Most ERPNext teams that adopt Metabase end up running two parallel worlds. Finance and ops live in ERPNext Desk all day, but every time someone needs a real dashboard — cohort trends, contribution margin, inventory ageing across warehouses — they alt-tab to a separate Metabase tab, log in again, and hope the filters they see match their ERPNext permissions. ERPNext's native Number Cards, Dashboard Charts, and Report Builder are fine for single-DocType counts and simple aggregates, but they run out of road on multi-join SQL, materialized models, drill-through, and the polished visual layer that Metabase gives you for free. The result is dashboard sprawl, duplicated access management, and BI that nobody trusts because the row-level scoping is done by hand.

This build-to-order app closes that gap by making Metabase a first-class citizen of ERPNext Desk. We build a proper Frappe app (its own module, DocTypes, and hooks.py) that renders your Metabase dashboards inside Desk workspaces via Metabase signed embedding — not a naked public iFrame. A whitelisted server method mints a short-lived, JWT-signed embed URL per request, injecting locked parameters derived from the logged-in ERPNext user: their company, allowed warehouses, cost centers, territory, or any dimension you nominate. Because the parameters are signed server-side and locked, a user physically cannot widen their own view by editing the URL. A Metabase Dashboard DocType acts as the catalog — each row maps a Metabase dashboard ID to an ERPNext workspace, a set of allowed Role Profiles, and the parameter-to-permission mapping — so adding or retiring a dashboard is a data change, not a redeploy.

Technically, the app leans on the parts of Frappe that are built for exactly this. Access is gated through standard ERPNext permissions and Role Profiles, so the dashboard catalog respects the same roles as the rest of your site. A one-click "provision read-only access" action calls a whitelisted method that creates and grants a least-privilege, read-only Postgres/MariaDB user scoped to the reporting views Metabase should see — no more hand-editing pg_hba or sharing the site's app credentials with the BI tool. SSO pass-through means a user already authenticated in ERPNext lands in the embedded dashboard without a second login prompt. Optional hooks.py doc events and scheduler_events can trigger Metabase cache refreshes or sync new users into a Metabase group when their ERPNext role changes. Everything is exposed cleanly through the Frappe REST API and whitelisted methods, and the whole app targets Frappe/ERPNext v15 and v16.

Because this is build-to-order, nothing ships until we agree on scope. It starts with a short scoping call where we map which dashboards go where, which ERPNext dimensions drive the signed filters, and how read-only access should be provisioned against your database and Metabase instance. From confirmed scope, typical delivery is one working week: we build on a staging copy of your site, run UAT with your team against real dashboards and real permissions, and only then install on production behind a rollback plan. You receive the full source, a git repo handover, install and configuration docs, a user guide, a training session, and a post-go-live support window — so your team owns and can extend the app, not just rent it.