mcp-clickhouse
This server is an MCP gateway to ClickHouse that lets AI agents explore schema, monitor the database, and run SQL queries under configurable read/write/admin access modes.
Explore schema: list databases, list tables, describe columns, show CREATE TABLE, and view table stats (parts, rows, size, time range).
Monitor the database: view running queries, server metrics, and cluster topology.
Run read-only SQL: execute SELECT/SHOW/DESCRIBE via the
querytool, with results capped byCLICKHOUSE_MAX_ROWSand enforced under ClickHousereadonly=1in read-only mode.Execute management SQL (in read-write/admin modes): use the
executetool for INSERT/CREATE/ALTER and other write statements.Perform destructive operations (admin mode only): DROP/TRUNCATE/DELETE/ALTER DELETE, gated by
CLICKHOUSE_ALLOW_DELETE.Control scope and safety: enforce database allowlists, protect system/information_schema databases, support dry-run validation, and emit JSON audit logs for guarded operations.
Provides tools for exploring ClickHouse schemas, running analytical read queries, and managing the database with configurable access modes and security restrictions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-clickhouseWhat are the biggest tables in the analytics database?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-clickhouse
A Model Context Protocol server for ClickHouse. It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) explore schemas, run analytical queries, and manage the database — with behaviour controlled entirely by flags.
The security model is statement-aware: every SQL statement is classified as read, write, or destructive, and gated against the current access mode. Read-only mode additionally runs queries under ClickHouse's own readonly=1 setting.
Features
Exploration & monitoring — databases, tables, columns,
SHOW CREATE, table stats (parts/rows/bytes), running queries, server metrics, cluster topology.Read queries — a
querytool that only accepts read statements, capped atCLICKHOUSE_MAX_ROWS.Management — an
executetool for INSERT/CREATE/ALTER (read-write) and DROP/TRUNCATE/DELETE (admin), each gated by classification.Access modes —
read-only→read-write→admin, layered so a mode never exposes statements above its level.Security flags — database allowlist, protected databases, destructive gating, row cap, dry-run, and JSON audit logging (see below).
Related MCP server: clickhouse-mcp-server
Security model
Concern | Flag | Default | Effect |
What can the server do? |
|
|
|
Which databases are in scope? |
| (all) | When set, operations on other databases are refused. |
Which databases are read-only forever? |
|
| Readable, never mutable. |
Can it run destructive SQL? |
|
| DROP/TRUNCATE/DELETE/… need this and admin mode. |
Result size cap |
|
| Hard cap on rows returned to the model. |
Preview without executing |
|
| Write/destructive statements validate + log intent, then return. |
Audit trail |
|
| Emits a JSON line to stderr per guarded operation. |
Interactive confirmation | (automatic) | — | Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the |
Statement classification lives in src/sql.ts and is fail-safe: ALTER … DELETE/UPDATE counts as destructive, and anything unparseable is treated as destructive.
Tools
Read (read-only+): list_databases, list_tables, describe_table, show_create_table, table_stats, running_queries, server_metrics, cluster_info, query
Write/Admin (read-write+): execute — runs a single statement after classifying it; writes need read-write mode, destructive statements need admin mode + CLICKHOUSE_ALLOW_DELETE.
Quickstart — add to your agent
Published on npm as @dockndevai/mcp-clickhouse. No clone or build needed — your MCP client runs it on demand with npx. Start in read-only mode; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.
Claude Code (CLI)
claude mcp add clickhouse -e CLICKHOUSE_URL="http://localhost:8123" -e CLICKHOUSE_USER="default" -e CLICKHOUSE_MODE="read-only" -- npx -y @dockndevai/mcp-clickhouseClaude Desktop · Cursor · Windsurf — same block in claude_desktop_config.json, .cursor/mcp.json, or ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"clickhouse": {
"command": "npx",
"args": [
"-y",
"@dockndevai/mcp-clickhouse"
],
"env": {
"CLICKHOUSE_URL": "http://localhost:8123",
"CLICKHOUSE_USER": "default",
"CLICKHOUSE_MODE": "read-only"
}
}
}
}OpenAI Codex CLI — in ~/.codex/config.toml:
[mcp_servers.clickhouse]
command = "npx"
args = ["-y", "@dockndevai/mcp-clickhouse"]
env = { CLICKHOUSE_URL = "http://localhost:8123", CLICKHOUSE_USER = "default", CLICKHOUSE_MODE = "read-only" }VS Code (GitHub Copilot, Agent mode) — in .vscode/mcp.json:
{
"servers": {
"clickhouse": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@dockndevai/mcp-clickhouse"
],
"env": {
"CLICKHOUSE_URL": "http://localhost:8123",
"CLICKHOUSE_USER": "default",
"CLICKHOUSE_MODE": "read-only"
}
}
}
}Example prompts
"What are the biggest tables in the
analyticsdatabase?""Show me the schema for
eventsand run a query for daily counts this week.""Which queries are currently running and using the most memory?"
Run from source (development)
Prefer the published package above. To run from a clone:
npm install
npm run build
node dist/index.js # with the environment variables setDevelop
npm run dev
npm test # SQL classification + security policy (30 tests)
npm run typecheckPublishing
This server ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md for publishing to npm and listing on the MCP registry, Smithery, Glama, Cursor, and PulseMCP.
License
MIT
Available Tools
9 toolscluster_infoCluster infoARead-onlyIdempotent
Cluster topology from system.clusters (shards, replicas, hosts).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the specific system table source and the conceptual content returned, but it does not add broader behavioral context such as authentication requirements, output shape, or edge cases. This is acceptable with strong annotations but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the core concept and avoids filler. Every clause contributes meaning, naming the source and the key aspects of the returned topology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only metadata inspection tool with no output schema, the description is complete. It tells the agent what information is available and from where, and the annotations cover the operational safety profile.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so the baseline is 4. There is nothing for the description to add about parameter meaning, and it does not attempt to invent any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource: cluster topology sourced from system.clusters, with shards, replicas, and hosts as the relevant components. It is distinct from sibling tools like list_tables or server_metrics, but lacks an explicit verb such as 'get' or 'returns', so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool should be used when cluster topology from system.clusters is needed, and the lack of parameters makes prerequisites moot. However, it provides no explicit guidance about when to prefer it over alternatives or any exclusions, leaving usage partly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_tableDescribe tableARead-onlyIdempotent
Column names, types, defaults, and comments for a table.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a read-only, idempotent, non-destructive operation, so the safety profile is covered. The description adds real value by disclosing the content of the response (column names, types, defaults, comments) even though no output schema exists. It omits any note on error behavior or whether views are handled, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with no wasted words, and the key information is front-loaded. It is a noun phrase rather than a sentence, but the trade-off favors brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description carries the return-value burden and does so by listing the fields returned. It is complete enough to call correctly, though it does not clarify relationship to show_create_table or edge cases like missing tables.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both required parameters (database, table) are documented in the schema with clear descriptions. The description adds no additional meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource (a table) and enumerates the returned metadata (column names, types, defaults, comments), so an agent can tell it retrieves schema structure. It lacks an explicit verb and does not distinguish itself from the sibling show_create_table, which likely returns similar DDL information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives. With siblings like list_tables, show_create_table, and table_stats, the agent gets no signal about which to pick for schema inspection versus DDL or statistics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesList databasesARead-onlyIdempotent
List databases and their engines.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as read-only, idempotent, non-destructive, and open-world, which covers the safety profile. The description adds the behavioral detail that the result includes database engines, which is useful context beyond the annotations for a zero-parameter read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, six-word sentence that front-loads the action and resource while adding the one meaningful extra detail ('engines'). There is no wasted text or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless read-only operation, the description plus annotations provide everything an agent needs: what is listed, what fields are returned, and the safety characteristics. No output schema exists, but the description sufficiently indicates the return content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and the input schema fully documents this fact, so the description does not need to add any parameter-related information. Per the baseline for zero-parameter tools, this is appropriately handled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List'), a clear resource ('databases'), and an additional detail ('their engines'), which precisely identifies what the tool does. It is immediately distinguishable from sibling tools like list_tables or describe_table because it targets databases as the resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the verb-resource pairing, so an agent can infer this is the tool to call when it needs to enumerate databases. However, the description provides no explicit when-to-use guidance and does not mention alternatives or exclusions, so it falls short of clearer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesList tablesBRead-onlyIdempotent
List tables in a database with engine, row count, and size.
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false, so safety and mutation behavior are covered. The description adds useful value by naming the returned columns (engine, row count, size), but says nothing about pagination, permissions, or result size limits. With annotations carrying the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the resource and the returned fields are both delivered immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one documented parameter and no output schema, the description tells the agent what it gets back and where the tables live. The only meaningful gap is the absence of sibling disambiguation, which is minor given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter ('database') and schema description coverage is 100%, so the schema already documents it. The phrase 'in a database' reinforces the parameter's role but adds no syntax, format, or scoping detail beyond the schema. Baseline 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (tables in a database), and even previews the returned fields (engine, row count, size). It does not, however, differentiate itself from close siblings like describe_table, show_create_table, or table_stats, which an agent could easily confuse with this one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus alternatives. Given siblings such as list_databases, describe_table, and table_stats, the description should route the agent but instead leaves all timing and exclusion logic to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryRun a read-only queryARead-onlyIdempotent
Run a SELECT/SHOW/DESCRIBE query and return rows. Non-read statements are refused here — use execute (read-write mode) for those. Results are capped at CLICKHOUSE_MAX_ROWS.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | A single read-only SQL statement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/non-destructive, so the safety profile is covered. The description adds meaningful non-annotation behavior: refusal semantics for writes and the result cap (CLICKHOUSE_MAX_ROWS), which tells the agent output may be truncated. Minor gaps remain (error shape, whether the cap is configurable).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences; the capability and the routing rule come first, the result-cap caveat last. Every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does tell the agent that rows are returned and that output is capped, which is the key expectation-setting detail. It could say a bit more about truncation behavior or error responses, but it is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and there is a single `sql` parameter already documented as a read-only statement. The description's mention of SELECT/SHOW/DESCRIBE reinforces but does not go beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (run) plus resource (query) and enumerates the accepted statement classes (SELECT/SHOW/DESCRIBE), so the agent knows exactly what this tool executes. It also names the sibling `execute` as the write-path counterpart, making it easy to distinguish from alternates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the when-not condition (non-read statements are refused) and the alternative to use instead (`execute` in read-write mode). Nothing about tool selection is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
running_queriesRunning queriesARead-onlyIdempotent
Currently executing queries from system.processes (id, user, elapsed, memory).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds useful context by naming system.processes as the source and indicating the result is a live view of currently executing queries. However, it does not disclose ordering, limits, or potential permission issues.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence that front-loads the core concept and packs the source and returned fields into a compact parenthetical. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only introspection tool with strong annotations, the description is mostly complete: it names the source table and the fields returned. It falls just short of explicitly saying 'returns a list of...' and does not mention ordering, limits, or privileges, which would be more helpful given there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is nothing for the description to explain about parameter usage, and the schema coverage is trivially complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource and scope: currently executing queries from system.processes, including the fields returned (id, user, elapsed, memory). It is unambiguous about what the tool exposes, though it lacks an explicit verb like 'list' and does not explicitly distinguish itself from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus related siblings such as query, server_metrics, or table_stats. The description implies it is for viewing active queries, but it does not state exclusions, prerequisites, or alternative tool routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_metricsServer metricsARead-onlyIdempotent
Non-zero metrics from system.metrics (connections, merges, memory, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, and open-world behavior. The description adds useful behavioral context beyond that by stating that zero-valued metrics are filtered out and naming the source table, which helps an agent understand what results to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that states the source, the filtering behavior, and representative categories. It is front-loaded and contains no filler or repetition of the title/annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only, idempotent tool, the description is sufficient to enable a correct call. No output schema exists, but the tool's simplicity and safe annotation profile mean the agent lacks no essential invocation guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so the baseline of 4 applies. There is no parameter ambiguity, and the description's mention of metric categories provides enough context for what can be explored.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific resource (system.metrics) and a clear scope (non-zero entries covering connections, merges, memory, etc.). It implies retrieval of server-level metrics, which is enough to distinguish it from siblings like list_databases or cluster_info, though it lacks an explicit verb such as 'list' or 'get'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implicit: an agent would select this tool when it needs server metric values rather than schema, table, or query information. However, the description does not explicitly state when to prefer this over running_queries, cluster_info, or other siblings, nor does it mention exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_create_tableShow CREATE TABLEBRead-onlyIdempotent
Return the full CREATE TABLE statement (schema, engine, settings) for a table.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true and destructiveHint=false, so the safety profile is fully covered. The description adds the useful detail that engine and settings are included in the output, but discloses nothing beyond that about behavior or output size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the returned content is parenthesized at the end for quick scanning. Nothing is padded or repeated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-param read-only tool with no output schema, the description is sufficient: it names the return payload (schema, engine, settings) and the annotation set covers safety. The only missing element is guidance relative to sibling tools like describe_table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with two required string params (database, table), so the schema fully documents the inputs. The description mentions 'a table' but adds no semantics beyond the schema baseline, which is the expected 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('full CREATE TABLE statement') and enumerates what the payload contains (schema, engine, settings). An agent knows exactly what it gets back. It does not, however, distinguish itself from sibling describe_table, which likely overlaps in intent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use statement, no prerequisites, and no routing to alternatives. With sibling tools like describe_table and list_tables present, the description never explains when this is preferred over those, leaving the agent to infer from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
table_statsTable statsBRead-onlyIdempotent
Part count, row count, on-disk size, and time range from system.parts.
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | Table name | |
| database | Yes | Database name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds useful context by revealing the data comes from system.parts (a ClickHouse system table), but says nothing about permissions, behavior on empty/non-existent tables, or the meaning of 'time range'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence listing the returned metrics with no filler. It is a noun fragment rather than a full sentence and 'time range' is left undefined, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does list the return fields, which partly compensates. However, it omits units, format, and how 'time range' is derived, so an agent lacks enough detail to interpret the response fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters (database, table) are fully documented in the schema at 100% coverage, so the description has no burden to explain them. It adds no parameter-specific information, which is acceptable here but yields only the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the specific measurements returned (part count, row count, on-disk size, time range) and discloses the source table (system.parts), so an agent knows exactly what data comes back. It stops short of differentiating itself from siblings like describe_table or server_metrics, and never explicitly states it operates on a given database/table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no mention of alternatives such as describe_table, show_create_table, or server_metrics. The agent must infer that this is the tool for physical/part-level metrics rather than schema or cluster information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.2- Changed
describe_table1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
list_tables1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
query1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
show_create_table1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
- Changed
table_stats1 field changed- removed
Input schema / additionalPropertiesRemoved value: -false
9 tool updates
v0.1.0- First observed
cluster_info - First observed
describe_table - First observed
list_databases - First observed
list_tables - First observed
query - First observed
running_queries - First observed
server_metrics - First observed
show_create_table - First observed
table_stats
TDQS
Scored across 9 tools
Each tool targets a fairly distinct area: table listing, column metadata, DDL, stats, and system introspection. The main overlap is that `query` can also run SHOW/DESCRIBE and thus partially duplicates `describe_table`, `show_create_table`, `list_databases`, and `list_tables`, though dedicated tools provide clearer structured output.
All names are snake_case, but the conventions are mixed: verb_noun forms (`list_tables`, `describe_table`, `show_create_table`), noun phrases (`table_stats`, `cluster_info`, `running_queries`, `server_metrics`), and a lone verb (`query`). Readable but not a predictable pattern.
Nine tools is well-scoped for a ClickHouse introspection and query server. Each tool has a clear place, and there is no obvious bloat or missing category within the read-oriented surface.
Read-side coverage is solid (databases, tables, schema, stats, queries, cluster, metrics). However, the `query` description explicitly says non-read statements must use an `execute` tool, which is absent, leaving writes/DDL as a dead end and creating an inconsistent tool surface.
Maintenance
Related MCP Connectors
Governed access to production AI-agent traces in an existing ClickHouse store.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Related MCP Servers
- AlicenseBqualityDmaintenanceAn MCP server implementation that enables Claude AI to interact with Clickhouse databases. Features include secure database connections, query execution, read-only mode support, and multi-query capabilities.22MIT
- AlicenseNot gradedqualityCmaintenanceEnables interaction with ClickHouse databases via MCP, providing tools to list databases and tables and execute safe SELECT, SHOW, and DESCRIBE queries.83 npmMIT
- FlicenseAqualityDmaintenanceRead-only MCP server for ClickHouse that allows listing databases and tables, describing schemas, and running SELECT queries.4-
- FlicenseNot gradedqualityDmaintenanceMCP server for executing SQL queries on PostgreSQL and ClickHouse with per-connection allow/deny policies by statement group.-