metabase · github-automation-metabase · Aug 17, 2026
diff --git a/_data/shared_chrome.json b/_data/shared_chrome.json
diff --git a/_docs/latest/ai/settings.md b/_docs/latest/ai/settings.md
@@ -69,8 +69,10 @@ You can specify your own API key and model for Metabot from one of the supported
 - **Amazon Bedrock**: Claude and GPT models.
 - **Anthropic**: Claude models (Opus, Sonnet, Haiku, and Fable).
 - **Microsoft Azure**: Your own Azure deployments of Claude or GPT models. Enter the deployment name you configured in Azure.
+- **Mistral**
 - **OpenAI**: GPT models.
-- **OpenRouter**: Claude and GPT models.
+- **OpenRouter**: Claude, GPT, Mistral, DeepSeek, and GLM-5.2 models.
+- **Z.AI**: GLM-5.2 models.
 
 If you're interested in Metabase supporting more AI providers or models, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features).
 

diff --git a/_docs/latest/configuring-metabase/config-template.md b/_docs/latest/configuring-metabase/config-template.md
@@ -246,9 +246,19 @@ config:
     map-tile-server-url: https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png
     mcp-apps-cors-custom-origins: ''
     mcp-apps-cors-enabled-clients: []
+    metabot-advanced-permissions: false
+    metabot-chat-system-prompt: ''
     metabot-enabled: true
+    metabot-icon: metabot
+    metabot-limit-reset-rate: monthly
+    metabot-limit-unit: tokens
+    metabot-name: Metabot
+    metabot-nlq-system-prompt: ''
+    metabot-quota-reached-message: You have reached your AI usage limit for the current period. Please contact your administrator.
     metabot-recent-views-enabled: true
+    metabot-show-illustrations: true
     metabot-slack-signing-secret: null
+    metabot-sql-system-prompt: ''
     mfa-challenge-signing-key: null
     mfa-enforcement: 'off'
     native-query-autocomplete-match-style: substring
@@ -357,4 +367,5 @@ config:
     usage-metadata-retention-days: 90
     usage-metadata-schedule: 0 0 2 * * ? *
     user-visibility: all
+    warehouse-allowed-networks: null
 ```
diff --git a/_docs/latest/configuring-metabase/environment-variables.md b/_docs/latest/configuring-metabase/environment-variables.md
@@ -1558,6 +1558,28 @@ Custom CORS origins for self-hosted MCP clients, space-separated.
 
 Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vscode).
 
+### `MB_METABOT_ADVANCED_PERMISSIONS`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: boolean
+- Default: `false`
+- [Exported as](../installation-and-operation/serialization): `metabot-advanced-permissions`.
+- [Configuration file name](./config-file): `metabot-advanced-permissions`
+
+Whether the AI feature access admin page shows granular, per-tool group permissions instead of a single on/off toggle per group.
+
+### `MB_METABOT_CHAT_SYSTEM_PROMPT`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: ``
+- [Exported as](../installation-and-operation/serialization): `metabot-chat-system-prompt`.
+- [Configuration file name](./config-file): `metabot-chat-system-prompt`
+
+Custom instructions appended to Metabot's system prompt for the chat experience (the AI sidebar and embedded Metabot).
+
 ### `MB_METABOT_ENABLED`
 
 - Type: boolean
@@ -1567,13 +1589,90 @@ Popular MCP clients enabled for CORS, stored as CSV client keys (e.g. claude, vs
 
 Whether Metabot is enabled for regular usage.
 
+### `MB_METABOT_ICON`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: `metabot`
+- [Exported as](../installation-and-operation/serialization): `metabot-icon`.
+- [Configuration file name](./config-file): `metabot-icon`
+
+The icon for Metabot. Set to `metabot` for the default icon, or a data URI for a custom uploaded image (up to 1MB).
+
+### `MB_METABOT_LIMIT_RESET_RATE`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: keyword
+- Default: `monthly`
+- [Exported as](../installation-and-operation/serialization): `metabot-limit-reset-rate`.
+- [Configuration file name](./config-file): `metabot-limit-reset-rate`
+
+How often Metabot usage limits reset: `daily`, `weekly`, or `monthly`.
+
+### `MB_METABOT_LIMIT_UNIT`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: keyword
+- Default: `tokens`
+- [Exported as](../installation-and-operation/serialization): `metabot-limit-unit`.
+- [Configuration file name](./config-file): `metabot-limit-unit`
+
+The unit used for Metabot usage limits: `tokens` or `messages`.
+
+### `MB_METABOT_NAME`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: `Metabot`
+- [Exported as](../installation-and-operation/serialization): `metabot-name`.
+- [Configuration file name](./config-file): `metabot-name`
+
+The display name for Metabot, shown throughout the Metabase UI.
+
+### `MB_METABOT_NLQ_SYSTEM_PROMPT`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: ``
+- [Exported as](../installation-and-operation/serialization): `metabot-nlq-system-prompt`.
+- [Configuration file name](./config-file): `metabot-nlq-system-prompt`
+
+Custom instructions appended to Metabot's system prompt for the natural language query (AI exploration) experience.
+
+### `MB_METABOT_QUOTA_REACHED_MESSAGE`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: `You have reached your AI usage limit for the current period. Please contact your administrator.`
+- [Exported as](../installation-and-operation/serialization): `metabot-quota-reached-message`.
+- [Configuration file name](./config-file): `metabot-quota-reached-message`
+
+The message shown to users when they reach their usage quota.
+
 ### `MB_METABOT_RECENT_VIEWS_ENABLED`
 
 - Type: boolean
 - Default: `true`
 
 Whether the user's recently viewed items are included in the Metabot system prompt.
 
+### `MB_METABOT_SHOW_ILLUSTRATIONS`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: boolean
+- Default: `true`
+- [Exported as](../installation-and-operation/serialization): `metabot-show-illustrations`.
+- [Configuration file name](./config-file): `metabot-show-illustrations`
+
+Whether to show Metabot illustrations in the UI.
+
 ### `MB_METABOT_SLACK_SIGNING_SECRET`
 
 - Type: string
@@ -1582,6 +1681,17 @@ Whether the user's recently viewed items are included in the Metabot system prom
 
 Signing secret for verifying requests from the Metabot Slack app.
 
+### `MB_METABOT_SQL_SYSTEM_PROMPT`
+
+> Only available on Metabase [Pro](/product/pro) and [Enterprise](/product/enterprise) plans.
+
+- Type: string
+- Default: ``
+- [Exported as](../installation-and-operation/serialization): `metabot-sql-system-prompt`.
+- [Configuration file name](./config-file): `metabot-sql-system-prompt`
+
+Custom instructions appended to Metabot's system prompt for the SQL generation experience.
+
 ### `MB_MFA_CHALLENGE_SIGNING_KEY`
 
 - Type: string
@@ -2638,6 +2748,19 @@ Cron schedule (in UTC) for usage metadata batch processing.
 
 Note: Sandboxed users will never see suggestions.
 
+### `MB_WAREHOUSE_ALLOWED_NETWORKS`
+
+- Type: keyword
+- Default: `null`
+
+Controls which networks Metabase may connect to for warehouse connections.
+Options:
+- external-only (only globally routable public addresses)
+- allow-private (external + private networks but NOT loopback or link-local)
+- allow-all (no restrictions).
+Defaults to external-only on Metabase Cloud and allow-all when self-hosted.
+Also covers the SSH tunnel host and the database auth-provider URLs.
+
 ## Other environment variables
 
 The following environment variables can only be set via the environment. They cannot be set by the configuration file.

diff --git a/_docs/latest/permissions/impersonation.md b/_docs/latest/permissions/impersonation.md
@@ -178,6 +178,16 @@ If instead you want to give a group SQL access to some, but not all, of the sche
 
 Connection impersonation doesn't apply to people in the Metabase Admins group, as their more permissive privileges take precedence.
 
+## Impersonated queries must be a single SELECT statement
+
+When people with impersonated access use the native SQL editor, they will only be able to write queries with a single select statement. Metabase will check each native query before running it and reject anything that isn't a single `SELECT` statement. Common table expressions (`WITH`) and set operations (`UNION`, `INTERSECT`, `EXCEPT`) count as a single `SELECT` statement, so those queries will run.
+
+Examples of queries Metabase will reject:
+
+- Multiple statements separated by semicolons, like `SET ROLE analyst; SELECT * FROM people;`
+- Statements that create or change tables, including temporary tables (`CREATE`, `ALTER`, `DROP`)
+- Role-switching statements like `SET ROLE` or `USE ROLE`
+
 ## Metabase gives people the most permissive access to data across all of their groups
 
 So if a person is in two groups with different permissions for the same database:

diff --git a/_docs/latest/questions/native-editor/writing-sql.md b/_docs/latest/questions/native-editor/writing-sql.md
@@ -103,16 +103,18 @@ You can use [Snippets](snippets) to save, reuse, and share SQL code across multi
 
 When you run a query from the SQL editor, Metabase sends the query to your database exactly as it is written. Any results or errors displayed in Metabase are the same as the results or errors that you would get if you ran the query directly against your database. If the SQL syntax of your query doesn’t match the SQL dialect used by your database, your database won’t be able to run the query.
 
-## The native query editor is designed for reading data, not writing it
+## SQL commands the editor doesn't support
 
-The native SQL editor is designed for asking questions about your data. Don't use the editor for:
+The native SQL editor is designed for asking questions about your data. The editor doesn't support:
 
 - Multi-statement queries
 - Stored procedures and function calls
 - DDL statements (like `CREATE`, `ALTER`, or `DROP`)
 
 Depending on your connection's privileges, some of the above actions may work, but none are officially supported, and we recommend against using the native query editor for these tasks.
 
+On databases that use [impersonation](../../permissions/impersonation), Metabase enforces this: queries must be a single `SELECT` statement, and Metabase will reject multi-statement queries, temporary tables, and DDL.
+
 ## Question version history
 
 For questions, [dashboards](../../dashboards/start), and [models](../../data-modeling/models), Metabase keeps a version history for the previous fifteen versions of that item.

diff --git a/_docs/v0.63/ai/settings.md b/_docs/v0.63/ai/settings.md
@@ -66,8 +66,10 @@ You can specify your own API key and model for Metabot from one of the supported
 - **Amazon Bedrock**: Claude and GPT models.
 - **Anthropic**: Claude models (Opus, Sonnet, Haiku, and Fable).
 - **Microsoft Azure**: Your own Azure deployments of Claude or GPT models. Enter the deployment name you configured in Azure.
+- **Mistral**
 - **OpenAI**: GPT models.
-- **OpenRouter**: Claude and GPT models.
+- **OpenRouter**: Claude, GPT, Mistral, DeepSeek, and GLM-5.2 models.
+- **Z.AI**: GLM-5.2 models.
 
 If you're interested in Metabase supporting more AI providers or models, let us know by submitting a [feature request](../troubleshooting-guide/requesting-new-features).
 

diff --git a/_docs/v0.63/configuring-metabase/config-template.md b/_docs/v0.63/configuring-metabase/config-template.md
@@ -244,9 +244,19 @@ config:
     map-tile-server-url: https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png
     mcp-apps-cors-custom-origins: ''
     mcp-apps-cors-enabled-clients: []
+    metabot-advanced-permissions: false
+    metabot-chat-system-prompt: ''
     metabot-enabled: true
+    metabot-icon: metabot
+    metabot-limit-reset-rate: monthly
+    metabot-limit-unit: tokens
+    metabot-name: Metabot
+    metabot-nlq-system-prompt: ''
+    metabot-quota-reached-message: You have reached your AI usage limit for the current period. Please contact your administrator.
     metabot-recent-views-enabled: true
+    metabot-show-illustrations: true
     metabot-slack-signing-secret: null
+    metabot-sql-system-prompt: ''
     mfa-challenge-signing-key: null
     mfa-enforcement: 'off'
     native-query-autocomplete-match-style: substring
@@ -355,4 +365,5 @@ config:
     usage-metadata-retention-days: 90
     usage-metadata-schedule: 0 0 2 * * ? *
     user-visibility: all
+    warehouse-allowed-networks: null
 ```