Skip to main content
Glama
flin-agency

flin-bigquery-mcp

by flin-agency

flin-bigquery-mcp

MCP server for exploring Google BigQuery and running bounded, read-only GoogleSQL queries. Follows the Python/FastMCP, desktop OAuth, multi-account token storage and uv packaging conventions of flin Search Console MCP and flin Keyword Planner MCP.

Mac installation (Claude Desktop)

Download flin-bigquery-mcp-0.1.0-macos.mcpb from the GitHub release and open it with Claude Desktop. You can also use Claude Desktop's local extension installation dialog and select the file.

The installer asks for your Google Desktop OAuth client ID and secret, default billing project, optional BigQuery location, and maximum bytes billed per query (default 1 GiB). Configure Google Cloud as described below before the first data request. Google sign-in opens in the browser when needed.

The extension contains the server source and a dependency lock file. It uses the MCPB uv runtime with Python 3.12, supports Apple Silicon and Intel Macs, and needs internet access on first launch to install Python/dependencies. A current Claude Desktop version with uv extension support is required. The .mcpb is an unsigned local extension, not a notarized macOS application; it does not require administrator access or a separate repository checkout. For other MCP clients, use the PyPI or source configuration below.

Related MCP server: BigQuery MCP Server

Quickstart

  1. Enable the BigQuery API in your Google Cloud project and configure billing for query jobs.

  2. Grant the Google account BigQuery Job User (roles/bigquery.jobUser) on the job/billing project and BigQuery Data Viewer (roles/bigquery.dataViewer) on the datasets to read. Metadata discovery also depends on the account's project/dataset permissions. Avoid using an admin identity.

  3. Configure the OAuth consent screen. For an external app in testing, add your Google account as a test user.

  4. Create an OAuth client of type Desktop app. Use its client ID and secret below. The local loopback callback is managed by the server.

  5. Install uv and clone this repository. Add this entry to your MCP client's configuration:

{
  "mcpServers": {
    "flin-bigquery-mcp": {
      "command": "uv",
      "args": [
        "run", "--directory", "/absolute/path/to/flin-bigquery-mcp",
        "--locked", "flin-bigquery-mcp"
      ],
      "env": {
        "GOOGLE_CLIENT_ID": "your-desktop-client-id",
        "GOOGLE_CLIENT_SECRET": "your-desktop-client-secret",
        "GOOGLE_BIGQUERY_PROJECT": "your-billing-project",
        "GOOGLE_BIGQUERY_LOCATION": "EU"
      }
    }
  }
}

Replace the path and values, then restart the client. health_check checks configuration locally. list_projects or the first data call opens Google sign-in when needed. Tokens are saved locally and refreshed automatically. OAuth waits for up to three minutes; retry the tool if sign-in expires.

This is a local stdio server, usable with clients such as Claude Desktop and Codex that support local MCP processes. No HTTP endpoint or cloud deployment is provisioned.

The published package can be used with "command": "uvx", "args": ["flin-bigquery-mcp@latest"].

Tools

Tool

Purpose

health_check

Local settings and saved-token status; does not verify Google access

list_projects

One page of accessible projects

list_datasets

One page of datasets in a project

get_dataset

Dataset location, description and labels

list_tables

One page of tables and views

get_table

Nested schema, row count, size, partitioning and clustering

preview_table

Bounded rows from a physical table without running a SQL query

dry_run_query

Validate a single SELECT and estimate scanned bytes

run_query

Validate and submit a bounded SELECT; returns a job reference

get_query_results

Poll a query job and page through its results

All data tools support account. Project-specific tools use project_id, falling back to GOOGLE_BIGQUERY_PROJECT. Pass dataset and table IDs separately, without project prefixes. list_projects works without a default project. Query project_id determines where the job is created and billed; fully qualified SQL can read another accessible project.

Example workflow

  1. health_check, then list_projects.

  2. list_datasets, get_dataset (check its location), list_tables, get_table.

  3. preview_table to inspect a few rows, or dry_run_query to estimate a query.

  4. run_query once, then get_query_results with the returned job_id, project_id, location and the same account.

  5. If job_complete is false, poll again later. For subsequent pages, pass next_page_token unchanged. Do not call run_query again to poll.

A parameterized query:

{
  "sql": "SELECT event_name, COUNT(*) AS events FROM `data-project.analytics.events_*` WHERE _TABLE_SUFFIX BETWEEN @start_date AND @end_date GROUP BY event_name ORDER BY events DESC LIMIT 20",
  "project_id": "billing-project",
  "location": "EU",
  "parameters": [
    {"name": "start_date", "type": "STRING", "value": "20261001"},
    {"name": "end_date", "type": "STRING", "value": "20261007"}
  ],
  "maximum_bytes_billed": 1073741824
}

Named scalar parameters are supported; ARRAY/STRUCT parameters are not yet exposed. Result pages contain at most 1,000 rows (default 100); previews default to 20. A page token is tied to its resource/job and account. Results expire according to BigQuery's anonymous result-table retention. Dates/times use ISO strings, NUMERIC/BIGNUMERIC use decimal strings, BYTES use base64, and non-finite floats use strings. Arrays and nested records are preserved. Large STRING/BYTES cells can still produce large responses despite the row limit.

Query controls and permissions

  • Every execution is preceded by a Google BigQuery dry run. Google's parsed statement_type must be SELECT. Scripts, stored procedure calls, DDL, DML, exports and unknown statement types are rejected before execution.

  • Default hard ceiling: 1 GiB (1,073,741,824 bytes) per query. Set GOOGLE_BIGQUERY_MAX_BYTES_BILLED to change it. Tool arguments may lower but cannot raise this ceiling.

  • Both the dry-run estimate and the submitted job are checked/bounded. Estimates may be incomplete for external or federated sources. maximum_bytes_billed limits BigQuery on-demand bytes, not every possible external, remote-function, ML or reservation charge.

  • A SQL LIMIT limits output rows, not scanned bytes. Filter partitions and select only needed columns.

  • run_query is marked non-idempotent and not read-only in MCP annotations because it creates a potentially billable job. Its allowed SQL only reads data. Polling results does not submit new queries.

  • The Google client uses jobs.insert, which requires the https://www.googleapis.com/auth/bigquery scope. That scope is broader than the server's tool surface. IAM permissions are the underlying access boundary; the server deliberately exposes no write operations or user-supplied destination/job configuration.

  • SELECT queries can invoke existing views, routines or remote functions allowed by IAM. SQL classification does not sandbox their downstream effects. Use a dedicated identity with only the intended dataset/job permissions.

  • Query submission uses a generated job ID and disables automatic job re-execution. If a transport error occurs after submission, check BigQuery job history before manually retrying to avoid duplicate charges.

Authentication and settings

Variable

Default / use

GOOGLE_BIGQUERY_AUTH_MODE

oauth; alternatively adc

GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET

Required in OAuth mode

GOOGLE_BIGQUERY_PROJECT

Default metadata and billing/job project; otherwise pass project_id

GOOGLE_BIGQUERY_LOCATION

Optional location (EU, US, or a region); must match the queried data

GOOGLE_BIGQUERY_MAX_BYTES_BILLED

1073741824; positive integer

GOOGLE_BIGQUERY_TOKEN_PATH

Default account's token file

GOOGLE_BIGQUERY_TOKEN_DIR

Named account token directory; defaults to the default token's directory

GOOGLE_BIGQUERY_OAUTH_PORT

0 (available local loopback port)

GOOGLE_APPLICATION_CREDENTIALS

Standard Google ADC credential file setting

Default OAuth token paths:

  • macOS: ~/Library/Application Support/flin-bigquery-mcp/token.json

  • Linux: ~/.config/flin-bigquery-mcp/token.json

  • Windows: %APPDATA%\flin-bigquery-mcp\token.json

Use account: "work" to keep another account in work.json. Account names allow letters, digits, _, -, . and cannot alias the default token file. Tokens are written atomically, with private file permissions on POSIX. Use a private directory owned by your user. Named accounts refer to separate sign-ins, not Google account IDs.

For service accounts, workload identity, or existing gcloud auth application-default login credentials:

{
  "GOOGLE_BIGQUERY_AUTH_MODE": "adc",
  "GOOGLE_BIGQUERY_PROJECT": "your-billing-project",
  "GOOGLE_BIGQUERY_LOCATION": "EU"
}

Optionally set GOOGLE_APPLICATION_CREDENTIALS to a credential file outside the repository. ADC mode does not support named account values. health_check always returns adc_not_checked with ok: false in ADC mode; verify access through a data tool. It never contacts metadata servers or opens a browser to probe ADC. Grant the ADC identity the same minimal BigQuery roles.

Development

uv sync --locked --extra dev
uv run pytest
uv run ruff check src tests scripts mcpb
uv run ruff format --check src tests scripts mcpb
uv build
uv run python scripts/build_mcpb.py
uv run python scripts/check_mcpb.py dist/mcpb

.env.example documents configuration. The server does not implicitly load .env; use client env settings or uv run --env-file .env flin-bigquery-mcp for local development. Never commit credentials or tokens.

Tests run without credentials and mock Google API calls. They cover OAuth refresh/storage, account isolation, query rejection, byte ceilings, pagination, serialization, sanitized errors, and a real stdio MCP handshake/tool call. See testing for the optional live check.

See release instructions, privacy, and support.

Troubleshooting

  • missing_configuration / invalid_configuration: check the selected authentication mode, required OAuth values, project, account name and positive byte ceiling.

  • authentication_required: complete Google sign-in or configure ADC. External OAuth apps in testing may require renewed consent.

  • permission_denied: check API enablement, job-user and data-viewer access, billing and quotas.

  • not_found: check IDs and the returned job location. An EU job cannot be fetched as a US job.

  • query_rejected: use a single SELECT (including CTEs), not a script or write operation.

  • cost_limit_exceeded: reduce scanned columns/date partitions or deliberately change the configured server ceiling.

  • invalid_request: check SQL, parameter types and region. Detailed SQL-bearing upstream errors are deliberately not returned to the model; inspect the Google Cloud console when needed.

Official references

Available Tools

10 tools
dry_run_queryA
Read-onlyIdempotent

Validate a single SELECT and estimate bytes without executing it. Named parameters use @name in SQL.

NameRequiredDescriptionDefault
sqlYes
accountNo
locationNo
parametersNo
project_idNo
maximum_bytes_billedNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely new behavior: this performs validation and returns a byte estimate with no execution, plus the '@name' parameter convention. It stops short of saying what happens on invalid SQL or whether the estimate is an upper bound.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core capability, no filler. The parameter convention note earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the annotations carry the safety profile. However, for a 6-parameter tool with zero schema coverage, key semantics (account/location/project_id scoping, maximum_bytes_billed behavior, error behavior on invalid SQL) are left entirely unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% — sql, account, location, project_id, and maximum_bytes_billed are all undocumented in both schema and description. The one compensating detail ('Named parameters use @name in SQL') is valuable for the parameters array but leaves five parameters unexplained, so the description does not fill the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource: 'Validate a single SELECT and estimate bytes without executing it.' The 'without executing it' clause implicitly separates it from the run_query sibling, though it never names that sibling. The 'single SELECT' constraint also usefully narrows scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'without executing it' phrasing implies this is a pre-flight check before run_query, but the description never states when to use this versus run_query directly, nor any prerequisites. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_datasetB
Read-onlyIdempotent

Get dataset location, description and labels. dataset_id must not include the project prefix.

NameRequiredDescriptionDefault
accountNo
dataset_idYes
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered by structured data. The description adds a useful format constraint ('dataset_id must not include the project prefix') but says nothing about behavior on a missing dataset, permission requirements for cross-project access, or how the openWorldHint manifests.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero filler; the return-field summary comes first and the parameter constraint follows. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the read-only annotations cover the risk profile. However, with two undocumented parameters and no note on behavior when the dataset is absent or inaccessible, an agent still lacks enough to invoke it confidently across accounts and projects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, yet it only clarifies one of three parameters: the dataset_id must omit the project prefix. The 'account' and 'project_id' parameters are left completely unexplained in both schema and description, which is a meaningful gap for a cross-project BigQuery lookup.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('dataset') and names the returned fields (location, description, labels), which separates it from siblings like list_datasets and get_table. It does not explicitly contrast itself with those siblings, but the resource and return scope make the intent unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to call this versus list_datasets, get_table, or preview_table, and no prerequisites or error conditions. The only guidance-like content is the dataset_id format constraint, which is a parameter rule rather than a when-to-use signal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_query_resultsA
Read-onlyIdempotent

Poll a query job or read one result page. Reuse project_id, location and account from submission.

If job_complete is false, call again later. Pass next_page_token unchanged to read the next page. NUMERIC values are decimal strings, dates are ISO strings, bytes are base64 strings.

NameRequiredDescriptionDefault
job_idYes
accountNo
locationNo
page_sizeNo
page_tokenNo
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive, so the safety profile is covered. The description adds real behavioral context the annotations don't: the polling loop signal (job_complete false → call again), the pagination contract (pass next_page_token unchanged), and type encodings (NUMERIC as decimal strings, bytes as base64).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the core action, then the polling rule, then the paging/encoding details. No wasted text and each sentence conveys an actionable constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return structure needn't be explained; the description still usefully notes how NUMERIC/dates/bytes are represented. Combined with polling and pagination guidance this covers most of what a 6-param job tool needs, with only page_size behavior left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the parameter burden. It explains how account, location, and project_id should be populated (reuse from submission) and that page_token pages forward, but page_size (with its 1–1000 bounds) and job_id are never described, leaving real gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair and resource: 'Poll a query job or read one result page.' This clearly distinguishes the tool from run_query/dry_run_query siblings, which submit rather than poll jobs, and an agent can tell exactly what it does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete operating rules: 'If job_complete is false, call again later' and 'Reuse project_id, location and account from submission.' That tells the agent when and how to re-invoke, though it doesn't explicitly name run_query as the prerequisite step that creates the job.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_tableB
Read-onlyIdempotent

Read nested schema, size, row count, partitioning and clustering before writing SQL.

NameRequiredDescriptionDefault
accountNo
table_idYes
dataset_idYes
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds that multiple metadata facets are returned in one read, but since an output schema exists, that is largely duplicative; nothing on permissions or required access is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded clause with no filler; the key information (what is read) comes first and the usage trigger last. It is terse to the point of being a fragment, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With rich annotations and a declared output schema, the description covers the what and roughly the when. The gap is scope resolution (which project/account a dataset_id is resolved against) and sibling differentiation, both left to inference for a tool with 4 unresolved parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 4 parameters (dataset_id, table_id, account, project_id), so the description must compensate and does not — it mentions no parameter at all. Parameter names are mostly self-explanatory, which keeps this above a 1, but the null-defaulted account/project_id scoping is left entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource and the exact metadata it returns (nested schema, size, row count, partitioning, clustering), which is far more informative than the bare name get_table. It does not, however, explicitly distinguish itself from siblings like preview_table or get_dataset, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'...before writing SQL' gives a clear implied moment to use the tool. But no alternative is named and no exclusion is stated (e.g., when to use preview_table for sample rows instead), so the routing guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

health_checkB
Read-onlyIdempotent

Check local configuration without contacting Google or opening a browser. ADC is not probed.

NameRequiredDescriptionDefault
accountNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, openWorld=false, idempotent, non-destructive; the description adds genuinely new behavioral facts: no network calls to Google, no browser launch, and specifically that ADC is not probed. That is exactly the kind of detail an agent needs to know this is a safe, purely local inspection. It stops short of saying what the check actually inspects or reports.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the negative scope front-loaded and no filler. Every clause carries information an agent cannot get from the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations carry the safety profile. However, for a diagnostic tool the description never says what is being examined or how to interpret a pass/fail result, and the undocumented `account` parameter leaves a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single `account` parameter has 0% schema description coverage and the description never mentions it — no indication whether it selects which stored credential's configuration to inspect or what happens when it is omitted (the schema shows default null). With zero coverage, the description was the only place this could have been clarified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Check local configuration" states a verb and a resource, but the resource is vague — it never says this is BigQuery configuration (only the annotation title does), nor what aspect of configuration is verified. The negative scope ("without contacting Google or opening a browser") is helpful but describes what the tool avoids rather than what it produces, and no sibling tool is referenced for contrast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to run this check — before a query, when auth fails, as a preflight — and no comparison to any of the nine sibling tools. The only guidance is an exclusion: "ADC is not probed," which tells an agent not to rely on it for auth diagnostics but does not say what to do instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_datasetsA
Read-onlyIdempotent

List one page of datasets in project_id or the configured default project.

NameRequiredDescriptionDefault
accountNo
page_sizeNo
page_tokenNo
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds two real behavioral facts beyond that: results are returned one page at a time (pagination is required to enumerate everything) and omitting project_id falls back to the configured default project.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the verb and resource before the scoping clause. Nothing could be removed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations cover the safety profile. The remaining gaps are the undocumented account parameter and page_token continuation semantics, which are minor but real for a paginated list tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 4 parameters, so the description has to carry the burden. It clarifies project_id's null/default behavior and implies page_size/page_token through "one page," but leaves the account parameter and the page_size bounds/limit completely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List one page of datasets") plus the scope (project_id or the default project), which is enough to separate it from list_tables and list_projects. It stops short of naming a sibling or contrasting with get_dataset, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (enumerating datasets, with a default-project fallback) but gives no explicit when-not guidance and never points to get_dataset for single-dataset details or list_tables for drill-down. Usage must be inferred from the verb and the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_projectsA
Read-onlyIdempotent

List one page of accessible projects. First use may open Google sign-in and save a local token.

NameRequiredDescriptionDefault
accountNo
page_sizeNo
page_tokenNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), so the description's value is in the extra disclosures: the call returns a single page rather than the full set, and first use has an interactive auth side effect that writes a local token. That side-effect warning is genuinely beyond what the annotations say and matters for non-interactive callers. It doesn't cover error modes or what happens if the sign-in is declined.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero filler, with the core action front-loaded before the auth caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema means return values needn't be explained, and the auth caveat covers the biggest surprise. But with three parameters at 0% schema coverage, leaving `account` (multi-account selection) and the page_token continuation flow entirely undescribed leaves the agent guessing on a tool it will likely call first.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it largely doesn't. "One page" vaguely gestures at page_size/page_token but never explains page_size's 1–1000 bounds or how to continue via page_token, and the `account` parameter is never mentioned at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List one page of accessible projects") and the sibling names (list_datasets, list_tables) make the resource level unambiguous. It doesn't say these are BigQuery projects or that projects are the top-level container for datasets — the annotation title carries that — but an agent can still distinguish it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not guidance relative to siblings, but it does disclose a real prerequisite: first use may trigger an interactive Google sign-in and persist a local token. That is useful context an agent needs before calling, though it is a prerequisite rather than routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesB
Read-onlyIdempotent

List one page of tables and views within a dataset.

NameRequiredDescriptionDefault
accountNo
page_sizeNo
dataset_idYes
page_tokenNo
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=true, so the safety profile is covered. The description adds the useful pagination trait ('one page'), but says nothing about auth, rate limits, or ordering.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence with the resource and pagination scope front-loaded. No wasted words, though it underspecifies rather than overexplains.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation. But with 5 parameters at 0% schema coverage, the description should do more to demystify account/project_id and pagination behavior for a BigQuery listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry param meaning. It hints at dataset_id and pagination (page_size/page_token) via 'one page... within a dataset,' but leaves account and project_id unexplained, and clarifies nothing about page_size limits or token semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (tables and views) scoped to a dataset, with pagination indicated. It can be distinguished from siblings like get_table/preview_table, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no routing to alternatives such as preview_table or get_table. The only hint is 'one page,' which implies pagination without explaining it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

preview_tableA
Read-onlyIdempotent

Read a bounded page from a physical table without a SQL query job. Row order is unspecified.

NameRequiredDescriptionDefault
accountNo
table_idYes
page_sizeNo
dataset_idYes
page_tokenNo
project_idNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is covered. The description adds one genuinely new trait, "Row order is unspecified", but says nothing about pagination continuation via page_token, truncation, or the page_size ceiling (1000) enforced by the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero waste; the core operation is front-loaded ahead of the caveat about row order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the read-only nature is covered by annotations. However, for a 6-parameter tool with no schema descriptions, the description leaves too much of the parameter surface unexplained to be fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Six parameters with 0% schema description coverage, so the description carries the full burden and largely fails: project_id, account, dataset_id and table_id are undocumented, and page_token's continuation semantics are only implied by "bounded page". The one useful hint is that reads are paged, which maps loosely to page_size/page_token.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

A specific verb and resource (read a bounded page from a physical table) plus an explicit contrast with the query-based siblings ("without a SQL query job"). An agent can distinguish this from run_query/dry_run_query without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Without a SQL query job" implies when this is preferred over run_query, but the guidance is only hinted at. There is no explicit when-not or named alternative such as get_table or run_query.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_queryA

Dry-run then submit a SELECT job that can incur Google charges. Never raises the configured byte ceiling.

Returns a job reference immediately. Use get_query_results to poll and paginate; do not resubmit to poll. project_id is the billing/job project; fully qualified SQL may read data from other accessible projects.

NameRequiredDescriptionDefault
sqlYes
accountNo
locationNo
parametersNo
project_idNo
maximum_bytes_billedNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond annotations: the job can incur Google charges, it never exceeds the configured byte ceiling (fails rather than overruns), returns a job reference immediately (async), and resubmission creates new work rather than polling. The annotations only say non-read-only, open-world, non-idempotent, non-destructive; the description gives the cost and ceiling semantics an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the risk (charges) and the key constraint (byte ceiling), followed by the return shape and routing guidance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be detailed, yet it still states a job reference comes back immediately. Cost, ceiling, polling, and cross-project semantics are covered; only the account/location parameter meanings are left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the burden. It clarifies two parameters well — project_id as the billing/job project that need not match the data's projects, and the byte ceiling behavior tied to maximum_bytes_billed. But sql, account, location, and parameters get no explanation, leaving meaningful gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — submit a SELECT job — and its two-phase nature (dry-run first). It differentiates from siblings by name, both the internal dry-run step versus dry_run_query and the polling handoff to get_query_results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: use get_query_results to poll and paginate, and 'do not resubmit to poll'. Also implies the dry-run-first workflow that distinguishes it from a plain submit. When/when-not coverage is unusually complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.1.0
    • First observeddry_run_query
    • First observedget_dataset
    • First observedget_query_results
    • First observedget_table
    • First observedhealth_check
    • First observedlist_datasets
    • First observedlist_projects
    • First observedlist_tables
    • First observedpreview_table
    • First observedrun_query

TDQS

A3.7/5.0

Scored across 10 tools

Disambiguation4/5

Tools split cleanly along metadata vs. data vs. query-execution lines, and the run_query/get_query_results pair explicitly warns against resubmission to poll, removing the classic confusion. Minor overlap remains between get_table, get_dataset and preview_table, which all read table/dataset information, though the descriptions distinguish schema metadata from bounded row previews.

Naming Consistency4/5

Nine of ten names follow a predictable verb_noun snake_case pattern (list_projects, get_dataset, preview_table, dry_run_query, run_query, get_query_results). health_check is the one deviation, using a noun_noun form, but it is a widely understood idiom and does not hurt readability.

Tool Count5/5

Ten tools is a well-scoped surface for a BigQuery server: enumeration, metadata inspection, preview, validation, execution and result polling each appear once. Nothing looks padded or redundant.

Completeness4/5

The core read/query lifecycle (project -> dataset -> table -> dry run -> run -> poll/paginate) is fully covered with no dead ends. Gaps are the absence of job management (cancel, list recent jobs/costs) and any write DDL/DML, which appears intentional for a read-only, cost-guarded server.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    B
    maintenance
    Enables validation and dry-run analysis of BigQuery SQL queries without execution. Provides cost estimates, schema previews, and syntax validation for BigQuery queries.
    9
    30 PyPI
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables LLMs to explore BigQuery datasets and tables, run safe read-only queries, and optionally perform vector search using BigQuery embeddings.
    10
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables read-only interaction with Google BigQuery, including SQL queries, dataset/table listing, schema retrieval, table preview, and metadata access via service account authentication.
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables secure read-only interaction with Google BigQuery through natural language, including listing datasets, listing tables, retrieving metadata, and executing queries with cost controls.
    -