase going open source. The submissions were genuinely fun to go through: analytics agents, new products, an entire API with machine learning, a couple of things that made us laugh, a couple that made us think “oh, that’s actually clever.” Picking two was harder than we expected. Here are the winners: Meta Chess, by Marat Surmashev A live dashboard where Claude and Codex play chess against each other, with Metabase as the entire game platform, not a passive viewer. This one uses two of our newest features in tandem. The agents sync through the MCP server : read the board state, check whose turn it is, and see the opponent’s last move. What spectators watching the dashboard see and what the agents see is the same source of truth. The dashboard itself is built with file-based development : the live chessboard, the last-move highlight, and the move history are all Metabase YAML cards shipped through the serialization v2

Development tools can sometimes struggle when dealing with large codebases. This gives performance nerds like me a reason to investigate. In this case, I ended up cutting clojure-lsp’s startup time in half and memory allocation by two thirds. Part 1: The mystery of heap headroom Devs working on Metabase were complaining about LSP taking too long to boot, so I wondered how long it could be. A few seconds? Half a minute? Imagine my surprise when I saw this: ( time ( clojure-lsp.api/analyze-project-only! { :project-root ( clojure.java.io/file "/path/to/metabase" )})) "Elapsed time: 178981.918417 msecs" Three minutes is a long time. The first suspect was heap size. There is a good rule of a thumb: if some process in Clojure (or any JDK language) takes longer to complete than anticipated, or doesn’t finish at all, you should check the heap. I used VisualVM to inspect our Clojure process and ran the benchmarking command, which gave us something like this: What’s going on here? My laptop has

Material Event filed 2026-05-04

Quarterly Report filed 2026-04-30

Material Event filed 2026-04-29

Show us what you can build with the new AI tools and get the chance to win a Metabase mechanical keyboard. Metabase now ships an MCP server, an Agent API, and Metabot in Slack: three different ways to plug your analytics into whatever agent or workflow you’re building. All in open source, which means the tools are yours, the semantic layer is yours, what you build on top of them is up to you. So we figured: let’s see what the community can build. Join the hackathon To enter: Build something using the AI tools listed below . Solo or with a team. Write it up — a social post, blog post, short video, or repo with a good README. Something that shows off what’ve built. Submit your entry by sharing it on X or LinkedIn, tag @metabase , and use #MetabaseAI . Submit by Tuesday 05/05/2026 . Build whatever you like. Analytics agents, dashboards that summarize themselves, something weird we didn’t think of — all fair game. If it uses one of our AI tools somewhere in the loop, it counts. Get inspire

Metabase’s backend is big. We’re talking 500K lines of Clojure code spread across a query processor, permissions system, numerous database drivers, a notification pipeline, serialization layer, search engine, and more. And like all big codebases, each subsystem has its own idioms, gotchas, and “you just have to know” moments. I’ve been using Claude Code for backend work on Metabase for a while now. It’s pretty good. But overloads Claude’s context window quickly. Every time Claude needs to understand a subsystem, it explores, greps, and reads files. All of that exploration eats your context window. Even when Claude spawns subagents, they will need to do a lot of extra work to get up to speed on the domain. I built some custom subagents to fix this. What are subagents and why did I make ten of them? Metabase’s backend has natural domain boundaries. The query processor is a 68-stage middleware pipeline that compiles MBQL (the Metabase Query Language) to SQL across 18 database dialects. Th

Proxy Statement filed 2026-04-16

Material Event filed 2026-04-14

Reproducing bug reports is one of the most time-consuming parts of maintaining an open source project. We built an AI agent called Repro-Bot to help us with this task. In this post, we’re sharing how we built it and show you how you can build your own. If you want to skip ahead and check out our code, take a look at the Repro-Bot repo ! Repro-Bot automates the boring parts Think about how you, a human person, would reproduce a bug report: Set up an environment identical (or at least similar) to what the reporter has. Follow the steps provided in the issue. If you can reproduce the bug: Write a test for the bug Fix it If you can’t reproduce, think through why: Is there information missing? Are there any hidden dependencies? Did anything change recently? etc This process is a mix of judgement calls (like ”fix it,” or what constitutes a relevant change), and chores like setting up the environment, following the steps, and asking the same questions over and over. Repro-Bot automates the bo