BigQuery MCP server: setup, auth, production
Last verified: June 2026· BigQuery MCP integration
Community MCP servers existGoogle Cloud’s serverless data warehouse.
What is the BigQuery MCP server?
A BigQuery MCP server implements the Model Context Protocol and exposes BigQuery's capabilities as typed tools an agent can discover and call in the middle of a task. Google Cloud’s serverless data warehouse.
Warehouse access turns an agent into an analyst that writes and explains its own queries. The governance that matters here is cost (bytes scanned / warehouse time) and row-level access to sensitive tables — both are solvable, neither is optional.
A real BigQuery workflow
The agent drafts a query against governed datasets, estimates the bytes it will scan before running, and answers the question — the estimate step alone prevents the accidental full-table scan that shows up on next month’s bill.
What an agent can do with BigQuery
- Let an agent draft and run analytics queries
- Answer questions against governed datasets
- Estimate query cost before running
Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.
Setting up the BigQuery MCP server
Use a service account with dataset-scoped, read-only IAM (roles/bigquery.dataViewer on specific datasets, plus jobUser). Set a maximum-bytes-billed default so a query can’t scan more than you allow.
Auth: A service account with dataset-scoped, read-only IAM roles. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.
The risk to watch with BigQuery
BigQuery charges by bytes scanned; one unqualified query over a large table is a real cost event. A maximum-bytes-billed ceiling and dataset-scoped IAM are the guardrails that matter.
More broadly, a production-grade BigQuery integration needs bytes-scanned cost guards and dataset-level IAM scoping. The MCP security checklist applies to every integration — we build servers with these controls baked in.
Troubleshooting
If the BigQuery tools don't appear after setup, it's almost always auth or transport. See MCP server not connecting for the step-by-step fix — and note that hosted servers often need OAuth, not a plain API key. To understand how MCP relates to ordinary tool use, see MCP vs function calling.
Frequently asked questions
Is there an official MCP server for BigQuery?
Community MCP servers exist. Whichever you use, a production setup needs bytes-scanned cost guards and dataset-level iam scoping.
How does authentication work for BigQuery over MCP?
A service account with dataset-scoped, read-only IAM roles. Credentials should never live in the sandbox or the repo; route them through your client's secret handling or a vaulted credential.
What can an agent actually do with BigQuery?
Let an agent draft and run analytics queries; Answer questions against governed datasets; Estimate query cost before running. Start read-only and add write access deliberately, behind audit logging.
Is it safe to give agents access to BigQuery?
Yes, when scoped correctly: least-privilege credentials, read-only by default, audit logs on every call, and human approval for any high-impact action. Bytes-scanned cost guards and dataset-level IAM scoping.