Best for
- Developers and analysts who want to query BigQuery quickly via AI assistants
- Organizations that need to prevent AI agents from modifying data
- Environments with sensitive data that require field-level access restrictions
B
BigQuery MCP Server
Community
Secure, read-only access to BigQuery for LLMs.
GitHub source repository ↗
62FMRS · C
This server provides secure read-only access to BigQuery, ideal for teams that want to use AI for data queries while enforcing strict controls on sensitive data. It defaults to read-only and offers field-level restrictions, adding a layer of safety. However, users must be aware that data is sent to LLM providers and that field restrictions are not a firewall.
BigQuery MCP Server is a Model Context Protocol (MCP) server that provides secure, read-only access to BigQuery datasets. It acts as a translator between AI assistants and your data warehouse, allowing you to query data in natural language. The server only allows SELECT statements; every query is validated by BigQuery's dry-run planner, so INSERT, UPDATE, DELETE, DROP, TRUNCATE, EXPORT DATA, and MERGE are all rejected. It supports configurable query byte limits, field-level access restrictions, and automatic discovery of sensitive columns (e.g., names, emails, SSNs) to prevent AI agents from reading PII, PHI, or financial data.
Tools
The tool list has not been reviewed yet.
Setup
- Ensure you have Node.js 14+ and a Google Cloud project with BigQuery enabled.
- Authenticate with
gcloud auth application-default login. - Add the server to your MCP client config, e.g., for Claude Desktop or Claude Code, use:
{
"mcpServers": {
"bigquery": {
"command": "npx",
"args": ["-y", "@ergut/mcp-bigquery-server", "--project-id", "your-project-id"]
}
}
}
- Restart your client and start chatting.
claude_desktop_config.json
{
"mcpServers": {
"bigquery": {
"command": "npx",
"args": [
"-y",
"@ergut/mcp-bigquery-server",
"--project-id",
"your-project-id"
]
}
}
}
Fit and risk
Not for
- Scenarios requiring write, update, or delete operations
- Users who need unrestricted access to all columns
- Strict security environments that cannot tolerate data leaving the network (since results are sent to LLM providers)
Required permissions
- BigQuery read permissions (e.g., roles/bigquery.user or roles/bigquery.dataViewer)
- For service account auth, access to the service account key file
- For advanced features, permission to list datasets and tables, and run dry-run queries
Risks and side effects
- Data exfiltration: query results are sent to LLM providers (Anthropic, OpenAI) and may leave your network
- Despite field restrictions, AI agents may attempt to infer data through crafted queries
- Misconfiguration may weaken restrictions, e.g., incorrectly setting preventedFields or maximum bytes billed
Troubleshooting
- Check MCP client config and ensure `npx` is available
- Verify Google Cloud authentication: run `gcloud auth application-default login`
- Ensure BigQuery API is enabled and the project ID is correct
- If using a service account, check the key file path
- For Protected Mode, validate config.json exists and is correctly formatted
Use cases
Ask business questions in natural language, e.g., 'What were our top 10 customers last month?'
Explore dataset schemas to identify tables and views.
Analyze data without writing complex SQL, while keeping sensitive data protected.
Supported clients
Claude DesktopFull support
Claude CodeFull support