Agent First BI for Power BI.

Three things break when an agent writes its own DAX

1. It picks the wrong measure

   Net sales, Revenue and Net Sales are one calculation in three datasets. The agent can't tell.

   Here: the sync finds they are one metric, net_sales, and names its variants.

   Net salesRevenueNet Sales
   net_sales

2. It fills its context

   A year of daily sales lands in the chat, and the agent loses the thread.

   Here: the agent downloads the full result as a CSV file into its folder. Only a preview of up to 100 rows goes into the context.

   in the context: 100 rowsin the CSV file: every row

3. It runs as someone else

   A shared account answers with its own rights, not the rights of the person asking.

   Here: every query runs with the asking person's own Power BI sign-in, so row-level security holds.

   shared account: its rows
   you: your rows

$ uv tool install powerbi-metrics-book

$ pbmb init ./deployment \
    --public-base-url https://metrics.example.com
$ cd ./deployment

$ docker compose up -d --wait

$ docker compose exec api server setup-link

$ claude mcp add --transport http powerbi_metrics_book \
  https://metrics.example.com/api/mcp

# then run /mcp, choose powerbi_metrics_book and sign in

Not released yet. These commands work from 0.1, the first release. Until then, run it on the sample tenant.

The quickstart, step by step

Add one address to your agent

The MCP connector is the main way in. Each agent signs in as you, through your browser, so it reads only what your Power BI already lets you read.

claude mcp add --transport http powerbi_metrics_book \
  https://metrics.example.com/api/mcp

# then run /mcp, choose powerbi_metrics_book and sign in

# ~/.codex/config.toml
[mcp_servers.powerbi_metrics_book]
url = "https://metrics.example.com/api/mcp"

# then sign in
codex mcp login powerbi_metrics_book

// ~/.cursor/mcp.json
{
  "mcpServers": {
    "powerbi_metrics_book": {
      "url": "https://metrics.example.com/api/mcp"
    }
  }
}

Connect an agent, step by step

Build internal tools on the same numbers

Your agent finds the data with you over MCP. Then your tool runs the same DAX with an API key. You never write Power BI sign-in code.

# once, as an admin
$ pbmb sa create sales-dashboard \
    --owner data-team@example.com \
    --role viewer --workspace <workspace id>
$ pbmb sa keys create sales-dashboard \
    --expires-in-days 30

# then from your tool, with the DAX your agent wrote
$ curl -X POST "$PBMB_URL/api/v1/queries" \
    -H "Authorization: Bearer $PBMB_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"dataset": "Sales", "dax": "EVALUATE ..."}'

A service account queries only after an admin turns onpowerbi.service_account_queries. It runs as the app's own service principal, so it never queries a dataset with row-level security.

Build on the API, step by step

Everything runs on one VM

You run it yourself, with Docker Compose on one VM of at least 2 vCPUs, 4 GB of memory and 40 GB of disk. The deploy guides say where to get one. One deployment serves one organisation and one Power BI tenant.

See the stack, container by container

Where to run it

Each guide ends with pbmb admin status passing against the new address, and says who acts at each step.