How to Set Up a BigQuery MCP Server for Claude, Cursor & Codex

This post was written by an engineer at QueryPlane. QueryPlane is an app builder for your database: bring your own postgres db and you can create interactive applications to share with other developers, coworkers or even your customers. If you’re interested in trying it out, get started here.

---

MCP (Model Context Protocol) lets AI tools like Claude Desktop, Claude Code, Cursor, and Codex connect directly to your BigQuery data warehouse. Instead of copy-pasting schemas and query results into chat, the AI can inspect your datasets, run SQL, and analyze your data autonomously.

In this post, we’ll cover:

• What is MCP — How the protocol works
• Best BigQuery MCP servers — Google’s official toolbox and dedicated options
• Setup guides — Step-by-step for Claude Desktop and Claude Code
• Security considerations — Keeping your data warehouse safe

What is MCP?

The Model Context Protocol is an open standard created by Anthropic that lets AI applications connect to external data sources and tools. Think of it as a USB-C port for AI — a standardized way for any AI client to talk to any data source.

For data warehouses like BigQuery, MCP servers expose tools for exploring datasets, running SQL, and managing resources — all callable by AI agents without manual context.

Best BigQuery MCP Servers

1. Google MCP Toolbox for Databases

googleapis/mcp-toolbox (~14,800 stars) is the best option for BigQuery. Built by Google, it has native IAM authentication and supports BigQuery alongside PostgreSQL, MySQL, Snowflake, ClickHouse, and more.

Features:

• Prebuilt generic tools (list_tables, execute_sql)
• Custom tools framework for domain-specific queries
• IAM authentication (no password management)
• Connection pooling
• OpenTelemetry observability built in

Best for: Any team using BigQuery, especially those already on Google Cloud.

2. mcp-bigquery-server

ergut/mcp-bigquery-server (~140 stars) is a dedicated BigQuery MCP server with read-only access.

Features:

• Read-only BigQuery access
• Dataset and table exploration
• SQL query execution
• Sensitive data protection with field-level access restrictions
• Automated sensitive field scanner for PII/PHI columns

Claude Desktop config:

{
  "mcpServers": {
    "bigquery": {
      "command": "npx",
      "args": [
        "-y",
        "@ergut/mcp-bigquery-server",
        "--project-id", "your-gcp-project",
        "--location", "US"
      ]
    }
  }
}

3. mcp-server-bigquery

LucasHild/mcp-server-bigquery (~125 stars) is another dedicated option with a Python-based implementation.

Which BigQuery MCP Server Should You Use?

Server	Stars	Official?	Multi-database	IAM auth
Google MCP Toolbox	~14,800	Yes	Yes	Yes
mcp-bigquery-server	~140	Community	No	Yes
mcp-server-bigquery	~125	Community	No	Yes

For most developers, use Google MCP Toolbox — it’s the official solution with the best IAM integration. For a lightweight dedicated option, try mcp-bigquery-server.

Security Considerations

Connecting an AI agent to BigQuery carries risk. Follow these practices:

• Use a dedicated service account — create a service account with minimal BigQuery roles
• Grant BigQuery Data Viewer only — avoid granting Editor or Admin roles
• Limit dataset access — use IAM conditions or authorized views to restrict visible data
• Set query cost limits — configure maximum bytes billed to prevent expensive scans
• Don’t expose service account keys — use workload identity or application default credentials
• Monitor via Cloud Audit Logs — track what queries the AI runs

# Create a dedicated service account for MCP
gcloud iam service-accounts create mcp-reader \
  --display-name="MCP BigQuery Reader"

# Grant read-only access to a specific dataset
bq add-iam-policy-binding \
  --member="serviceAccount:mcp-reader@project.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataViewer" \
  your_dataset

Using MCP with QueryPlane

If you want the benefits of AI-powered database access without managing MCP servers, QueryPlane provides this out of the box. Connect your BigQuery project and use AI to generate queries, explore schemas, and build dashboards — all from your browser with built-in access controls and team collaboration.

FAQ

What is a BigQuery MCP server?

A BigQuery MCP server is a process that implements the Model Context Protocol to let AI tools (Claude, Cursor, Codex, Windsurf) connect to your BigQuery data warehouse. It exposes tools for listing datasets, describing schemas, and running SQL queries.

How do I connect Claude to BigQuery?

Install Google’s MCP Toolbox or a dedicated BigQuery MCP server, then add it to your Claude Desktop config or use claude mcp add in Claude Code. Authentication uses Google Cloud IAM.

Is it safe to connect AI to BigQuery?

It can be safe with proper precautions: use a dedicated service account with Data Viewer role, limit dataset access, set maximum bytes billed, and monitor queries via Cloud Audit Logs.

How do I control BigQuery costs with MCP?

Set the maximumBytesBilled parameter on queries to cap scan size. Use a dedicated service account with limited dataset access so the AI can only query approved tables.

Wrapping up

BigQuery has strong MCP support through Google’s official MCP Toolbox. The IAM-based authentication model makes it straightforward to set up secure, cost-controlled access. Start with a read-only service account, set query cost limits, and see how AI-powered data access fits your analytics workflow.