Google Cloud BigQuery

Name: Google Cloud BigQuery MCP Server
Availability: InStock
Author: Google Cloud BigQuery

Data & Research6 tools

Google's BigQuery MCP server exposes 6 tools over OAuth. Five are read-only metadata and query tools; one, execute_sql, runs any statement BigQuery accepts, including DROP. Verified live 2026-08-17.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 17 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Google Cloud BigQuery via MCP

https://bigquery.googleapis.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Google Cloud BigQuery Tools & Capabilities (6)

list_dataset_idsRead-only

List BigQuery dataset IDs in a Google Cloud project. Supports pagination. Use `page_size` to limit results and `page_token` to retrieve next page.

get_dataset_infoRead-only

Get metadata information about a BigQuery dataset.

list_table_idsRead-only

List table ids in a BigQuery dataset. Supports pagination. Use `page_size` to limit results and `page_token` to retrieve next page.

get_table_infoRead-only

Get metadata information about a BigQuery table.

execute_sql_readonlyRead-only

Run a read-only SQL query in the project and return the result. Prefer this tool over `execute_sql` if possible. This tool is restricted to only `SELECT` statements. `INSERT`, `UPDATE`, and `DELETE` statements and stored procedures aren't allowed. If the query doesn't include a `SELECT` statement, an error is returned. For information on creating queries, see the [GoogleSQL documentation](https://cloud.google.com/bigquery/docs/reference/standard-sql/query-syntax). Example Queries: -- Count the number of penguins in each island. SELECT island, COUNT(*) AS population FROM bigquery-public-data.ml_datasets.penguins GROUP BY island -- Evaluate a bigquery ML Model. SELECT * FROM ML.EVALUATE(MODEL `my_dataset.my_model`) -- Evaluate BigQuery ML model on custom data SELECT * FROM ML.EVALUATE(MODEL `my_dataset.my_model`, (SELECT * FROM `my_dataset.my_table`)) -- Predict using BigQuery ML model: SELECT * FROM ML.PREDICT(MODEL `my_dataset.my_model`, (SELECT * FROM `my_dataset.my_table`)) -- Forecast data using AI.FORECAST SELECT * FROM AI.FORECAST(TABLE `project.dataset.my_table`, data_col => 'num_trips', timestamp_col => 'date', id_cols => ['usertype'], horizon => 30) Queries executed using the `execute_sql_readonly` tool will have the job label `goog-mcp-server: true` automatically set. Queries are charged to the project specified in the `projectId` field.

execute_sqlDestructive

Run a SQL query in the project and return the result. Prefer the `execute_sql_readonly` tool if possible. This tool can execute any query that bigquery supports including: * SQL Queries (SELECT, INSERT, UPDATE, DELETE, CREATE, etc.) * AI/ML functions like AI.FORECAST, ML.EVALUATE, ML.PREDICT * Any other query that bigquery supports. Example Queries: -- Insert data into a table. INSERT INTO `my_project.my_dataset`.my_table (name, age) VALUES ('Alice', 30); -- Create a table. CREATE TABLE `my_project.my_dataset`.my_table ( name STRING, age INT64); -- DELETE data from a table. DELETE FROM `my_project.my_dataset`.my_table WHERE name = 'Alice'; -- Create Dataset CREATE SCHEMA `my_project.my_dataset` OPTIONS (location = 'US'); -- Drop table DROP TABLE `my_project.my_dataset`.my_table; -- Drop dataset DROP SCHEMA `my_project.my_dataset`; -- Create Model CREATE OR REPLACE MODEL `my_project.my_dataset.my_model` OPTIONS ( model_type = 'LINEAR_REG' LS_INIT_LEARN_RATE=0.15, L1_REG=1, MAX_ITERATIONS=5, DATA_SPLIT_METHOD='SEQ', DATA_SPLIT_EVAL_FRACTION=0.3, DATA_SPLIT_COL='timestamp') AS SELECT col1, col2, timestamp, label FROM `my_project.my_dataset.my_table`; Queries executed using the `execute_sql` tool will have the job label `goog-mcp-server: true` automatically set. Queries are charged to the project specified in the `projectId` field.

Read from the server on 2026-08-17, including each tool's own safety annotations.

Limits

One tool can destroy data, and it looks like the other one. execute_sql and execute_sql_readonly take identical parameters and return identical output. Only the tool name and the annotations separate them.
No per-query cost cap in the schema. maximumBytesBilled exists in BigQuery's API and is not among the seven input properties the six MCP tools expose. dryRun is the only in-band control.
Results are capped at 3,000 rows. Google's documentation states query results are limited to a maximum of 3,000 rows, so this is not a bulk-export path.
Queries are cancelled after three minutes. Google states both query tools limit processing time to three minutes by default and automatically cancel queries that run longer.
No Google Drive external tables. Google states neither execute_sql nor execute_sql_readonly supports querying Google Drive external tables.
No read-only OAuth scope. All six tools declare the same https://www.googleapis.com/auth/bigquery scope, which Google describes as view *and manage*. Least-privilege has to be expressed in IAM, not in the token.
The server has no quotas of its own. Google states there is no limit on the number of MCP calls; the underlying API quotas still apply, and Google maps each tool to its REST method.
No scheduling, permissions or reservation management. Google directs those tasks to a different server — the run_bq_command tool on the Cloud CLI MCP server — rather than this one.
Deny-policy attributes are CLI-only. Google states resource.service and tool.name are not available in the Google Cloud console and must be managed with the CLI.
tools/list is open to anyone. Google states the method doesn't require authentication, and we confirmed it. Nothing sensitive is exposed — the tool list is identical for every caller — but do not read a successful handshake as a successful connection.
We did not exercise any tool that runs a query. Our check was initialize, tools/list and one deliberately unauthenticated get_dataset_info call to observe the auth challenge. Every behavioural claim above comes from Google's documentation, the tool schemas or the server's own protected-resource descriptors.

Frequently asked questions

Does the BigQuery MCP server require authentication?

Yes, for every tool call. Our anonymous request on 2026-08-17 listed all six tools without a credential, then a call to get_dataset_info returned HTTP 401 and a WWW-Authenticate header. Google's documentation states the tools/list method doesn't require authentication, so discovery is open and execution is not. Tool calls need a Google Cloud OAuth 2.0 token.

Which BigQuery MCP tool can delete data?

execute_sql, and only that one. It is the single tool annotated destructiveHint true and readOnlyHint false, and Google's documentation states it can run any query BigQuery supports, listing DELETE, DROP TABLE and DROP SCHEMA among its own examples. The other five tools, including execute_sql_readonly, are annotated read-only and cannot mutate anything.

What is the difference between execute_sql and execute_sql_readonly?

The permitted statement set. Google's documentation states execute_sql_readonly allows only read-only operations and rejects DML statements, DDL statements and Python UDFs, returning an error when a query contains no SELECT. execute_sql accepts all of those. Both tools take identical parameters and both descriptions tell the caller to prefer the read-only one.

How much does a BigQuery MCP query cost?

Whatever the underlying query costs, on your own project. Google's pricing documentation states on-demand queries bill by bytes processed, and that a LIMIT clause on a non-clustered table does not reduce the bytes read. The tool schema exposes no cost cap, so a single agent-written query can scan far more than the returned rows suggest.

Can I stop an agent from writing to BigQuery through MCP?

Yes, with an IAM deny policy. Google exposes tool.isReadOnly as a deny-policy attribute and publishes a policy that denies mcp.googleapis.com/tools.call whenever that attribute is false. Google's documentation names execute_sql as the only tool such a policy blocks. The deny is server-side, so it holds regardless of which MCP client the agent uses.

Does the BigQuery MCP server have its own rate limits?

No. Google's documentation states the BigQuery MCP server has no quotas of its own and no limit on the number of calls. The underlying REST methods each tool calls still apply their own quotas, and Google maps every tool to its API method. Query results are separately capped at 3,000 rows and three minutes of processing time.

Which OAuth scope does the BigQuery MCP server require?

One scope for all six tools. The server's own protected-resource descriptor, read on 2026-08-17, names https://www.googleapis.com/auth/bigquery for every tool including execute_sql. Google describes that scope as view and manage your data in BigQuery. There is no narrower read-only scope, so scope choice cannot separate the destructive tool from the safe five.