# Use the BigQuery MCP server
This document shows you how to use the BigQuery remote Model Context Protocol (MCP) server to connect with AI applications including Gemini CLI, ChatGPT, Claude, and custom applications you are developing. You can use the BigQuery remote MCP server to perform tasks such as running queries, getting metadata, and listing resources. The BigQuery remote MCP server is enabled when you enable the BigQuery API.
[Model Context Protocol](https://modelcontextprotocol.io/docs/getting-started/intro)
(MCP) standardizes how large language models (LLMs) and AI applications or
agents connect to external data sources. MCP servers let you use their tools,
resources, and prompts to take actions and get updated data from their backend
service.
## What's the difference between local and remote MCP servers?
Local MCP servers
: Typically run on your local machine and use the standard input
and output streams (stdio) for communication between services on the same
device.
Remote MCP servers
: Run on the service's infrastructure and offer an HTTP
endpoint to AI applications for communication between the AI MCP client and
the MCP server. For more information about MCP architecture, see
[MCP architecture](https://modelcontextprotocol.io/docs/learn/architecture).
## Stateless core
With
[MCP version 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28),
MCP changes from a bidirectional, stateful protocol to a stateless protocol.
Each MCP request is self-describing and can be routed using headers. There isn't
a need for the `initialize`/`initialized` handshake or `Mcp-Session-Id` because
each request includes all the information needed in HTTP headers or the `_meta`
parameter. MCP servers can request additional information required by a tool
through
[multi-round-trip requests (MRTR)](https://modelcontextprotocol.io/specification/latest/basic/patterns/mrtr).
To help route and process requests without parsing the request body, some MCP
headers are required, including the following:
- Headers that are required by the MCP specification such as the [protocol version header](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http#protocol-version-header) and [standard request headers](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http#standard-request-headers).
- [Custom headers](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http#custom-headers-from-tool-parameters) that are defined by the MCP server. These headers are mirrored into HTTP headers from the tool's input schema using the `x-mcp-header` property. For example, an MCP server might define a custom header to specify the Google Cloud region or project ID.
For more information about MCP architecture, see the MCP version 2026-07-28
[specification](https://modelcontextprotocol.io/specification/2026-07-28) and
[key changes](https://modelcontextprotocol.io/specification/2026-07-28/changelog).
You might use the BigQuery [local MCP server](https://docs.cloud.google.com/bigquery/docs/pre-built-tools-with-mcp-toolbox)
for the following reasons:
- You need to build a custom tool over a parameterized SQL query.
- You don't have permissions to enable or use the MCP server in your project.
To allow agents access to advanced BigQuery capabilities like
scheduling, permission management, and reservation management, use
the `run_bq_command` tool available under the Cloud CLI MCP server. For
more information, see
[Use the Cloud CLI remote MCP server](https://docs.cloud.google.com/sdk/use-gcloud-mcp).
For more information about how to use our local MCP server, see
[Connect LLMs to BigQuery with MCP](https://docs.cloud.google.com/bigquery/docs/pre-built-tools-with-mcp-toolbox). The
following sections apply only to the BigQuery remote MCP server.
## Google and Google Cloud remote MCP servers
Google and Google Cloud remote MCP servers have the following features and benefits:
- Simplified, centralized discovery
- Managed global or regional HTTP endpoints
- Fine-grained authorization
- Optional prompt and response security with Model Armor protection
- Centralized audit logging
For information about other MCP servers and information about security
and governance controls available for Google Cloud MCP servers,
see [Google Cloud MCP servers overview](https://docs.cloud.google.com/mcp/overview).
## Before you begin
1.
Enable the BigQuery API.
**Roles required to enable APIs**
To enable APIs, you need the `serviceusage.services.enable` permission. If you
created the project, then you likely already have this permission through the
Owner role (`roles/owner`). Otherwise, you can get this permission through the
Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
[Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).
[Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=bigquery.googleapis.com)
For new projects, the BigQuery API is
automatically enabled.
2. Optional: [Enable
billing](https://docs.cloud.google.com/billing/docs/how-to/modify-project) for the project. If you don't want to enable billing or provide a credit card, the steps in this document still work. BigQuery provides you a sandbox to perform the steps. For more information, see [Enable the BigQuery sandbox](https://docs.cloud.google.com/bigquery/docs/sandbox#setup).
> [!NOTE]
> **Note:** If your project has a billing account and you want to use the BigQuery sandbox, then [disable billing for your project](https://docs.cloud.google.com/billing/docs/how-to/modify-project#disable_billing_for_a_project).
### Required roles
To get the permissions that
you need to use the BigQuery MCP server,
ask your administrator to grant you the
following IAM roles on the project where you want to use the BigQuery MCP server:
- Make MCP tool calls: [MCP Tool User](https://docs.cloud.google.com/iam/docs/roles-permissions/mcp#mcp.toolUser) (`roles/mcp.toolUser`)
- Run BigQuery jobs: [BigQuery Job User](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.jobUser) (`roles/bigquery.jobUser`)
- Query BigQuery data: [BigQuery Data Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/bigquery#bigquery.dataViewer) (`roles/bigquery.dataViewer`)
For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).
These predefined roles contain
the permissions required to use the BigQuery MCP server. To see the exact permissions that are
required, expand the **Required permissions** section:
#### Required permissions
The following permissions are required to use the BigQuery MCP server:
- Make MCP tool calls: `mcp.tools.call`
- Run BigQuery jobs: `bigquery.jobs.create`
- Query BigQuery data: `bigquery.tables.getData`
You might also be able to get
these permissions
with [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles) or
other [predefined roles](https://docs.cloud.google.com/iam/docs/roles-overview#predefined).
Additional BigQuery permissions might be required depending
on the task. For information about BigQuery permissions, see
[BigQuery IAM roles and permissions](https://docs.cloud.google.com/bigquery/docs/access-control).
## Authentication and authorization
BigQuery MCP servers use the [OAuth
2.0](https://developers.google.com/identity/protocols/oauth2) protocol with
[IAM](https://docs.cloud.google.com/iam/docs/overview) for authentication and authorization.
All [Google Cloud identities](https://docs.cloud.google.com/docs/authentication/identity-products) are
supported for authentication to MCP servers.
We recommend that you create a separate identity for agents that are using MCP
tools so that access to resources can be controlled and monitored. For more
information about authentication, see
[Authenticate to MCP servers](https://docs.cloud.google.com/mcp/authenticate-mcp).
## BigQuery MCP OAuth scopes
OAuth 2.0 uses scopes and credentials to determine if an authenticated
principal is authorized to take a specific action on a resource. For more
information about OAuth 2.0 scopes at Google, see
[Using OAuth 2.0 to access Google APIs](https://developers.google.com/identity/protocols/oauth2).
BigQuery has the following MCP tool OAuth scopes:
| Scope URI for gcloud CLI | Description |
|---|---|
| `https://www.googleapis.com/auth/bigquery` | View and manage your data in BigQuery and see the email address for your Google Account. |
Additional scopes might be required on the resources accessed during a tool
call. To view a list of scopes required for BigQuery, see
[OAuth 2.0 scopes for BigQuery API v2](https://developers.google.com/identity/protocols/oauth2/scopes#bigquery).
## Configure an MCP client to use the BigQuery MCP server
AI applications and agents, such as Claude or Antigravity, can instantiate an
MCP client that connects to a single MCP server. An AI application can have
multiple clients that connect to different MCP servers.
If your application isn't listed in the
[client-specific guidance](https://docs.cloud.google.com/mcp/configure-mcp-ai-application#client-specific-guidance), then you can use
the following information to connect from most applications.
In your AI application, look for a way to add or connect to a remote MCP server.
For the BigQuery MCP server, enter the following
information as required:
- **Server name**: BigQuery MCP server
- **Server URL** or **Endpoint**: https://bigquery.googleapis.com/mcp
- **Transport** : [Streamable HTTP](https://modelcontextprotocol.io/specification/latest/basic/transports/streamable-http)
- **Authentication details**: your Google Cloud credentials, your
OAuth Client ID and secret, or an agent identity and credentials
Which authentication details you choose depend on how you want to
authenticate. For more information, see
[Authenticate to MCP servers](https://docs.cloud.google.com/mcp/authenticate-mcp).
### Redirect URIs
For web-based applications, and some desktop applications, you must allowlist a
redirect URI when you create a client ID and secret for authentication.
Redirect URIs are used by the authorization server to send tokens
to your application. Your application's documentation should specify the
redirect URI that you must use. [Custom redirect URIs](https://developers.google.com/identity/protocols/oauth2/native-app#redirect-uri_custom-scheme)
aren't supported.
For application-specific guidance about setting up and connecting to MCP server,
see [Client-specific guidance](https://docs.cloud.google.com/mcp/configure-mcp-ai-application#client-specific-guidance).
For more general guidance, see the following resources:
- [Connect to remote MCP servers](https://modelcontextprotocol.io/docs/develop/connect-remote-servers).
- [Configure MCP in an AI application](https://docs.cloud.google.com/mcp/configure-mcp-ai-application).
## Available tools
To view details of available MCP tools and their descriptions for the
BigQuery MCP server, see the [BigQuery MCP
reference](https://docs.cloud.google.com/bigquery/docs/reference/mcp).
### Limitations
The BigQuery MCP tools are subject to the following limitations:
- The [`execute_sql`](https://docs.cloud.google.com/bigquery/docs/reference/mcp/tools_list/execute_sql) and [`execute_sql_readonly`](https://docs.cloud.google.com/bigquery/docs/reference/mcp/tools_list/execute_sql_readonly) tools don't support querying Google Drive external tables.
- By default, the `execute_sql` and `execute_sql_readonly` tools limit query processing time to three minutes. Queries that run longer than three minutes are automatically canceled.
- Query results are limited to a maximum of 3,000 rows.
- The `execute_sql_readonly` tool allows only read-only operations on the data. Mutations such as DML statements, DDL statements, and Python UDFs aren't supported.
- The `execute_sql_readonly` tool doesn't support queries that use Graph Query Language (GQL).
### List tools
Use the [MCP inspector](https://modelcontextprotocol.io/docs/tools/inspector) to list tools, or send a
`tools/list` HTTP request directly to the BigQuery MCP server.
The `tools/list` method doesn't require authentication.
POST /mcp HTTP/1.1
Host: bigquery.googleapis.com
Content-Type: application/json
{
"jsonrpc": "2.0",
"method": "tools/list",
}
### Deny access to read-write tools
The only MCP tool that isn't read-only is `execute_sql`. You can restrict access
to the `execute_sql` tool by creating a [deny policy that restricts read-write
MCP tool use](https://docs.cloud.google.com/mcp/control-mcp-use-iam#deny_read-write_mcp_tool_use).
## Sample use cases
The following are sample use cases for the BigQuery MCP server:
- Build workflows that use insights from BigQuery data to
trigger certain actions such as creating issues and composing emails.
- Use BigQuery's advanced capabilities like forecasting
for higher-order insights.
- Build a conversational experience for your users with custom agent
instructions.
- Chat with your [graph](https://docs.cloud.google.com/bigquery/docs/graph-overview) data using GQL.
### Sample prompts
You can use the following sample prompts to get information about
BigQuery resources, gain insights, and analyze
BigQuery data:
- "List the datasets in project `PROJECT_ID`."
- "Find all the queries that I ran in project `PROJECT_ID` using the MCP server in the `REGION` region. Use the tag `goog-mcp-server:true` to identify the query jobs that ran through the MCP server."
- "Find the top orders by volume from `DATASET_ID` in project `PROJECT_ID`. Identify the appropriate tables, find the correct schema, and show the results."
- "Create a forecast on the table `PROJECT_ID`.`DATASET_ID`.`TABLE_ID` for future years. Use `COLUMN_NAME` as the data column and `COLUMN_NAME` as the timestamp column. Show the top 10 forecasts."
In the prompts, replace the following:
- `PROJECT_ID`: the Google Cloud project ID
- `REGION`: the name of the region
- `DATASET_ID`: the name of the dataset
- `TABLE_ID`: the name of the table
- `COLUMN_NAME`: the name of the column
## Optional security and safety configurations
MCP introduces new security risks and considerations due to the wide variety of
actions that you can do with the MCP tools. To minimize and manage these risks,
Google Cloud offers default settings and customizable
policies to control the use of MCP tools in your Google Cloud
organization or project.
For more information about MCP security and governance, see
[AI security and safety](https://docs.cloud.google.com/mcp/ai-security-safety).
### Use Model Armor
[Model Armor](https://docs.cloud.google.com/model-armor/overview) is a
Google Cloud service designed to enhance the security and
safety of your AI applications. It works by proactively screening LLM prompts
and responses, protecting against various risks and supporting responsible AI
practices. Whether you are deploying AI in your cloud environment, or on
external cloud providers, Model Armor can help
you prevent malicious input, verify content safety, protect sensitive data,
maintain compliance, and enforce your AI safety and security policies
consistently across your diverse AI landscape.
When Model Armor is enabled with
[logging enabled](https://docs.cloud.google.com/model-armor/configure-logging), Model Armor logs the entire
payload. This might expose sensitive information in your logs.
#### MCP request routing to Model Armor
Model Armor is available in [certain regions](https://docs.cloud.google.com/model-armor/locations). When Model Armor is enabled and you use an MCP server in a jurisdiction that Model Armor doesn't support, the routing behavior of the call might be different for different MCP servers and might break data residency compliance for in-use and in-transit data. For more information about the behavior of individual MCP servers, see [Model Armor supported products](https://docs.cloud.google.com/mcp/model-armor-supported-products).
#### Enable Model Armor
You must enable Model Armor APIs before you can use Model Armor.
### Console
1.
Enable the Model Armor API.
**Roles required to enable APIs**
To enable APIs, you need the `serviceusage.services.enable` permission. If you
created the project, then you likely already have this permission through the
Owner role (`roles/owner`). Otherwise, you can get this permission through the
Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
[Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).
[Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=modelarmor.googleapis.com)
2. Select the project where you want to activate Model Armor.
### gcloud
Before you begin, follow these steps using the Google Cloud CLI with the
Model Armor API:
1.
In the Google Cloud console, activate Cloud Shell.
[Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)
At the bottom of the Google Cloud console, a
[Cloud Shell](https://docs.cloud.google.com/shell/docs/how-cloud-shell-works)
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
2.
Run the following command to set the API endpoint for the
Model Armor service.
```bash
gcloud config set api_endpoint_overrides/modelarmor "https://modelarmor.LOCATION.rep.googleapis.com/"
```
Replace `LOCATION` with the region where you want to use
Model Armor.
#### Configure protection for Google and Google Cloud remote MCP servers
To help protect your MCP tool calls and responses you can use
Model Armor floor settings. A floor setting defines the minimum
security filters that apply across the project. This configuration applies a
consistent set of filters to all MCP tool calls and responses within
the project.
> [!TIP]
> **Tip:** Don't enable the prompt injection and jailbreak filter unless your MCP traffic carries natural language data.
Set up a Model Armor floor setting with MCP sanitization
enabled. For more information, see [Configure Model Armor floor
settings](https://docs.cloud.google.com/model-armor/configure-floor-settings).
> [!NOTE]
> **Note:** If the agent and the MCP server are in different projects, you can create floor settings in both projects (the client project and the resource project). In this case, Model Armor is invoked twice, once for each project.
See the following example command:
```bash
gcloud model-armor floorsettings update \
--full-uri='projects/PROJECT_ID/locations/global/floorSetting' \
--enable-floor-setting-enforcement=TRUE \
--add-integrated-services=GOOGLE_MCP_SERVER \
--google-mcp-server-enforcement-type=INSPECT_AND_BLOCK \
--enable-google-mcp-server-cloud-logging \
--malicious-uri-filter-settings-enforcement=ENABLED \
--add-rai-settings-filters='[{"confidenceLevel": "MEDIUM_AND_ABOVE", "filterType": "DANGEROUS"}]'
```
Replace `PROJECT_ID` with your Google Cloud project ID.
Note the following settings:
- `INSPECT_AND_BLOCK`: The enforcement type that inspects content for the Google MCP server and blocks prompts and responses that match the filters.
- `ENABLED`: The setting that enables a filter or enforcement.
- `MEDIUM_AND_ABOVE`: The confidence level for the Responsible AI - Dangerous filter settings. You can modify this setting, though lower values might result in more false positives. For more information, see [Model Armor confidence levels](https://docs.cloud.google.com/model-armor/overview#ma-confidence-levels).
#### Disable scanning MCP traffic with Model Armor
To stop Model Armor from automatically scanning traffic to and
from Google MCP servers based on the project's floor settings, run the following
command:
gcloud model-armor floorsettings update \
--full-uri='projects/PROJECT_ID/locations/global/floorSetting' \
--remove-integrated-services=GOOGLE_MCP_SERVER
Replace `PROJECT_ID` with the Google Cloud project
ID. Model Armor doesn't automatically apply the rules defined in
this project's floor settings to any Google MCP server traffic.
Model Armor floor settings and general configuration can impact
more than just MCP. Because Model Armor integrates with services
like Vertex AI, any changes you make to floor settings can affect
traffic scanning and safety behaviors across all integrated services, not just
MCP.
### Control MCP use with IAM policies
Identity and Access Management (IAM)
[deny policies](https://docs.cloud.google.com/iam/docs/deny-overview) and
[allow policies](https://docs.cloud.google.com/iam/docs/allow-policies) help you
secure Google Cloud and Google MCP servers.
You can combine multiple criteria to build customized security and governance
policies by allowing or denying access based on the following:
- The principal.
- Tool properties like the read-only attribute.
- The service name or tool name.
- The application's OAuth client ID.
For more information, see
[Control MCP use with Identity and Access Management](https://docs.cloud.google.com/mcp/control-mcp-use-iam).
## Quotas and limits
The BigQuery MCP server doesn't have its own quotas. There
is no limit on the number of calls that can be made to the MCP server.
You are still subject to the quotas enforced by the APIs called by the MCP
server tools. The following API methods are called by the MCP server tools:
| Tool | API method | Quotas |
|---|---|---|
| `list_dataset_ids` | [`datasets.list`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/datasets/list) | [Dataset quotas and limits](https://docs.cloud.google.com/bigquery/quotas#dataset_limits) |
| `list_table_ids` | [`tables.list`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/tables/list) | [Table quotas and limits](https://docs.cloud.google.com/bigquery/quotas#table_limits) |
| `get_dataset_info` | [`datasets.get`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/datasets/get) | [Dataset quotas and limits](https://docs.cloud.google.com/bigquery/quotas#dataset_limits) |
| `get_table_info` | [`tables.get`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/tables/get) | [Table quotas and limits](https://docs.cloud.google.com/bigquery/quotas#table_limits) |
| `execute_sql` | [`jobs.Query`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/jobs/query) | [Query job quotas and limits](https://docs.cloud.google.com/bigquery/quotas#query_jobs) |
| `execute_sql_readonly` | [`jobs.Query`](https://docs.cloud.google.com/bigquery/docs/reference/rest/v2/jobs/query) | [Query job quotas and limits](https://docs.cloud.google.com/bigquery/quotas#query_jobs) |
For more information on BigQuery quotas, see
[Quotas and limits](https://docs.cloud.google.com/bigquery/quotas).
## What's next
- See the [BigQuery MCP reference documentation](https://docs.cloud.google.com/bigquery/docs/reference/mcp).
- Learn more about [Google Cloud MCP servers](https://docs.cloud.google.com/mcp/overview).
- See the MCP [supported products](https://docs.cloud.google.com/mcp/supported-products).