MotherDuck
by MotherDuck
Query a serverless DuckDB warehouse from an AI agent. Two tools run arbitrary SQL, one of them read-write, and the connector has no read-only mode — restriction is client-side blocking or a read-scaling token.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect MotherDuck via MCP
https://api.motherduck.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
MotherDuck Tools & Capabilities (15)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Two tools execute arbitrary SQL. Inside
queryandquery_rwthe read/write distinction is a property of the SQL string, not of the tool.query_rwwill run DROP as readily as SELECT. - There is no read-only server mode. MotherDuck's three documented approaches are client-side tool blocking, a read-scaling token, and proxy filtering. Only the token enforces server-side, and it costs you the OAuth flow and introduces replica lag of a few minutes.
- One application scope.
read:databasesis the only non-identity scope either the resource or its authorization server advertises, on a connector Anthropic's directory labels "Read and write". A consent screen cannot express read-only here. - Result and time caps. Both SQL tools return at most 2,048 rows and 50,000 characters, and queries are cancelled server-side after 55 seconds.
search_catalogreturns at most 100 results. - Query results transit MotherDuck's MCP server. MotherDuck states data is processed in your organisation's region but results pass through the regional MCP server, routed by where the client runs — for a web agent, that is the agent provider's location, not yours.
- No extension installation. MotherDuck's published server instructions list twelve pre-installed DuckDB extensions and state that on-the-fly installation is not available.
- Cost is the real ceiling. There is no documented request rate limit. The free Lite plan includes 10 compute-unit hours and 10 GB of storage per month; beyond that, compute and storage are pay-as-you-go, and Advanced AI Functions carry a soft default of 10 AI Units per day.
- We could not read tool schemas or annotations. The endpoint returns 401 to an anonymous request, so no
tools/listresponse was seen and no safety annotation is reported here. Tool names come from Anthropic's directory and MotherDuck's reference; parameters come from the reference. - The open-source repository is a different server.
motherduckdb/mcp-server-motherduckis the
Frequently asked questions
Does the MotherDuck MCP server run arbitrary SQL against my warehouse?
Yes, through two tools. `query` takes a raw DuckDB SQL string and MotherDuck restricts it to read-only statements, rejecting anything that modifies data with a ForbiddenQueryError. `query_rw` takes the same free-text SQL with no verb restriction, so INSERT, UPDATE, DELETE, DROP TABLE and CREATE DATABASE all run through it. Neither tool constrains which tables you touch.
Does the MotherDuck MCP server have a read-only mode?
No. MotherDuck documents three ways to restrict it and none is a server mode, so the tool list never changes. You either block `query_rw` in your MCP client, authenticate with a read-scaling token whose replicas reject writes at the database, or filter tool calls in your own proxy. Only the read-scaling token enforces anything server-side.
Can the connector read the actual rows in my tables, not just the schema?
Yes, through SQL. A SELECT issued via `query` or `query_rw` returns real table rows, capped at 2,048 rows and 50,000 characters per call. The catalogue tools do not: `list_tables`, `list_columns` and `search_catalog` return names, types and comments only. Reading customer data always goes through one of the two SQL tools.
How many tools does the MotherDuck MCP server actually have?
MotherDuck documents 39 and Anthropic's directory lists 15. The 15 are an exact subset of the 39, with no renamed or invented names in either direction. The 24 the directory omits are the Flight tools, which create schedule and run Python jobs on MotherDuck compute, the Guide tools, and three catalogue tools. Both figures were retrieved on 2026-08-21.
What can the MotherDuck connector delete?
Three things, and one of them is unbounded. `delete_dive` permanently removes a saved Dive and MotherDuck states it cannot be recovered. Undocumented in the directory listing, `delete_flight` and `delete_guide` remove scheduled jobs and Guide documents. Beyond those, `query_rw` accepts DROP TABLE and DROP DATABASE as ordinary SQL, so its blast radius is whatever your token can reach.
Do I need a paid MotherDuck plan to use the MCP server?
No. MotherDuck's prerequisites are a MotherDuck account and an MCP-compatible client, and the free Lite plan includes 10 compute-unit hours and 10 GB of storage per month. Dives carry no additional charge on any plan. Compute and storage beyond the included allowance are billed pay-as-you-go, so an agent running many queries has a cost consequence rather than a hard cap.
Which OAuth scopes does the MotherDuck MCP server request?
Five, of which only one is an application scope. The resource descriptor at api.motherduck.com advertises `openid`, `profile`, `email`, `offline_access` and `read:databases`. Four of those are OIDC identity and refresh scopes. That leaves a single coarse application grant on a connector that also writes, so the consent screen offers nothing meaningful to narrow.
Sources
- MotherDuck MCP server reference, full corpus (retrieved 2026-08-21) · retrieved 2026-08-21
- MotherDuck MCP server overview (retrieved 2026-08-21) · retrieved 2026-08-21
- Restricting to read-only access (retrieved 2026-08-21) · retrieved 2026-08-21
- Connect to the MotherDuck MCP Server (retrieved 2026-08-21) · retrieved 2026-08-21
- Using the MotherDuck MCP Server (retrieved 2026-08-21) · retrieved 2026-08-21
- MotherDuck published MCP server instructions (retrieved 2026-08-21) · retrieved 2026-08-21
- MotherDuck pricing and plans (retrieved 2026-08-21) · retrieved 2026-08-21
- Live OAuth posture check: anonymous POST to the endpoint returned 401 with a
www-authenticatechallenge, and the RFC 9728 descriptor atapi.motherduck.com/.well-known/oauth-protected-resource/mcpreturned 200 (2026-08-21) · retrieved 2026-08-21 - Local MCP server source,
motherduckdb/mcp-server-motherducktagv1.0.8(retrieved 2026-08-21) · retrieved 2026-08-21 - Anthropic Connectors Directory entry (snapshot 2026-08-16) · retrieved 2026-08-16
- MotherDuck support — · Privacy
motherduck.com/robots.txtcarriesContent-Signal: ai-train=yes, search=yes, ai-input=yes— synthesis is expressly permitted (retrieved 2026-08-21) · retrieved 2026-08-21
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Data & Research
- Developer
- MotherDuck
- Tools
- 15
- Domain
- api.motherduck.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.