Back to Browse

Tabletopdb MCP Server

Developer ToolsModerate6.1MCP RegistryLocal
Free

Server data from the Official MCP Registry

BoardGameGeek tools: search, details, collections, hot list, trades, and recommendations.

About

BoardGameGeek tools: search, details, collections, hot list, trades, and recommendations.

Security Report

6.1
Moderate6.1Moderate Risk

tabletopdb is a clean BoardGameGeek XML API2 client. It reads BGG_API_KEY from the environment, validates every tool argument with zod, makes no shell or eval calls, and sends only game IDs and usernames to BGG, which matches its purpose. The main concern is that the BGG_API_URL override can redirect the API key to any host, which users should be aware of. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

override the API base (defaultRequired

Environment variable: BGG_API_URL

your BGG username; enriches bgg-price identityRequired

Environment variable: BGG_USERNAME

BGG_API_KEYRequired

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-tabletopdb": {
      "env": {
        "BGG_API_KEY": "your-bgg-api-key-here",
        "BGG_API_URL": "your-bgg-api-url-here",
        "BGG_USERNAME": "your-bgg-username-here"
      },
      "args": [
        "-y",
        "@reneturcios/tabletopdb"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

tabletopdb

BoardGameGeek tools for agents: search the BGG catalogue, pull game details and collections, check the hot list, find trades, and get recommendations — all through the public BoardGameGeek XML API2.

tabletopdb is a clean-room rebuild of the documented bgg-mcp tool set (originally by kkjdaniel), written fresh from its public README tool list. It reproduces the tool surface and the request/response handling against the BGG XML API2; it does not copy the original project's code.

One bin serves two faces:

  • a small CLI: tabletopdb <tool-name> '<json-arguments>'
  • a stdio MCP server: tabletopdb mcp

Requirements

  • Node.js 20 or newer.
  • A BoardGameGeek API key in the environment:
export BGG_API_KEY="your-bgg-api-key"

Every call sends Authorization: Bearer $BGG_API_KEY. When the key is missing or blank, calls fail with an error naming BGG_API_KEY before any request is made.

Optional environment variables:

  • BGG_API_URL — override the API base (default https://boardgamegeek.com/xmlapi2).
  • BGG_USERNAME — your BGG username; enriches bgg-price identity output only.

CLI usage

Tool names are hyphenated, exactly as documented:

tabletopdb bgg-search '{"query":"Catan"}'
tabletopdb bgg-details '{"id":13}'
tabletopdb bgg-collection '{"username":"someuser"}'
tabletopdb bgg-hot '{}'
tabletopdb bgg-user '{"username":"someuser"}'
tabletopdb bgg-price '{"id":13}'
tabletopdb bgg-trade-finder '{"username":"someuser","maxResults":10}'
tabletopdb bgg-recommender '{"id":13,"limit":5}'
tabletopdb bgg-rules '{"id":13}'
tabletopdb bgg-thread-details '{"threadId":123456}'
tabletopdb --version

Exit codes: 0 success, 1 API/validation error, 2 usage error (unknown command or malformed JSON arguments).

MCP usage

npx -y @reneturcios/tabletopdb mcp

MCP client config:

{
  "mcpServers": {
    "tabletopdb": {
      "command": "npx",
      "args": ["-y", "@reneturcios/tabletopdb", "mcp"],
      "env": { "BGG_API_KEY": "your-bgg-api-key" }
    }
  }
}

Docker:

docker run -i -e BGG_API_KEY="your-bgg-api-key" ghcr.io/cloudcorprecords/tabletopdb
docker run --rm -e BGG_API_KEY="your-bgg-api-key" ghcr.io/cloudcorprecords/tabletopdb bgg-hot '{}'

Tools

BGG answers in XML; responses are converted to JSON by a small built-in parser (attributes become fields, repeated elements become arrays, element text is kept under a value key where mixed).

ToolArgumentsWhat it does
bgg-searchquery (required), typeSearch BGG by name. type defaults to boardgame.
bgg-detailsid (number, required), typeFull thing details with stats (/thing?id=&stats=1).
bgg-collectionusername (required)A user's owned collection (own=1&stats=1). If BGG answers HTTP 202 (collection being prepared), returns {status: "accepted", note} instead of an error — retry shortly.
bgg-hottypeThe current BGG hot list. type defaults to boardgame.
bgg-userusername (required)A BGG user profile.
bgg-priceid (number, required)Resolves the game's identity via BGG and returns {id, name, price_sources: [], note}. Live price lookup needs a separate price-data provider; see Gaps.
bgg-trade-finderusername (required), maxResultsCollection items whose status is marked fortrade, as {username, for_trade, count}.
bgg-recommenderid (number, required), limitCategory heuristic: takes the game's first category, searches it, and returns up to limit other games (default 10). See Gaps.
bgg-rulesid (number, required){id, name, description, bgg_url, note} — the game's BGG description and page link. Full rules live in BGG files/wiki.
bgg-thread-detailsthreadId (number, required)A forum thread with its parsed articles.

Gaps

  • bgg-price is an identity shaping, not a price feed: the original project resolves prices through external price sources that its README does not specify, so this rebuild returns the BGG-resolved identity with an empty price_sources list and an explicit note.
  • bgg-rules is an info shaping for the same reason: it returns the game's description and canonical BGG page; the full rules live in the files and wiki on that page.
  • bgg-recommender is a labelled category heuristic (shared first category, source game excluded), not a learned recommendation model.
  • The collection HTTP 202 semantics are simplified to a single {status: "accepted", note} object; callers poll by retrying.
  • No live BGG call was made while building this package; behaviour is verified against fake-fetch fixtures only.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, fake fetch only, no network
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!