MCP Toolbox for Databases

Google runs a remote BigQuery MCP server at https://bigquery.googleapis.com/mcp. It turns on when you enable the BigQuery API, signs in with Google Cloud IAM and OAuth 2.0, and lets an agent list datasets and tables, read schemas and run SQL. One tool, execute_sql_readonly, only allows SELECT statements. We checked Google's docs on 31 October 2026.

Quick facts

Two things carry the same name, so we separate them. The first is the remote server, run by Google and the one Google's docs point to first. The second is the local route, where you run MCP Toolbox for Databases yourself with a BigQuery configuration. We cover both.

What it does

Google's page says you can use the remote server "to perform tasks such as running queries, getting metadata, and listing resources", from clients including Antigravity, ChatGPT, Claude and custom apps. In practice an agent finds the right table, reads its schema, writes a query and reads the result.

The tool list on Google's reference page, as we read it:

The reference page also lists get_query_results, cancel_job and get_job, which cover long-running jobs: fetching results, cancelling and checking a job.

The tool descriptions steer the agent toward in-warehouse work. For forecasting, anomaly detection, key-driver analysis, classification and text generation, they tell the model to use BigQuery's AI.FORECAST, AI.DETECT_ANOMALIES, AI.KEY_DRIVERS, AI.CLASSIFY and AI.GENERATE functions rather than exporting rows to a local sandbox. That keeps data in place and scales, and it also means the agent writes SQL that calls AI functions, which may cost more than a plain SELECT. Check function pricing before you let an agent loop.

What it costs

We found no separate MCP charge on the pages we read. The costs are BigQuery's own: query processing and storage under your pricing model, and any AI function usage. Check BigQuery's pricing page for current on-demand and capacity rates. Google's page also says the MCP server has no quotas of its own, while the underlying APIs keep theirs.

The money risk is a large scan. BigQuery on-demand pricing bills by data processed, so SELECT * over a huge table is expensive. The docs do not describe a per-query byte cap for the MCP tools, though BigQuery itself supports maximum bytes billed settings and quotas. Set project-level quotas as a backstop.

Google's tools tag the jobs they run. The sample prompts mention the label goog-mcp-server:true, which identifies query jobs that ran through the MCP server, so you can find and total them afterwards.

Limits from Google's docs

• execute_sql and execute_sql_readonly cannot query Google Drive external tables.
• Queries are cancelled after three minutes by default.
• Results are capped at 3,000 rows.
• execute_sql_readonly allows only read operations. DML, DDL and Python UDFs are not supported, and neither is Graph Query Language.

Three minutes and 3,000 rows are plenty for exploration and poor for exports. An agent that needs a full table should write to a destination table or use an export, not stream rows through chat.

Set it up

Project and roles

1. Create or choose a Google Cloud project, with billing or the BigQuery sandbox.
2. Enable the BigQuery API. That enables the remote MCP server.
3. Grant the roles on the project:

The permissions behind them are mcp.tools.call, bigquery.jobs.create and bigquery.tables.getData. Google notes additional permissions may be needed for a task.

Use a separate identity

Google's advice is direct: "We recommend that you create a separate identity for agents that are using MCP tools so that access to resources can be controlled and monitored." Make a service account or agent identity for this, grant it Data Viewer only on the datasets the agent needs, and keep Job User at the project level.

Generic client settings

From Google's page, for any client with a remote-server option:

Custom redirect URIs are not supported, so web and desktop clients must use the redirect URI the client documents.

Install it in each agent

Google's page names Antigravity, ChatGPT and Claude, and gives generic settings for others. The lines below are our adaptation from the generic values and each agent's own docs. See MCP clients for how these agents name fields.

Claude Code

Our adaptation:

claude mcp add --transport http bigquery https://bigquery.googleapis.com/mcp

Then run /mcp and authenticate. Google's page says the server uses OAuth 2.0 with IAM, and that clients can use your Google Cloud credentials, your own OAuth client ID and secret, or an agent identity. We did not test each agent's sign-in, so expect to supply your own OAuth client in some of them.

Codex

Our adaptation, in ~/.codex/config.toml:

[mcp_servers.bigquery]
url = "https://bigquery.googleapis.com/mcp"

Then codex mcp login bigquery. We did not test Codex against Google's OAuth.

Cursor

Our adaptation, in ~/.cursor/mcp.json:

{
  "mcpServers": {
    "bigquery": { "url": "https://bigquery.googleapis.com/mcp" }
  }
}

Antigravity

Google names Antigravity as a supported client. The config-file form, our adaptation, goes in ~/.gemini/config/mcp_config.json with the Streamable HTTP URL in serverUrl:

{
  "mcpServers": {
    "bigquery": { "serverUrl": "https://bigquery.googleapis.com/mcp" }
  }
}

Google's setup page has a client-specific guide that names Antigravity; follow it for how credentials are passed. Gemini CLI is now Code Assist enterprise only.

OpenCode

Our adaptation, in opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bigquery": {
      "type": "remote",
      "url": "https://bigquery.googleapis.com/mcp",
      "oauth": {}
    }
  }
}

Google's page does not mention OpenCode, so this block is our adaptation and untested.

The local route: MCP Toolbox for Databases

Google's page says you might choose a local server when you need a custom tool over a parameterized SQL query, or when you do not have permission to enable or use the remote server in your project. The local server is MCP Toolbox for Databases (googleapis/mcp-toolbox, Apache-2.0, renamed from genai-toolbox). Its README lists BigQuery among prebuilt database targets:

{
  "mcpServers": {
    "toolbox-bigquery": {
      "command": "npx",
      "args": ["-y", "@toolbox-sdk/server", "--prebuilt=bigquery", "--stdio"],
      "env": { "BIGQUERY_PROJECT": "your-project-id" }
    }
  }
}

The --prebuilt=postgres form is the README's own example, and we swapped the target. Look up the environment variable names for the BigQuery configuration in the Toolbox docs. The README also says prebuilt tools are available in the Antigravity MCP Store with click-to-install, and that you can load one toolset with the --prebuilt=<database>/<toolset> form.

Security notes

Google's docs give more governance detail than most vendors, and it is worth using.

• Least privilege. Use a dedicated identity. Data Viewer on specific datasets, not the whole project.
• Block writes. The only tool that is not read-only is execute_sql. Google says you can restrict it with a deny policy for read-write MCP tool use. Do that, and let agents use execute_sql_readonly.
• Centralized audit logging. Google lists it as a feature of its remote MCP servers, and the goog-mcp-server:true job label helps you find the queries.
• Model Armor. Google offers Model Armor to screen prompts and responses for malicious input and sensitive data. It is optional, and the docs warn about behaviour in jurisdictions it does not support, which can affect data residency.
• Data leaves BigQuery. Query results go to the model provider. Mask or exclude columns with personal data. BigQuery column-level security and policy tags still apply to your identity.
• Prompt injection. Table contents can be written by outsiders, such as form text or reviews. A row that tells the model to run execute_sql is a real risk if writes are allowed.
• Cost. Use quotas and maximum bytes billed on the project.
• The 2026-07-28 protocol. Google's page notes the MCP protocol moved to a stateless design with required headers. Older clients may not support it, so check your agent's release notes.

Example prompts

Google's samples, shortened:

Limits and known issues

• Three-minute query timeout and 3,000-row cap.
• No Google Drive external table queries.
• GQL is not supported on the read-only tool.
• The remote server needs the API enabled and IAM roles granted by an administrator, which blocks some users.
• Client support for Google's OAuth flow may vary, and we did not test each agent.
• Advanced features, such as scheduling, permission management and reservations, are not in this server. Google points to the run_bq_command tool in the Google Cloud CLI MCP server for those.

Alternatives

Our take

For BigQuery on Google Cloud, the remote server is the cleanest route we have read about. Managed endpoint, IAM instead of passwords, a separate read-only SQL tool, a deny-policy switch for the one write tool, audit logs and a job label for tracing. Google has thought about the failure modes.

The weak points are practical. Setup needs someone with rights to enable the API and grant roles. Client support for Google's OAuth is uneven across agents, so expect to test. And cost control is on you: quotas and bytes-billed limits, because an agent that writes a wide scan can spend real money in one query.

Our plan: dedicated identity, Data Viewer on named datasets, deny execute_sql, set a project quota, then try one question on a small table.

This is our reading of the documentation, not a hands-on test.

A short setup checklist

1. Choose a project and enable the BigQuery API.
2. Create a service account or agent identity for the agent.
3. Grant MCP Tool User, Job User and Data Viewer on named datasets.
4. Create a deny policy for execute_sql.
5. Set project quotas and a maximum bytes billed.
6. Add the endpoint to your agent and authenticate.
7. Ask it to list datasets, then query a small table.
8. Check the goog-mcp-server:true jobs afterwards.

See also the MCP server list and best MCP servers.

Frequently asked questions

What is the BigQuery MCP server URL?

https://bigquery.googleapis.com/mcp, over Streamable HTTP, enabled with the BigQuery API.

Which IAM roles do I need?

MCP Tool User, BigQuery Job User and BigQuery Data Viewer on the project, plus more for some tasks.

Can I make it read-only?

Yes. Use execute_sql_readonly and deny execute_sql with a policy.

Are there query limits?

Three minutes by default and 3,000 result rows, per Google's docs.

Is there a local, open-source option?

Yes, MCP Toolbox for Databases under Apache-2.0 has a prebuilt BigQuery setup.