Skip to main content
Glama
io.github.0xmortuex/duckdb-mcp

io.github.0xmortuex/duckdb-mcp

by 0xmortuex

duckdb-mcp

Let your AI agent run SQL over your local CSV, Parquet and JSON files, without giving it the keys to your disk.

duckdb-mcp is an MCP server that points DuckDB at the data files in folders you choose. The agent lists the files, looks at their columns, profiles them and runs SQL. It is built to be safe by default:

  • Read-only. One SELECT-type statement per call. INSERT, CREATE, COPY, ATTACH, INSTALL/LOAD, EXPORT, SET and PRAGMA are rejected before they run.

  • Confined to the folders you allow. DuckDB's own allowed_directories is set, external access is switched off and the configuration is locked, so read_csv('C:/Windows/win.ini'), ../ traversal, junction/symlink escapes, URLs and extension downloads all fail. This is tested, not assumed.

  • Bounded. Results stop at 1000 rows (with a clear TRUNCATED notice) and every query has a 30 second limit. Results are streamed, so SELECT * on a million-row file returns instantly.

  • Nothing to set up. DuckDB runs in memory inside the server process. No database file, no service, no network.

What it looks like

Real output from a stdio session against a small orders.csv:

> describe_file orders.csv
File: orders.csv  (csv, 180 B)
Rows: 5    Columns: 5

| column | type |
| --- | --- |
| order_id | BIGINT |
| customer | VARCHAR |
| country | VARCHAR |
| amount | DOUBLE |
| placed_at | DATE |

> query "SELECT country, count(*) AS orders, round(sum(amount),2) AS revenue FROM 'orders.csv' GROUP BY 1 ORDER BY 3 DESC"
| country | orders | revenue |
| --- | --- | --- |
| US | 2 | 380.0 |
| UK | 2 | 135.75 |
| FI | 1 | NULL |

3 rows, 3 columns.

> query "SELECT * FROM read_csv('C:/Users/me/secret.csv')"        (a file outside the allowed folders)
Error: Permission Error: Cannot access file "C:/Users/me/secret.csv" - file system operations are disabled by configuration
File access is limited to the allowed folders: C:/Users/me/data. Call list_files to see the queryable files.

> query "COPY (SELECT 1) TO 'x.csv'"
Error: COPY statements are blocked: this server is read-only. Allowed: SELECT / WITH / VALUES / FROM, DESCRIBE, SUMMARIZE, SHOW and EXPLAIN.

Related MCP server: mcp-duckdb-analyst

Install

You need uv. Replace the path with the folder that holds your data.

Claude Code

claude mcp add duckdb -- uvx duckdb-mcp --dir "C:\Users\me\data"

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "duckdb": {
      "command": "uvx",
      "args": ["duckdb-mcp", "--dir", "C:\\Users\\me\\data"]
    }
  }
}

Or with pip: pip install duckdb-mcp, then run duckdb-mcp --dir PATH.

Choosing the folders

Option

Meaning

--dir PATH

A folder whose data files may be queried. Repeat it for several folders.

DUCKDB_MCP_DIRS

Same thing as an environment variable, separated by ; on Windows and : elsewhere. Used when no --dir is given.

(nothing)

The server's current working directory.

--max-rows N

Row cap per result (default 1000).

--timeout S

Seconds a query may run (default 30).

Subfolders are included. Files are named relative to their folder, or by absolute path.

Tools

Tool

What it does

list_files

Data files in the allowed folders, with type and size. Optional glob pattern.

describe_file

Column names and types, the row count and sample rows of one file.

profile_file

Per column: type, null %, approximate distinct count, min, max, average, median and the three most common values.

sample_file

The first N rows, or a random sample.

query

One read-only SQL statement. Output as a markdown table (default), CSV or JSON.

explain_query

The execution plan, optionally with run-time statistics (analyze=true).

Supported files: .csv, .tsv, .parquet, .json, .ndjson, .jsonl, and .gz of the text formats. In SQL, name a file as FROM 'sales.csv', read_csv('sales.csv'), read_parquet('2024/*.parquet') or read_json_auto('events.ndjson'). Joins across files work: SELECT * FROM 'a.csv' JOIN 'b.parquet' USING (id).

Excel (.xlsx) is not supported: DuckDB's Excel reader is an extension that has to be downloaded, and this server deliberately turns extension loading off. Export the sheet to CSV first.

Try asking

  • "What data files do I have? Describe the biggest one."

  • "Profile orders.csv and tell me which columns have data quality problems."

  • "Which five customers spent the most last quarter?"

  • "Join users.parquet with events.ndjson and show daily active users for March."

  • "Is the status column ever empty? How many distinct values does it have?"

  • "Explain why this query is slow" (it will use explain_query).

Security

What is enforced, and by what:

Threat

Defence

Reading files outside the allowed folders (C:/Windows/..., /etc/passwd, ../.., UNC paths, a sibling folder with the same name prefix)

DuckDB allowed_directories + enable_external_access=false. DuckDB resolves .. and junctions/symlinks, so those are refused too.

Network access (read_csv('https://...'), INSTALL httpfs)

enable_external_access=false; extension auto-install and auto-load are off.

Undoing the above from SQL

The statement gate rejects SET. Independently, DuckDB refuses to re-enable external access or change allowed_directories once access is off, and lock_configuration=true freezes every other setting.

Writing files (COPY ... TO, EXPORT DATABASE, EXPLAIN ANALYZE COPY ...)

DuckDB still allows writes inside allowed folders, so the statement gate only accepts one SELECT-type statement, and an EXPLAIN must wrap a SELECT.

Changing or creating objects (CREATE, INSERT, ATTACH, PRAGMA)

Same gate.

A runaway query

Interrupted after --timeout seconds.

Flooding the model's context

Row cap, and cells longer than 200 characters are shortened.

What it does not do:

  • It cannot stop a query from using CPU and memory up to the time limit (DuckDB's memory spill goes to a private temp folder).

  • An allowed folder is readable in full. Do not allow a folder that holds secrets.

  • For convenience, a quoted literal that names an existing data file in an allowed folder is replaced by that file's full path before the query runs. So WHERE name = 'orders.csv' compares against the full path when orders.csv exists. If you need the plain text, build it: 'orders' || '.csv'. Reads are always enforced by DuckDB, whatever the rewrite does.

  • There are no per-user accounts; whoever can talk to the server can query the allowed folders.

Development

uv sync --extra test
uv run ruff check src tests && uv run mypy --strict src
uv run pytest tests

Tests use real files and real DuckDB: the sandbox suite attempts the escapes listed above, a 1,000,000-row CSV/Parquet test checks streaming and the row cap (and measures peak memory in a child process), and a stdio test launches the installed server and talks MCP to it.

Want to know how it works? duckdb-mcp-the-hard-way builds a minimal version step by step.

License

MIT

Available Tools

6 tools
describe_fileA

Show a file's schema (column names and types), its row count and a few sample rows.

path is relative to an allowed folder (as list_files shows it) or absolute inside one. Column types are DuckDB's auto-detected types, which is what SQL will see. The row count of a CSV/JSON file needs a full scan; Parquet answers from metadata. Use this before writing a query, to get exact column names.

NameRequiredDescriptionDefault
pathYes
sample_rowsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that the row count requires a full scan on CSV/JSON but comes from metadata for Parquet, and that column types are DuckDB's auto-detected types (which is what SQL will see). It does not state the read-only/error behavior or what happens with an invalid path, but the cost and type-fidelity disclosures are genuinely valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The output shape and main use case are front-loaded in the opening sentence, with path semantics and scan-cost caveats following in short, purposeful lines. Nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the cost and type caveats are covered for a read-only inspection tool. The one real gap is the undocumented `sample_rows` control, which an agent must guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain both parameters, and it covers `path` well (relative to an allowed folder as `list_files` shows it, or absolute inside one). It never explains the `sample_rows` parameter — not its name, default of 5, or whether 0 disables sampling — leaving one of two parameters fully undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence gives a specific verb and resource: it shows a file's schema (column names and types), row count, and sample rows. That is clearly distinct from a raw query tool, but it is not differentiated from the overlapping siblings `sample_file` and `profile_file`, which the description never mentions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use this before writing a query, to get exact column names" gives a clear trigger condition for choosing this tool. However, it never names an alternative or a when-not-to-use case, even though `profile_file` and `sample_file` sit right next to it in the sibling list and appear to overlap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_queryA

Show DuckDB's execution plan for a SELECT query without returning its rows.

Useful to check whether a filter is pushed down into a Parquet scan, or why a query is slow. With analyze=true the query is actually executed and per-operator timings and row counts are included (still read-only, still time-limited). Same SQL rules and file naming as query.

NameRequiredDescriptionDefault
sqlYes
analyzeNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the safety burden and does so: it declares the operation read-only, states it is time-limited, and warns that analyze=true actually executes the query (a real cost/side-effect disclosure) while returning timings and row counts. What it omits is the concrete time limit and any error/failure behavior, so not a full 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the core action and scope, then motivation, then the analyze=false/true distinction. Nothing is padding; even 'still read-only, still time-limited' adds reassurance tied to the executing mode.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the description covers the essential behavior for a two-parameter read/explain tool. Gaps are minor: no statement of the actual time limit, and the 'file naming' reference assumes familiarity with the file-oriented siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate and largely does: analyze=true is explained with its exact effect (executes the query, adds per-operator timings and row counts) and its default-off implication. The `sql` parameter gets only the indirect hint 'Same SQL rules and file naming as `query`', leaving the expected SQL dialect/statement form partly inferred from a sibling.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Show DuckDB's execution plan for a SELECT query') plus the key scope qualifier ('without returning its rows'), which cleanly separates it from the `query` sibling that does return rows. An agent can pick between them without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-to-use contexts ('check whether a filter is pushed down into a Parquet scan, or why a query is slow') and implicitly routes row-fetching to `query` via 'without returning its rows'. It lacks an explicit when-not-to-use statement or a pointer naming `query` as the alternative action, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_filesA

List the data files you can query (CSV, TSV, Parquet, JSON, NDJSON, optionally .gz).

Shows each file's path relative to its allowed folder, its type and size. Use this first: those paths can be used directly in SQL, e.g. SELECT * FROM 'sales.csv'. Optional pattern is a case-insensitive glob on the path, e.g. '2024' or 'logs/*.json'. At most 500 files are shown.

NameRequiredDescriptionDefault
patternNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description does real work: it discloses supported formats, the .gz variant, that paths are relative to an allowed folder, what metadata is returned (type, size), and a hard result cap of 500 files. It never states read-only/safety semantics implicitly assumed by 'list', but nothing is misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action, then format list, then return shape, then the workflow instruction, then the parameter detail. Every sentence adds usable information and none restates the title or name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be spelled out, yet the description still previews path/type/size and the 500-file truncation limit that an agent must know to interpret results. For a one-parameter, non-destructive discovery tool, nothing an agent needs is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for `pattern`, and it does: a case-insensitive glob applied to the path, with two concrete examples ('*2024*', 'logs/*.json'). It omits what the empty default does, which is the only meaningful gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List the data files you can query'), enumerates the supported formats, and positions itself in the workflow with 'Use this first', which implicitly distinguishes it from downstream siblings like profile_file, sample_file, describe_file and query.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear when-to-use guidance ('Use this first') and explains the payoff ('those paths can be used directly in SQL, e.g. SELECT * FROM ''sales.csv'''), which is exactly the routing information an agent needs. It stops short of naming alternatives or exclusions, e.g. that an already-known path makes this call unnecessary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

profile_fileA

Profile each column of a file in one pass: type, null %, approximate distinct count, min, max, average, median and the three most common values.

Use it to spot data-quality problems (many nulls, constant columns, odd ranges) before analysing. columns limits it to named columns; otherwise the first 50 columns are profiled. On a very large file this scans everything and can hit the time limit - then profile fewer columns.

NameRequiredDescriptionDefault
pathYes
columnsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does disclose real behavioral traits: full-file scan cost, risk of hitting the time limit on very large files, and the default 50-column cap. It does not state permissions/side-effect profile or that the distinct count is an estimate beyond the parameter naming, leaving a modest gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the output contract, then usage, then a performance caveat — three sentences, each carrying distinct information. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't restate return values, and the column-limit behavior plus the timeout caveat cover the main invocation risks. Minor omissions: supported file formats/locations and whether the scan is read-only are not stated, but nothing critical to calling it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does for the non-obvious parameter: `columns` restricts profiling to named columns, otherwise the first 50 are used. `path` is left unexplained but is self-evident for a file-profiling tool. Low param count keeps the residual gap small.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource ('Profile each column of a file in one pass') and enumerates exactly what is computed: type, null %, approximate distinct count, min, max, average, median, top three values. That is far more specific than a title restatement. It lacks an explicit contrast with siblings like describe_file or sample_file, so it falls short of the top band.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use it to spot data-quality problems (many nulls, constant columns, odd ranges) before analysing' gives a clear triggering context. The large-file caveat with the fallback ('profile fewer columns') adds actionable guidance. No explicit when-not or named alternative is given, which keeps it out of the 5 band.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryA

Run one read-only SQL statement (DuckDB dialect) over the data files.

Reference files by name: SELECT * FROM 'sales.csv', or read_csv('sales.csv'), read_parquet('dir/*.parquet'), read_json_auto('events.ndjson'). Paths are relative to the allowed folders (see list_files) or absolute inside them. Allowed: SELECT, WITH, VALUES, FROM-first queries, DESCRIBE, SUMMARIZE, SHOW and EXPLAIN. Anything that writes or reaches outside the allowed folders (INSERT, CREATE, COPY, ATTACH, INSTALL, SET, PRAGMA, files elsewhere on disk, URLs) is rejected.

Output is a markdown table by default; format='csv' or 'json' is more compact for big results. Results stop at the server's row cap (default 1000) with a TRUNCATED notice; pass a smaller max_rows to see less. Queries have a time limit. Prefer aggregation (GROUP BY, COUNT, SUM) over fetching raw rows. Use describe_file first for column names.

NameRequiredDescriptionDefault
sqlYes
formatNomarkdown
max_rowsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does it well: it enumerates rejected statement types (INSERT, CREATE, COPY, ATTACH, INSTALL, SET, PRAGMA, URLs, out-of-scope paths), discloses the server row cap default of 1000 with a TRUNCATED notice, and warns of a query time limit. Gaps remain: the time limit is unquantified and error/failure semantics (what the agent sees when a query is rejected) are not described.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, then ordered by what an agent needs next: allowed syntax, rejection rules, output/truncation behavior, and strategy advice. Sentence count is high but each one carries a distinct constraint or affordance; nothing merely restates the name or schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return value structure needn't be spelled out, and the description still covers formatting and truncation. It is nearly complete for a query tool; the missing pieces are error/retry behavior and any note on whether the row cap can be raised.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and does: it explains that format='csv' or 'json' is more compact for big results, and that max_rows can be set smaller to see less against a 1000-row default cap. For the required sql parameter it supplies dialect, allowed statement forms, and file-reference syntax (read_csv, read_parquet glob, read_json_auto, quoted table names).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, resource and execution engine ("Run one read-only SQL statement (DuckDB dialect) over the data files"), so an agent knows exactly what this does versus profiling, sampling or explaining. It also names sibling context (list_files for folders) that anchors the tool in the toolset.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives strong when-to-use guidance: prefer aggregation with GROUP BY/COUNT/SUM over fetching raw rows, and "use describe_file first for column names" is an explicit prerequisite step. It stops short of routing to explain_query, sample_file or profile_file for cases where this tool is the wrong choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sample_fileA

Show a few rows of a file: the first rows (mode='head') or a random sample (mode='random', scans the whole file). Cheaper than describe_file when you only want to see the data. rows is 1 to 100.

NameRequiredDescriptionDefault
modeNohead
pathYes
rowsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description does real work: it discloses that mode='random' scans the entire file, which is a substantial cost signal an agent would otherwise miss, and frames the tool as cheaper than describe_file. It does not state that the tool is strictly read-only or what happens with files that cannot be parsed, so a small gap remains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the purpose and mode semantics before the cost comparison. Every clause carries information; there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the definition covers the mode cost tradeoff and the rows bound. What is missing is whether head mode truncates a large file or whether sampling errors out on unreadable files, which would matter for a three-parameter data-inspection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it largely does: it defines the meaning of both enum values for mode and states the inclusive bounds for rows (1 to 100). Only path is left unexplained, which is a minor omission given its obviousness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb plus resource ('Show a few rows of a file') and immediately disambiguates the two operating modes, head vs random. It also names the sibling tool it is not (describe_file), so an agent can distinguish intent without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit selection rule against a named sibling: use this instead of describe_file when you only want to see the data, since it is cheaper. There is no explicit 'when not to use' guidance (e.g. when you need types or row counts, use profile_file), but the positive routing is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observeddescribe_file
    • First observedexplain_query
    • First observedlist_files
    • First observedprofile_file
    • First observedquery
    • First observedsample_file

TDQS

A4.3/5.0

Scored across 6 tools

Disambiguation4/5

Each tool has a distinct role: list_files (discovery), describe_file (schema), profile_file (column statistics), sample_file (row preview), query (SQL), explain_query (plan). The main overlap is that describe_file also returns sample rows and profile_file touches type metadata, but descriptions draw clear boundaries (cheaper sampling, stats vs. schema).

Naming Consistency4/5

Five of six names follow a clean verb_noun pattern (list_files, describe_file, profile_file, sample_file, explain_query). The bare 'query' is the sole deviation but is unambiguous in context.

Tool Count5/5

Six tools is well-scoped for a read-only DuckDB query server, each mapping to a distinct step in the analysis workflow. Nothing feels padded or missing.

Completeness5/5

The read-only analytical lifecycle is fully covered: discover files, inspect schema, sample rows, profile columns, run SQL, and explain plans. No write operations exist, consistent with the explicit read-only design, so there are no dead ends.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Turns a folder of CSV, Parquet, and JSON files into a single SQL-queryable source for AI agents, supporting JOINs across files with read-only sandboxed access.
    6
    19 PyPI
    2
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables read-only analytical access to local CSV, Parquet, JSON files or a DuckDB database through MCP, with table discovery, column profiling, guarded SQL querying, and explain plans for safe use with Claude Desktop and Claude Code.
    8
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables MCP clients like Claude Desktop, Claude Code and Cursor to safely explore local CSV, Excel, Parquet and SQLite files by running guarded read-only DuckDB SQL over a sandboxed data directory. It also supports data profiling, chart generation as image content, and exporting query results, without ever allowing writes or access outside the configured folder.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI assistants to explore and analyse local CSV, Parquet or JSON files through validated read-only SELECT queries, with schema discovery, profiling and query-plan tools. Results are capped, timed, PII-masked and audit-logged inside a locked DuckDB sandbox that cannot write, reach the network or read other files.
    18 PyPI
    MIT