eMondrian Community is designed for local evaluation and trusted networks. Read this page before making it reachable from other machines.
What is open in Community
Community ships with no authentication and no access restrictions. Anyone who can reach the server can:
| Endpoint | What they can do |
|---|---|
/xmla | Query all data in all catalogs |
/schema-editor/ | Read and change schemas |
/catalog-editor/ | Read and change data sources and catalogs, including database connection strings and the credentials in them |
/logs/ | Read server logs, including queries and SQL |
/emondrian/mcp/sse | Use all MCP tools: query data, overwrite schemas (save_schema), read logs and settings |
/ | See installed licenses and activate license keys |
/xmla and /api also answer cross-origin requests from any origin by default (CORS_ALLOW_ORIGIN=*, see CORS): any web page open in a browser that can reach the server may query it through that browser.
This is deliberate for a local setup on http://localhost. Don’t expose this configuration to an untrusted network, and never to the internet.
Recommendations
- Keep it local or on a trusted network. Run eMondrian on
localhostfor evaluation. For team use, restrict access to a trusted network segment with firewall rules. - Use a read-only database user. eMondrian only reads data. A read-only user limits the damage if the server is misused. See Connect databases.
- Put a reverse proxy in front for shared use. A reverse proxy (nginx, Caddy, Traefik, …) can add HTTPS and authentication, and can block paths users don’t need — for example
/schema-editor/,/catalog-editor/,/logs/and/emondrian/mcp/for regular report users. - Treat MCP as administrative access. The MCP tools can change schemas. Give MCP access only to people who may change the model, and only on a trusted machine.
- Disable services you don’t use in
.env— e.g.ENABLE_SERVICE_SCHEMA_EDITOR=falseandENABLE_SERVICE_CATALOG_EDITOR=false. - Narrow CORS. Set
CORS_ALLOW_ORIGINin.envto the one web application that needs browser access. Leaving it empty does not close browser access: the eMondrian server’s own CORS handling still allows simple requests from any origin. - Protect the logs. They can contain member names and filter values from your data.
Roles inside the model
Schemas can define roles that restrict cubes, dimensions or members — see Schema reference. Roles control what a role may see; they are not a replacement for authentication of who connects.
Production
Authentication, per-user access for MCP, audit logging and production hardening are planned for eMondrian Enterprise. For production deployments, see emondrian.com/pricing or contact [email protected].