MotherDuck

Query a serverless DuckDB warehouse.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the MotherDuck connector does

The MotherDuck MCP server connects a serverless DuckDB data warehouse to Claude, ChatGPT and any MCP-compatible agent. It runs SQL against your databases, explores schemas, searches the catalogue and builds Dives — interactive saved visualisations. Two of its tools execute arbitrary SQL, one of them read-write, which sets the risk profile for everything else.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

MotherDuck tools (15)

  • list_databases
  • list_shares
  • list_tables
  • list_columns
  • search_catalog
  • query
  • ask_docs_question
  • query_rw
  • get_dive_guide
  • save_dive
  • read_dive
  • update_dive
  • delete_dive
  • list_dives
  • share_dive_data

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • Two tools execute arbitrary SQL. Inside query and query_rw the read/write distinction is a property of the SQL string, not of the tool. query_rw will run DROP as readily as SELECT.
  • There is no read-only server mode. MotherDuck's three documented approaches are client-side tool blocking, a read-scaling token, and proxy filtering. Only the token enforces server-side, and it costs you the OAuth flow and introduces replica lag of a few minutes.
  • One application scope. read:databases is the only non-identity scope either the resource or its authorization server advertises, on a connector Anthropic's directory labels "Read and write". A consent screen cannot express read-only here.
  • Result and time caps. Both SQL tools return at most 2,048 rows and 50,000 characters, and queries are cancelled server-side after 55 seconds. search_catalog returns at most 100 results.
  • Query results transit MotherDuck's MCP server. MotherDuck states data is processed in your organisation's region but results pass through the regional MCP server, routed by where the client runs — for a web agent, that is the agent provider's location, not yours.
  • No extension installation. MotherDuck's published server instructions list twelve pre-installed DuckDB extensions and state that on-the-fly installation is not available.
  • Cost is the real ceiling. There is no documented request rate limit. The free Lite plan includes 10 compute-unit hours and 10 GB of storage per month; beyond that, compute and storage are pay-as-you-go, and Advanced AI Functions carry a soft default of 10 AI Units per day.
  • We could not read tool schemas or annotations. The endpoint returns 401 to an anonymous request, so no tools/list response was seen and no safety annotation is reported here. Tool names come from Anthropic's directory and MotherDuck's reference; parameters come from the reference.
  • The open-source repository is a different server. motherduckdb/mcp-server-motherduck is the

Frequently asked questions

Does the MotherDuck MCP server run arbitrary SQL against my warehouse?

Yes, through two tools. `query` takes a raw DuckDB SQL string and MotherDuck restricts it to read-only statements, rejecting anything that modifies data with a ForbiddenQueryError. `query_rw` takes the same free-text SQL with no verb restriction, so INSERT, UPDATE, DELETE, DROP TABLE and CREATE DATABASE all run through it. Neither tool constrains which tables you touch.

Does the MotherDuck MCP server have a read-only mode?

No. MotherDuck documents three ways to restrict it and none is a server mode, so the tool list never changes. You either block `query_rw` in your MCP client, authenticate with a read-scaling token whose replicas reject writes at the database, or filter tool calls in your own proxy. Only the read-scaling token enforces anything server-side.

Can the connector read the actual rows in my tables, not just the schema?

Yes, through SQL. A SELECT issued via `query` or `query_rw` returns real table rows, capped at 2,048 rows and 50,000 characters per call. The catalogue tools do not: `list_tables`, `list_columns` and `search_catalog` return names, types and comments only. Reading customer data always goes through one of the two SQL tools.

How many tools does the MotherDuck MCP server actually have?

MotherDuck documents 39 and Anthropic's directory lists 15. The 15 are an exact subset of the 39, with no renamed or invented names in either direction. The 24 the directory omits are the Flight tools, which create schedule and run Python jobs on MotherDuck compute, the Guide tools, and three catalogue tools. Both figures were retrieved on 2026-08-21.

What can the MotherDuck connector delete?

Three things, and one of them is unbounded. `delete_dive` permanently removes a saved Dive and MotherDuck states it cannot be recovered. Undocumented in the directory listing, `delete_flight` and `delete_guide` remove scheduled jobs and Guide documents. Beyond those, `query_rw` accepts DROP TABLE and DROP DATABASE as ordinary SQL, so its blast radius is whatever your token can reach.

Do I need a paid MotherDuck plan to use the MCP server?

No. MotherDuck's prerequisites are a MotherDuck account and an MCP-compatible client, and the free Lite plan includes 10 compute-unit hours and 10 GB of storage per month. Dives carry no additional charge on any plan. Compute and storage beyond the included allowance are billed pay-as-you-go, so an agent running many queries has a cost consequence rather than a hard cap.

Which OAuth scopes does the MotherDuck MCP server request?

Five, of which only one is an application scope. The resource descriptor at api.motherduck.com advertises `openid`, `profile`, `email`, `offline_access` and `read:databases`. Four of those are OIDC identity and refresh scopes. That leaves a single coarse application grant on a connector that also writes, so the consent screen offers nothing meaningful to narrow.

Sources

More Data & Research connectors

  • Airfield Directory

    Look up airfields, landing fees, fuel prices, pilot reports and METAR/TAF from an AI agent.

  • Airtable

    Read, write and restructure Airtable bases from your AI assistant.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put MotherDuck to work.

Connect MotherDuck once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio