Enables natural-language querying of a SQLite database (Chinook sample) through tools for listing tables, describing schemas, executing read-only SQL queries, and summarizing results.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@fde-week3-agent which country has the most customers?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A natural-language SQL agent that queries the Chinook sample database, built two ways: with raw function calling, then refactored to use the Model Context Protocol (MCP).
Built as week 3 of a 16-week forward-deployed engineering study plan. The goal: internalize the agent loop, understand why tool descriptions matter more than tool code, and see what MCP actually adds (and doesn't add) over raw function calling.
Answers natural-language questions like "which country has the most customers?" or "what are the top 5 best-selling artists by total revenue?" against a real SQLite database. The agent doesn't hardcode any SQL — it discovers the schema, writes queries, and interprets results dynamically.
Two working implementations of the same agent:
Raw function calling (main.py): tools are Python functions in tools.py, schemas are hardcoded in tool_schemas.py, dispatched via a lookup dict in agent.py.
MCP (main_mcp.py): the same tools are exposed by an MCP server (mcp_server.py) and consumed by a client agent (mcp_client_agent.py). Tool schemas are fetched dynamically at startup, not hardcoded.
Related MCP server: mcp-chinookdb-server
The agent's behavior is identical across both implementations — same queries, same answers, same latency profile. That equivalence is the point. It demonstrates that MCP is a delivery mechanism for tools, not a change to how agents reason. Which one to pick is an organizational decision:
Raw is right when the agent and tools ship together and you don't need cross-agent reuse
MCP is right when tools are maintained separately, when the customer might swap agents later, or when the same tools need to serve multiple agents
list_tables — discoverability. Returns table names.
describe_table(name) — discoverability. Returns column schema for a given table.
query_sql(sql) — read-only SELECT execution. Rejects INSERT, UPDATE, DELETE, DROP, and multi-statement input at the tool level (not just in the description).
summarize_results(rows, question) — pure-LLM tool that generates natural-language summaries of query results.
The read-only constraint on query_sql is enforced in the tool's Python code, before the SQL reaches the database. The description tells the model the rule; the code enforces it. This is defense in depth: even if the model is confused, prompt-injected, or from a weaker model that ignores instructions, the destructive operation never reaches the database.
Same enforcement lives in the tool code whether accessed via raw dispatch or MCP. Refactoring to MCP doesn't move the security boundary — the boundary is in tools.py, which is unchanged across implementations.
git clone https://github.com/jordanmatusik24/fde-week3-agent
cd fde-week3-agent
uv syncCreate .env:
ANTHROPIC_API_KEY=sk-ant-...Download Chinook:
Invoke-WebRequest -Uri "https://github.com/lerocha/chinook-database/raw/master/ChinookDatabase/DataSources/Chinook_Sqlite.sqlite" -OutFile "chinook.db"Raw function calling agent:
uv run python main.py "How many customers are in the database?"
uv run python main.py "What are the top 5 best-selling artists by total revenue?"
uv run python main.py "Are there any customers who haven't made a purchase?"MCP agent (same questions, tools served over MCP protocol):
uv run python main_mcp.py "How many customers are in the database?"Test the MCP server standalone with the MCP inspector:
uv run mcp dev mcp_server.pyRaw:
main.py → agent.py (dispatch loop) → tools.py (implementations)
↑
tool_schemas.py (hardcoded)MCP:
main_mcp.py → mcp_client_agent.py → MCP protocol over stdio → mcp_server.py → tools.py
↑
schemas generated from decoratorsDescription quality dominates tool code quality. A tool with a perfect implementation and a vague description gets misused. A tool with a middling implementation and a sharp description gets called correctly. The description is the model's API contract.
Discoverability tools prevent schema hallucination. Without list_tables and describe_table, an agent asked to query an unknown database invents plausible-looking but wrong SQL based on training-data conventions. With them, the agent observes the schema before writing SQL, and correctness follows.
Parallel tool calls happen when the description hints at them. The describe_table description ends with "you can call it in parallel for multiple tables in one turn." The model then bundles 3-4 describes into a single turn on multi-table queries, cutting latency 2-3× vs sequential discovery.
Constraints enforced only in prompt/description are voluntary. Constraints in tool code are mandatory. The SELECT-only check has to live in tools.py, not just in the description, because the description is documentation and code is the wall. This distinction is the answer to every customer security review question about what an agent can and cannot do.
MCP doesn't change agent behavior. Same queries, same answers, same latency profile across the two implementations. MCP shifts where tools are maintained, not how agents reason.
Python 3.12, managed by uv
Anthropic SDK for Claude Sonnet 4.5
MCP Python SDK for the MCP server and client
typer for the CLI
Chinook sample database — a fictional digital music store schema
Return the column schema for a table.
Call this before writing any SQL that references a table you haven't described yet. You can call it in parallel for multiple tables in one turn. Returns an error if the table name doesn't exist — use list_tables to see valid names.
Args: name: The exact table name, case-sensitive, as returned by list_tables.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint. Description adds: parallel calls possible, error on nonexistent table, case-sensitive name. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs plus a bullet for args. Front-loaded with purpose. Every sentence is informative without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers usage, error handling, and parameter semantics. Lacks explicit description of the return format (column schema details), but 'column schema' is generally understood for this standard tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage. Description fully compensates by explaining the 'name' parameter: exact, case-sensitive, as returned by list_tables.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Return the column schema for a table' with specific verb and resource. Distinguishes from siblings: list_tables lists tables, query_sql runs queries, summarize_results summarizes – this tool is for schema introspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call this before writing any SQL that references a table you haven't described yet' and suggests using list_tables for valid names. Also mentions parallel calls in one turn.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all tables in the connected Chinook database.
Call this FIRST when you don't yet know what data is available. Returns a JSON object with a 'tables' key holding a list of table names. Each name can then be passed to describe_table to learn the columns. Cheap to call; use it freely rather than guessing table names.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint and idempotentHint. The description adds value by specifying the return format (JSON with 'tables' key), the result content (list of names), and the cost profile (cheap to call). No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences: purpose, usage guidance, technical detail. Every sentence adds value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, but the description adequately explains the return format (JSON with 'tables' key). It also recommends next steps (use describe_table). Complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. Description adds no param details, which is appropriate. Baseline 4 for zero-param tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all tables in the Chinook database. It uses a specific verb ('List') and resource ('tables'), and distinguishes from siblings by recommending initial use before describe_table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call this FIRST when you don't yet know what data is available' and 'use it freely rather than guessing table names', providing clear when-to-use and when-not-to.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Execute a single SELECT statement against the database and return results.
This tool is READ-ONLY: INSERT, UPDATE, DELETE, DROP, and any other non-SELECT statement will be rejected. Multiple statements chained with semicolons will also be rejected — send one SELECT at a time.
Returns an object with: columns (list of column names), row_count, rows (list of row objects), and truncated (true if there were more than 100 rows, in which case only the first 100 are returned).
If you don't know the schema, call list_tables and describe_table FIRST. Never invent column or table names — verify them by describing the tables involved.
Args: sql: A single, valid SQLite SELECT statement. Use standard SQL. You may include JOIN, WHERE, GROUP BY, ORDER BY, LIMIT, and aggregate functions. Do not include a trailing semicolon.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, and non-destructive behavior. The description adds valuable context: it explicitly rejects INSERT/UPDATE/DELETE/DROP, rejects multiple statements, and documents the truncation behavior (max 100 rows). This enriches the agent's understanding beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections and bullet points. Front-loaded with purpose. Slightly verbose but every sentence adds essential information. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description thoroughly explains the return format (columns, row_count, rows, truncated). It also covers error cases (rejection of non-SELECT). For a read-only SQL tool, this is fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by exhaustively detailing the sql parameter: it must be a single SELECT statement, standard SQL allowed constructs (JOIN, WHERE, etc.), and explicitly forbids a trailing semicolon. This leaves no ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a single SELECT statement and returns results, using specific verbs and resources. It distinguishes itself from siblings (list_tables, describe_table, summarize_results) by focusing exclusively on SELECT queries.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (SELECT only) and when not to use (non-SELECT, multiple statements). Provides clear guidance to first explore schema using list_tables and describe_table, preventing common errors.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Produce a natural-language summary of query results.
Use this ONLY when the rows need narrative interpretation (multiple rows, aggregate patterns, comparisons across groups). For single-row lookups or trivially small results, answer directly in your response text without calling this tool.
Args: rows: The 'rows' list returned from query_sql. question: The user's original question, verbatim.
| Name | Required | Description | Default |
|---|---|---|---|
| rows | Yes | ||
| question | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true. Description does not contradict and adds some context (input types from query_sql), but does not elaborate on behavioral aspects like output length or processing limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise paragraphs covering purpose, usage guidelines, and parameter explanations. No redundant sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Explains purpose, when to use, and parameters. No output schema, but the output is natural language text; minor gap: does not specify output format or length constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% but description gives meaningful explanations for both parameters: 'rows' is from query_sql results, 'question' is the user's original query. Fully compensates for missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool produces a natural-language summary of query results. It distinguishes from sibling tools by specifying it's for narrative interpretation, not single-row lookups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (multiple rows, aggregate patterns) and when not to (single-row lookups). Provides clear criteria and alternatives (answer directly).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0describe_tablelist_tablesquery_sqlsummarize_resultsScored across 4 tools
Each tool has a distinct, non-overlapping purpose: listing tables, describing schema, executing SQL queries, and summarizing results. No two tools could be confused for the same task.
All tools follow a consistent verb_noun pattern in snake_case (list_tables, describe_table, query_sql, summarize_results), making the set predictable and easy to use.
4 tools perfectly cover the essential workflow for a read-only database agent: discover tables, inspect schema, run queries, and summarize results. Each tool earns its place with no unnecessary additions.
The set covers the core workflow well, but lacks a tool for quickly previewing sample data or obtaining table statistics, which would require writing a query manually. Minor gap, but functional.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
MCP server exposing the Backtest360 engine API as tools for AI agents.
GibsonAI MCP server: manage your databases with natural language
Hosted MCP server for live public-data APIs and Skills for AI agents.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/jordanmatusik24/fde-week3-agent'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
