CData Connect AI MCP server icon

CData Connect AI

by CData Connect AI

HIPAA CompliantSOC2 ReadyISO 27001 Ready
Data & Research12 tools

Run SQL against 318 documented enterprise data sources from an AI agent. The 12 tools Anthropic lists are a SQL dispatcher, not a verb list — the reachable surface is whatever SQL your connections permit, including INSERT, UPDATE and DELETE.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect CData Connect AI via MCP

https://mcp.cloud.cdata.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

CData Connect AI Tools & Capabilities (12)

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • The tool count is not the surface. Two of the 12 names take SQL as an argument. Counting verbs across the names produces "12 read, 0 write, 0 delete", and that figure is wrong in the way that matters most.
  • No OAuth scope separates reading from writing. Four identity claims are all the server advertises. The Select/Insert/Update/Delete/Execute boundary is real but lives in CData's admin UI, invisible and unenforceable from any MCP client.
  • Blocking a tool in Claude is coarse. queryData carries SELECT and DELETE alike; there is no setting that keeps one and drops the other.
  • We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request on 2026-08-22, so no parameter detail or destructiveHint is published here.
  • CData publishes no single authoritative tool list. Its MCP page names 8 tools, Anthropic's directory names 12, and its OpenAPI ops enum names 12 different operations. The three disagree, and the disagreement is concentrated in the write operations.
  • Server instructions are not enforcement. A toolkit's guardrail text is prose read by a model, and update_toolkit_server_instructions can rewrite it.
  • Toolkits need a paid plan. CData states MCP toolkits are available to Growth+ customers only and that only administrators can create and configure custom tools — so the strongest scoping control is unavailable on lower plans.
  • Data Security is early access. CData's documentation asks readers to contact support for access to the redaction and blocking feature, so do not plan around it being present.
  • Query log files expire in seven days. The query log itself persists, but the downloadable per-query detail files do not.
  • Shared credentials are the default. Every user on the account queries a source through the same connection credentials unless an administrator switched that source to per-user authentication.

Frequently asked questions

Yes, if the connection permits it. CData documents INSERT, UPDATE, UPSERT, DELETE and EXECUTE statements against connected sources, and its OpenAPI specification names execute_insert and execute_update as MCP operations. Whether a given agent can use them depends on the Select, Insert, Update, Delete and Execute permissions an administrator set on that connection inside Connect AI.

Far more than twelve. The twelve names Anthropic lists are a SQL dispatcher: queryData forwards arbitrary SQL to any connected source. CData documents 318 data source connectors, and the reachable surface is every table, view and stored procedure across every connection your account holds, multiplied by the SQL verbs permitted.

No. The server's RFC 9728 descriptor and its authentication challenge both advertise exactly four scopes: openid, profile, email and offline_access. All four are identity claims. Nothing at the MCP consent step separates reading a row from deleting one, so the boundary lives entirely in CData's own per-connection permissions.

Yes, where the connection grants Delete permission. CData documents DELETE and DELETE SELECT statements, the latter deleting multiple rows from a temporary table in one request. Its per-connection permissions list Delete as a separate toggle, which is CData's own acknowledgement that deletion is reachable through this SQL surface and needs gating.

A second MCP server at mcp.cloud.cdata.com/mcp/mgmt that Anthropic's directory does not list. CData documents eighteen administrative tools on it, including create_connection, which saves new credentials for another data source, and set_tool_op_enabled, which turns individual operations on or off inside a toolkit.

By default, yes. CData states that all users on an account access a data source through the same login credentials, so a Salesforce connection made by one administrator serves everyone. Some sources support per-user authentication instead, but CData notes this is not available for every source and only administrators can switch it on.

Yes, in two separate logs. CData's query log records the timestamp, query type, user, status, connection and full query text for every query, and a separate audit log records administrative tasks such as user creation and permission changes. Downloadable per-query log files are retained for seven days only.

At least one configured data source. CData's Claude setup page lists connecting a data source to your Connect AI account as the prerequisite, because the connector has no data of its own. Toolkits, which scope the MCP surface to chosen connections and operations, additionally require a Growth+ plan and administrator rights.

Sources

Use in Agentman

Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Server Info

Category
Data & Research
Developer
CData Connect AI
Tools
12
Domain
mcp.cloud.cdata.com

Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.