mcp-clickhouse
mcp-clickhouse
Сервер Model Context Protocol для ClickHouse. Он позволяет MCP-клиенту (Claude Desktop, Claude Code и т.п.) исследовать схемы, выполнять аналитические запросы и управлять базой данных — а поведение полностью контролируется флагами.
Модель безопасности базируется на осведомлённости о типе оператора: каждый SQL-оператор классифицируется как чтение, запись или деструктивный и проверяется в соответствии с текущим режимом доступа. Режим read-only дополнительно выполняет запросы под readonly=1 самого ClickHouse.
Возможности
Обзор и мониторинг — базы данных, таблицы, колонки,
SHOW CREATE, статистика таблиц (parts/rows/bytes), выполняющиеся запросы, метрики сервера, топология кластераЧтение запросов — инструмент
query, который принимает только операторы чтения и ограничен параметромCLICKHOUSE_MAX_ROWSУправление — инструмент
executeдля INSERT/CREATE/ALTER (read-write) и DROP/TRUNCATE/DELETE (admin), каждое действие классифицируетсяРежимы доступа —
read-only→read-write→admin, они выстроены уровнями, чтобы режим никогда не открывал операторы, превышающие его уровеньФлаги безопасности — разрешённые базы данных, защищённые базы данных, блокировка деструктивных операций, лимит строк, dry-run и JSON-журнал аудита (см. ниже)
Related MCP server: clickhouse-mcp-server
Модель безопасности
Аспект | Флаг | По умолчанию | Эффект |
Что может делать сервер? |
|
|
|
Какие базы данных входят в область видимости? |
| (все) | Если задано, операция отказано для других баз данных. |
Какие базы данных никогда не изменяются? |
|
| Читаемые, но никогда не изменяемые. |
Можно ли выполнять деструктивный SQL? |
|
| DROP/TRUNCATE/DELETE/… требуют этого и режима |
Ограничение размера результата |
|
| Жёсткая граница количества строк, возвращаемых модели. |
Предпросмотр без выполнения |
|
| Операторы записи и деструктивные операторы проверяются, записывают намерение и затем возвращаются. |
Журнал аудита |
|
| Для каждой контролируемой операции выводел JSON-строку в stderr. |
Классификация операторов находится в src/sql.ts и построена по принципу fail-safe: ALTER … DELETE/UPDATE считается деструктивным, и всё, что не удаётся разобрать, также деструктивно.
Инструменты
Чтение (read-only+): list_databases, list_tables, describe_table, show_create_table, table_stats, running_queries, server_metrics, cluster_info, query.
Запись/Администрирование (read-write+): execute — запускает одну команду после классификации; для записи требуется режим read-write, для деструктивных — admin + CLICKHOUSE_ALLOW_DELETE.
Использование с вашим MCP-клиентом
Работает с Claude Code, Claude Desktop, Cursor, OpenAI Codex CLI, Windsurf, VS Code (Copilot) и любым другим MCP-клиентом — см. docs/CLIENTS.md для настройки под каждого клиента.
Установка
npm install
npm run buildЗапуск с Claude Desktop / Claude Code
{
"mcpServers": {
"clickhouse": {
"command": "node",
"args": ["/absolute/path/to/mcp-clickhouse/dist/index.js"],
"env": {
"CLICKHOUSE_URL": "http://clickhouse:8123",
"CLICKHOUSE_USER": "readonly",
"CLICKHOUSE_PASSWORD": "…",
"CLICKHOUSE_MODE": "read-only",
"CLICKHOUSE_DATABASE_ALLOWLIST": "analytics"
}
}
}
}Примеры запросов
"Какие таблицы самые большие в базе данных
analytics?""Покажи схему для
eventsи выполни запрос по ежедневным количествам за эту неделю.""Какие запросы сейчас выполняются и потребляют больше всего памяти?"
Разработка
npm run dev
npm test # SQL classification + security policy (30 tests)
npm run typecheckПубликация
Сервер поставляется с server.json для официального реестра MCP и содержит поле mcpName для проверки владельца npm. См. PUBLISHING.md для публикации на npm и в реестре MCP, Smithery, Glama, Cursor и PulseMCP.
Лицензия-бесплатно
MIT-ия.
Available Tools
9 toolscluster_infoCluster infoARead-onlyIdempotent
Cluster topology from system.clusters (shards, replicas, hosts).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the specific system table source and the conceptual content returned, but it does not add broader behavioral context such as authentication requirements, output shape, or edge cases. This is acceptable with strong annotations but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the core concept and avoids filler. Every clause contributes meaning, naming the source and the key aspects of the returned topology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only metadata inspection tool with no output schema, the description is complete. It tells the agent what information is available and from where, and the annotations cover the operational safety profile.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so the baseline is 4. There is nothing for the description to add about parameter meaning, and it does not attempt to invent any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource: cluster topology sourced from system.clusters, with shards, replicas, and hosts as the relevant components. It is distinct from sibling tools like list_tables or server_metrics, but lacks an explicit verb such as 'get' or 'returns', so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool should be used when cluster topology from system.clusters is needed, and the lack of parameters makes prerequisites moot. However, it provides no explicit guidance about when to prefer it over alternatives or any exclusions, leaving usage partly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_tableDescribe tableARead-onlyIdempotent
Column names, types, defaults, and comments for a table.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a read-only, idempotent, non-destructive operation, so the safety profile is covered. The description adds real value by disclosing the content of the response (column names, types, defaults, comments) even though no output schema exists. It omits any note on error behavior or whether views are handled, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with no wasted words, and the key information is front-loaded. It is a noun phrase rather than a sentence, but the trade-off favors brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description carries the return-value burden and does so by listing the fields returned. It is complete enough to call correctly, though it does not clarify relationship to show_create_table or edge cases like missing tables.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both required parameters (database, table) are documented in the schema with clear descriptions. The description adds no additional meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource (a table) and enumerates the returned metadata (column names, types, defaults, comments), so an agent can tell it retrieves schema structure. It lacks an explicit verb and does not distinguish itself from the sibling show_create_table, which likely returns similar DDL information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives. With siblings like list_tables, show_create_table, and table_stats, the agent gets no signal about which to pick for schema inspection versus DDL or statistics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesList databasesARead-onlyIdempotent
List databases and their engines.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only, idempotent, non-destructive, and open-world, which covers the safety profile. The description adds the behavioral detail that the result includes database engines, which is useful context beyond the annotations for a zero-parameter read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, six-word sentence that front-loads the action and resource while adding the one meaningful extra detail ('engines'). There is no wasted text or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless read-only operation, the description plus annotations provide everything an agent needs: what is listed, what fields are returned, and the safety characteristics. No output schema exists, but the description sufficiently indicates the return content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and the input schema fully documents this fact, so the description does not need to add any parameter-related information. Per the baseline for zero-parameter tools, this is appropriately handled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List'), a clear resource ('databases'), and an additional detail ('their engines'), which precisely identifies what the tool does. It is immediately distinguishable from sibling tools like list_tables or describe_table because it targets databases as the resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the verb-resource pairing, so an agent can infer this is the tool to call when it needs to enumerate databases. However, the description provides no explicit when-to-use guidance and does not mention alternatives or exclusions, so it falls short of clearer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesList tablesBRead-onlyIdempotent
List tables in a database with engine, row count, and size.
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false, so safety and mutation behavior are covered. The description adds useful value by naming the returned columns (engine, row count, size), but says nothing about pagination, permissions, or result size limits. With annotations carrying the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the resource and the returned fields are both delivered immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one documented parameter and no output schema, the description tells the agent what it gets back and where the tables live. The only meaningful gap is the absence of sibling disambiguation, which is minor given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter ('database') and schema description coverage is 100%, so the schema already documents it. The phrase 'in a database' reinforces the parameter's role but adds no syntax, format, or scoping detail beyond the schema. Baseline 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (tables in a database), and even previews the returned fields (engine, row count, size). It does not, however, differentiate itself from close siblings like describe_table, show_create_table, or table_stats, which an agent could easily confuse with this one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus alternatives. Given siblings such as list_databases, describe_table, and table_stats, the description should route the agent but instead leaves all timing and exclusion logic to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryRun a read-only queryARead-onlyIdempotent
Run a SELECT/SHOW/DESCRIBE query and return rows. Non-read statements are refused here — use execute (read-write mode) for those. Results are capped at CLICKHOUSE_MAX_ROWS.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | A single read-only SQL statement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/non-destructive, so the safety profile is covered. The description adds meaningful non-annotation behavior: refusal semantics for writes and the result cap (CLICKHOUSE_MAX_ROWS), which tells the agent output may be truncated. Minor gaps remain (error shape, whether the cap is configurable).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences; the capability and the routing rule come first, the result-cap caveat last. Every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does tell the agent that rows are returned and that output is capped, which is the key expectation-setting detail. It could say a bit more about truncation behavior or error responses, but it is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and there is a single `sql` parameter already documented as a read-only statement. The description's mention of SELECT/SHOW/DESCRIBE reinforces but does not go beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (run) plus resource (query) and enumerates the accepted statement classes (SELECT/SHOW/DESCRIBE), so the agent knows exactly what this tool executes. It also names the sibling `execute` as the write-path counterpart, making it easy to distinguish from alternates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the when-not condition (non-read statements are refused) and the alternative to use instead (`execute` in read-write mode). Nothing about tool selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
running_queriesRunning queriesARead-onlyIdempotent
Currently executing queries from system.processes (id, user, elapsed, memory).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds useful context by naming system.processes as the source and indicating the result is a live view of currently executing queries. However, it does not disclose ordering, limits, or potential permission issues.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the core concept and packs the source and returned fields into a compact parenthetical. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only introspection tool with strong annotations, the description is mostly complete: it names the source table and the fields returned. It falls just short of explicitly saying 'returns a list of...' and does not mention ordering, limits, or privileges, which would be more helpful given there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is nothing for the description to explain about parameter usage, and the schema coverage is trivially complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource and scope: currently executing queries from system.processes, including the fields returned (id, user, elapsed, memory). It is unambiguous about what the tool exposes, though it lacks an explicit verb like 'list' and does not explicitly distinguish itself from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus related siblings such as query, server_metrics, or table_stats. The description implies it is for viewing active queries, but it does not state exclusions, prerequisites, or alternative tool routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_metricsServer metricsARead-onlyIdempotent
Non-zero metrics from system.metrics (connections, merges, memory, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, and open-world behavior. The description adds useful behavioral context beyond that by stating that zero-valued metrics are filtered out and naming the source table, which helps an agent understand what results to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that states the source, the filtering behavior, and representative categories. It is front-loaded and contains no filler or repetition of the title/annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only, idempotent tool, the description is sufficient to enable a correct call. No output schema exists, but the tool's simplicity and safe annotation profile mean the agent lacks no essential invocation guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so the baseline of 4 applies. There is no parameter ambiguity, and the description's mention of metric categories provides enough context for what can be explored.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource (system.metrics) and a clear scope (non-zero entries covering connections, merges, memory, etc.). It implies retrieval of server-level metrics, which is enough to distinguish it from siblings like list_databases or cluster_info, though it lacks an explicit verb such as 'list' or 'get'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implicit: an agent would select this tool when it needs server metric values rather than schema, table, or query information. However, the description does not explicitly state when to prefer this over running_queries, cluster_info, or other siblings, nor does it mention exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_create_tableShow CREATE TABLEBRead-onlyIdempotent
Return the full CREATE TABLE statement (schema, engine, settings) for a table.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true and destructiveHint=false, so the safety profile is fully covered. The description adds the useful detail that engine and settings are included in the output, but discloses nothing beyond that about behavior or output size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the returned content is parenthesized at the end for quick scanning. Nothing is padded or repeated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-param read-only tool with no output schema, the description is sufficient: it names the return payload (schema, engine, settings) and the annotation set covers safety. The only missing element is guidance relative to sibling tools like describe_table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with two required string params (database, table), so the schema fully documents the inputs. The description mentions 'a table' but adds no semantics beyond the schema baseline, which is the expected 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('full CREATE TABLE statement') and enumerates what the payload contains (schema, engine, settings). An agent knows exactly what it gets back. It does not, however, distinguish itself from sibling describe_table, which likely overlaps in intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use statement, no prerequisites, and no routing to alternatives. With sibling tools like describe_table and list_tables present, the description never explains when this is preferred over those, leaving the agent to infer from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
table_statsTable statsBRead-onlyIdempotent
Part count, row count, on-disk size, and time range from system.parts.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds useful context by revealing the data comes from system.parts (a ClickHouse system table), but says nothing about permissions, behavior on empty/non-existent tables, or the meaning of 'time range'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence listing the returned metrics with no filler. It is a noun fragment rather than a full sentence and 'time range' is left undefined, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does list the return fields, which partly compensates. However, it omits units, format, and how 'time range' is derived, so an agent lacks enough detail to interpret the response fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters (database, table) are fully documented in the schema at 100% coverage, so the description has no burden to explain them. It adds no parameter-specific information, which is acceptable here but yields only the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the specific measurements returned (part count, row count, on-disk size, time range) and discloses the source table (system.parts), so an agent knows exactly what data comes back. It stops short of differentiating itself from siblings like describe_table or server_metrics, and never explicitly states it operates on a given database/table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives such as describe_table, show_create_table, or server_metrics. The agent must infer that this is the tool for physical/part-level metrics rather than schema or cluster information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.2- Changed
describe_table1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
list_tables1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
query1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
show_create_table1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
table_stats1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
9 tool updates
v0.1.0- First observed
cluster_info - First observed
describe_table - First observed
list_databases - First observed
list_tables - First observed
query - First observed
running_queries - First observed
server_metrics - First observed
show_create_table - First observed
table_stats
TDQS
Scored across 9 tools
Each tool targets a fairly distinct area: table listing, column metadata, DDL, stats, and system introspection. The main overlap is that `query` can also run SHOW/DESCRIBE and thus partially duplicates `describe_table`, `show_create_table`, `list_databases`, and `list_tables`, though dedicated tools provide clearer structured output.
All names are snake_case, but the conventions are mixed: verb_noun forms (`list_tables`, `describe_table`, `show_create_table`), noun phrases (`table_stats`, `cluster_info`, `running_queries`, `server_metrics`), and a lone verb (`query`). Readable but not a predictable pattern.
Nine tools is well-scoped for a ClickHouse introspection and query server. Each tool has a clear place, and there is no obvious bloat or missing category within the read-oriented surface.
Read-side coverage is solid (databases, tables, schema, stats, queries, cluster, metrics). However, the `query` description explicitly says non-read statements must use an `execute` tool, which is absent, leaving writes/DDL as a dead end and creating an inconsistent tool surface.
Maintenance
Related MCP Connectors
Governed access to production AI-agent traces in an existing ClickHouse store.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Hosted BigQuery MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Hosted SQL Server MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Related MCP Servers
- AlicenseBqualityDmaintenanceAn MCP server implementation that enables Claude AI to interact with Clickhouse databases. Features include secure database connections, query execution, read-only mode support, and multi-query capabilities.22MIT
- AlicenseNot gradedqualityCmaintenanceEnables interaction with ClickHouse databases via MCP, providing tools to list databases and tables and execute safe SELECT, SHOW, and DESCRIBE queries.16 npmMIT
- FlicenseAqualityDmaintenanceRead-only MCP server for ClickHouse that allows listing databases and tables, describing schemas, and running SELECT queries.4-
- FlicenseNot gradedqualityDmaintenanceMCP server for executing SQL queries on PostgreSQL and ClickHouse with per-connection allow/deny policies by statement group.-