# MCP Toolbox for Databases > MCP Toolbox for Databases is Google's open-source MCP server for more than 30 data sources, among them BigQuery, AlloyDB, Cloud SQL, Spanner and PostgreSQL. It runs as a binary or container with prebuilt or custom tools from tools.yaml. - Canonical: https://www.anchorterminal.com/tools/mcp-toolbox-databases - Pricing: https://www.anchorterminal.com/tools/mcp-toolbox-databases#pricing - Reviews: https://www.anchorterminal.com/tools/mcp-toolbox-databases#reviews - Markdown: https://www.anchorterminal.com/tools/mcp-toolbox-databases.md (~5,900 tokens) - Slim: https://www.anchorterminal.com/tools/mcp-toolbox-databases.min.md (~1,330 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/mcp-toolbox-databases.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT mcp-toolbox-databases.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 ## Overview **Grade BB · 77.7/100 · rank #27 of 1486 · #2 in Databases & files · agent-ready · confidence medium** ## Assessment One self-hosted server reaches 57 source types, with engine-level read-only locks, toolsets, optional OAuth 2.1 and fortnightly semver releases under Apache-2.0. Prebuilt sets list 9 to 41 tools, origin and host checks default to any, and 432 issues and pull requests are open. ## Facts | Field | Value | | --- | --- | | Vendor | Google (https://mcp-toolbox.dev) | | Kind | MCP server | | Category | Databases & files (https://www.anchorterminal.com/categories/data) | | Transport | stdio, Streamable HTTP | | Auth | OAuth or key · Toolbox holds the source credentials (database users and passwords from environment variables, or Google Application Default Credentials and IAM for Google sources). Clients need nothing by default. Optional MCP authorisation makes Toolbox an OAuth 2.1 resource server that validates JWT bearer tokens against a configured authorisation server and required scopes, and publishes protected-resource metadata. authServices can also bind tool parameters to a signed-in user's claims. The HTTP server listens on 127.0.0.1 by default, but --allowed-origins and --allowed-hosts default to *. | | Pricing | Free (Free · OSS) · Free and Apache-2.0, run on your own machine or your own Cloud Run service. Google Cloud sources bill for their own usage (BigQuery queries, Cloud SQL instances); Toolbox itself has no price. | | x402 | No · Self-hosted MCP server with nothing to buy (checked 2026-11-06). | | Licence | Apache-2.0 | | Tools exposed | 29 | | Packages | npm: `@toolbox-sdk/server`; pypi: `toolbox-core`; npm: `@toolbox-sdk/core` | | MCP registry name | `io.github.googleapis/mcp-toolbox` | | Source | https://github.com/googleapis/mcp-toolbox | | Docs | https://mcp-toolbox.dev/ | | llms.txt | https://mcp-toolbox.dev/llms.txt | | Last release | 2026-11-05 | | GitHub stars | 16,818 (as of 2026-11-06) | | Surface listed | The Toolbox server (binary, container and @toolbox-sdk/server), read from a shallow clone of googleapis/mcp-toolbox (README, CHANGELOG, SECURITY.md, prebuilt configs, docs and source), mcp-toolbox.dev and the MCP registry on 6 November 2026. Nothing was installed or run | | Two ways to use it | Prebuilt generic tools (list_tables, execute_sql and the like) for coding agents, or custom tools with fixed SQL, parameters and authorised parameters for production agents | | Sources | Google Cloud (BigQuery, AlloyDB, Cloud SQL, Spanner, Bigtable, Firestore, Dataplex, Looker, Cloud Storage and more) and others such as PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Neo4j, Redis, Snowflake, ClickHouse, Elasticsearch and SQLite | | Observability | OpenTelemetry traces and metrics, exported only when --telemetry-otlp or --telemetry-gcp is set | | Security options | MCP authorisation as an OAuth 2.1 resource server, authorised parameters bound to user claims, read-only mode, Model Armor screening, --allowed-hosts and --allowed-origins | | Capabilities | db.sql, db.document, db.admin | | Tags | self-hosted, free, open-source, mcp, stdio, http, mcp-registry, llms-txt, google-cloud, bigquery, postgres, toolsets, read-only-mode, opentelemetry, go | | JSON | https://www.anchorterminal.com/api/v1/tools/mcp-toolbox-databases.json | ## Score breakdown (methodology v0.7, October 2026 research run) Assessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 80 | 16.0 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 85 | 13.8 | | Agent ergonomics | 13% | 16.2 | 82 | 13.3 | | Security & auth | 14% | 17.5 | 75 | 13.1 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 95 | 8.3 | | Transparency & trust (editorial 77, provenance 50) | 7% | 8.8 | 64 | 5.6 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **77.7 → BB** | ### Why each score - Reliability 80 (checked 2026-11-06): Scored as local software the owner runs. A Go binary, a container in Artifact Registry and @toolbox-sdk/server on npm, with install paths per platform (20). Tests, lint, conformance and nightly tier-report workflows in the repository; the pass state wasn't read (15). 432 open issues and pull requests on a repository with 16,818 stars and releases every two weeks, triaged with labels, though the backlog is large (15). Semantic versioning with a published policy, release-please CHANGELOG and an UPGRADING.md (15). 1.x since well before this check, v1.16.0 now (15). 20 + 15 + 15 + 15 + 15 = 80. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 85 (checked 2026-11-06): Every tool's parameters are typed in tools.yaml and published as JSON Schema over MCP (25). mcp-toolbox.dev serves llms.txt (10). Prebuilt descriptions vary from one line ("Use this tool to execute a single SQL statement.") to detailed, and few say when not to use a tool (12). Typed parameters with required flags; execute_sql takes free SQL (12). Many examples, samples and codelabs; error responses are thinly documented (11). Semver, a dated CHANGELOG and versioned docs (15). 25 + 10 + 12 + 12 + 11 + 15 = 85. - Agent ergonomics 82 (checked 2026-11-06): The PostgreSQL prebuilt set lists 29 tools (15), split into five toolsets a client can load one at a time, and write tools disappear in read-only mode (plus 8). Results are bounded per tool, some prebuilt tools take limits, and BigQuery tools compact empty schema fields (14). Errors come back as tool errors; paths are sanitised from file errors since 1.15.0 (12). readOnlyHint and destructiveHint are set per tool and switch with the source's read-only state (18). Prebuilt sets need only environment variables, and SDKs exist in Python, JavaScript, Go and Java (15). 23 + 14 + 12 + 18 + 15 = 82. - Security & auth 75 (checked 2026-11-06): Source credentials stay in Toolbox, Google sources use IAM, and optional MCP authorisation validates OAuth 2.1 JWTs with required scopes. --allowed-origins and --allowed-hosts default to *, which the CLI docs themselves call unsafe even on localhost, though the default bind is 127.0.0.1 (20). Read-only mode is enforced at the engine, write tools are suppressed, and custom tools can fix SQL and bind parameters to the signed-in user (18). The security docs cover prompt injection and screening through Model Armor (12). OpenTelemetry traces and metrics per call when exported (10). Google's vulnerability intake with a stated response time and GitHub advisories (15). 20 + 18 + 12 + 10 + 15 = 75. - Payments & pricing 60 (checked 2026-11-06): Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 95 (checked 2026-11-06): v1.16.0 on 5 November 2026, one day before this check (30). Eight releases from v1.10.0 (27 August) to v1.16.0 in the 90 days (20). Pull requests merge daily and new tools land in each fortnightly release, though 432 issues and pull requests are open (20). io.github.googleapis/mcp-toolbox is in the official registry at 1.16.0 (15). Release automation, lint, tests and conformance workflows (10). 30 + 20 + 20 + 15 + 10 = 95. - Transparency & trust 64 (checked 2026-11-06): Apache-2.0 (30). A self-hosted server; data goes only to the configured sources and to a telemetry exporter if one is set. There is no data-handling statement of its own (15). A versioning policy defining breaking changes, UPGRADING.md and a notice for the repository rename; prebuilt tool removals are listed in the changelog (16). Telemetry is off unless --telemetry-otlp or --telemetry-gcp is set, and the docs say so (16). 30 + 15 + 16 + 16 = 77. Fix list, everything this grade says the listing lacks, the biggest gain first (16 items). What it covers is at https://www.anchorterminal.com/fixes/mcp-toolbox-databases.md (JSON https://www.anchorterminal.com/fixes/mcp-toolbox-databases.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{"listing": "mcp-toolbox-databases", "plan": "read"}`, free while the beta runs ### What we couldn't check - unchecked: whether the tests workflow passes on the default branch. - Our reader fetched https://pypi.org/pypi/toolbox-core/json once on 6 November, a path PyPI's robots.txt disallows. The version it gave (1.4.0) was re-read from the allowed release feed https://pypi.org/rss/project/toolbox-core/releases.xml, which is the source used. - unchecked: GA status per source; the minor-version policy mentions beta functions, and per-source stability labels weren't read. ### Sources - repository and README: (seen 2026-11-06) - CHANGELOG: (seen 2026-11-06) - SECURITY.md: (seen 2026-11-06) - read-only security docs: (seen 2026-11-06) - CLI reference: (seen 2026-11-06) - MCP authorisation docs: (seen 2026-11-06) - docs site llms.txt: (seen 2026-11-06) - toolbox-core release feed: (seen 2026-11-06) - MCP registry entries: (seen 2026-11-06) ## Score history Every move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/mcp-toolbox-databases/history.json - 2026-11-06: graded 77.7 BB (methodology 0.7) ## Who's behind it (provenance 50/100, checked 2026-11-06) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Google LLC | 20/20 | | Domain age | mcp-toolbox.dev, no registry record we could read | 0/15 | | Endpoint on the vendor's domain | mcp-toolbox.dev | 15/15 | | Terms of service | not found | 0/10 | | Privacy policy | not found | 0/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | not found | 0/10 | | People named | 5 named with their role, none with a public profile | 7/10 | | Support route | help pages, a community | 5/5 | Source files carry "Copyright 2025 Google LLC" under Apache-2.0, and the repository is in the googleapis organisation. SECURITY.md routes reports to g.co/vulnz with a five-working-day response and discloses through GitHub Security Advisories. mcp-toolbox.dev/robots.txt allows all crawlers and serves llms.txt. Its registration date wasn't found through RDAP. No terms or privacy policy specific to Toolbox, which sends nothing to Google unless GCP telemetry export or a Google source is configured. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0. **Privacy policy**. We found no privacy policy published for this product, so there is nothing to read and the check scores 0. ## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade) ### Key people - Larry Page, Co-founder, Google, left executive roles in December 2019 and sits on Alphabet's board - Sergey Brin, Co-founder, Google, left executive roles in 2019 and sits on Alphabet's board - Sundar Pichai, CEO, Google and Alphabet - Thomas Kurian, CEO, Google Cloud - Demis Hassabis, Co-founder and CEO, Google DeepMind - Note: MCP Toolbox for Databases is published by Google in the googleapis GitHub organisation (source files carry Copyright Google LLC). The company-level people are copied from data/humans/google-secret-manager.json (checked 28 October 2026) with their sources. No product lead is named in the repository or on mcp-toolbox.dev, so none is added. Google is part of Alphabet, so no investors are listed. - Google Cloud: LinkedIn https://www.linkedin.com/company/google X https://x.com/Google GitHub https://github.com/googleapis ### Ownership and investors - Ownership: Part of Alphabet Inc. ### Getting support - Discord: https://discord.gg/Dmm69peqjh - Help: https://mcp-toolbox.dev/ - Community (mcp-toolbox issues): https://github.com/googleapis/mcp-toolbox/issues - Sources: https://about.google/intl/ALL_en/our-story/, https://cloud.google.com/contact, https://cloud.google.com/support-hub, https://github.com/googleapis/mcp-toolbox, https://mcp-toolbox.dev/, https://www.linkedin.com/company/google, https://x.com/Google ## Live (updated 2026-11-07 18:16 UTC) - github `googleapis/mcp-toolbox` v1.16.0, released 2026-11-05 - mcp-registry `io.github.googleapis/mcp-toolbox` 1.16.0 - npm `@toolbox-sdk/core` 1.2.0 - npm `@toolbox-sdk/server` 1.16.0 - pypi `toolbox-core` 1.4.0, released 2026-09-01 - security.txt: none - Watching changelog - Always current: https://www.anchorterminal.com/api/v1/live/mcp-toolbox-databases.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - 57 source types and 39 prebuilt configurations, from BigQuery and AlloyDB to PostgreSQL, MySQL, MongoDB and Snowflake - Read-only mode locks the database session, hides write tools and sets readOnlyHint - Custom tools in tools.yaml fix SQL and bind parameters to the signed-in user's claims - Optional MCP authorisation as an OAuth 2.1 resource server with protected-resource metadata - v1.16.0 on 5 November 2026 after eight releases in 90 days, in the MCP registry ## Weaknesses - --allowed-origins and --allowed-hosts default to *, which the docs call unsafe - Prebuilt PostgreSQL set lists 29 tools and AlloyDB 41 unless a toolset is chosen - 432 open issues and pull requests - Some prebuilt descriptions are a single line with no guidance on when not to use the tool ## Before you call it (notes for agents) 1. Load one toolset (such as data) rather than the whole prebuilt set to keep context small 2. Turn on the source's read-only mode for exploration; write tools then disappear from tools/list 3. Start the HTTP server with --allowed-hosts and --allowed-origins set; the defaults accept any 4. Prefer custom tools with fixed SQL over execute_sql for production agents ## Connect Install: ```bash npx @toolbox-sdk/server --prebuilt postgres --stdio ``` MCP client configuration: ```json { "mcpServers": { "postgres": { "args": [ "-y", "@toolbox-sdk/server", "--prebuilt", "postgres", "--stdio" ], "command": "npx", "env": { "POSTGRES_DATABASE": "mydb", "POSTGRES_HOST": "localhost", "POSTGRES_PASSWORD": "password", "POSTGRES_USER": "user" } } } } ``` Through letme: https://letme.dev/mcp-toolbox-databases (letme picks it for db.sql, the top-graded tool for the job). letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | MongoDB MCP Server | A | 80.2 | 13 | db.document, db.admin | no | https://www.anchorterminal.com/tools/mongodb-mcp.md | | Supabase API + MCP | BB | 74 | 94 | db.sql, db.admin | no | https://www.anchorterminal.com/tools/supabase-mcp.md | | Neon MCP Server | BB | 72.5 | 124 | db.sql, db.admin | no | https://www.anchorterminal.com/tools/neon-mcp.md | | DBHub | BB | 70.4 | 200 | db.sql, db.admin | no | https://www.anchorterminal.com/tools/dbhub.md | | PlanetScale MCP Server | B | 69.6 | 233 | db.sql, db.admin | no | https://www.anchorterminal.com/tools/planetscale-mcp.md | | Postgres MCP Pro | F | 37 | 1357 | db.sql, db.admin | no | https://www.anchorterminal.com/tools/postgres-mcp-pro.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - Renamed from Gen AI Toolbox for Databases; the repository moved from googleapis/genai-toolbox to googleapis/mcp-toolbox and the old registry entry io.github.googleapis/genai-toolbox stops at 0.31.0 (README; https://registry.modelcontextprotocol.io/v0/servers?search=googleapis) - 57 source types and 39 prebuilt configurations; the PostgreSQL prebuilt set has 29 tools in five toolsets (data, monitor, health, view-config and replication), BigQuery 9, Cloud Storage 14 and AlloyDB for PostgreSQL 41 (internal/prebuiltconfigs/tools) - Read-only protection in three layers, engine-level session locks, suppression of write tools and readOnlyHint annotations set from the source's read-only state (docs/en/documentation/configuration/security/read-only.md) - v1.16.0 on 5 November 2026, with eight minor and patch releases since 27 August under release-please and a semver policy covering the CLI, manifests and prebuilt toolsets (CHANGELOG.md) - Security reports go to Google's g.co/vulnz with a five-working-day response and GitHub Security Advisories for disclosure (SECURITY.md) - SDKs in Python (toolbox-core 1.4.0), JavaScript (@toolbox-sdk/core 1.2.0), Go and Java, with integrations for ADK, LangChain and LlamaIndex (README) - #2 of 16 in Best database, file and memory tools for AI agents: https://www.anchorterminal.com/best/data/index.md - All 97 databases comparisons: https://www.anchorterminal.com/compare/data/index.md ## Compare - [ClickHouse MCP Server vs MCP Toolbox for Databases](https://www.anchorterminal.com/compare/clickhouse-mcp-server-vs-mcp-toolbox-databases.md): B 68.8 vs BB 77.7 - [DBHub vs MCP Toolbox for Databases](https://www.anchorterminal.com/compare/dbhub-vs-mcp-toolbox-databases.md): BB 70.4 vs BB 77.7 - [MCP Toolbox for Databases vs Neon MCP Server](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-neon-mcp.md): BB 77.7 vs BB 72.5 - [MCP Toolbox for Databases vs ObsessionDB](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-obsessiondb.md): BB 77.7 vs E 41.1 - [MCP Toolbox for Databases vs PlanetScale MCP Server](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-planetscale-mcp.md): BB 77.7 vs B 69.6 - [MCP Toolbox for Databases vs Postgres MCP Pro](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-postgres-mcp-pro.md): BB 77.7 vs F 37 - [MCP Toolbox for Databases vs PostgreSQL (archived MCP reference server)](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-postgres-reference-server-archived.md): BB 77.7 vs F 18.6 - [MCP Toolbox for Databases vs Snowflake-managed MCP server](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-snowflake-managed.md): BB 77.7 vs D 52.7 - [MCP Toolbox for Databases vs Supabase API + MCP](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-supabase-mcp.md): BB 77.7 vs BB 74 - [MCP Toolbox for Databases vs MongoDB MCP Server](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-mongodb-mcp.md): BB 77.7 vs A 80.2 - [MCP Toolbox for Databases vs Redis MCP](https://www.anchorterminal.com/compare/mcp-toolbox-databases-vs-redis-mcp.md): BB 77.7 vs C 54.9 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on mcp-toolbox.dev or one of its subdomains, or the README at the root of github.com/googleapis/mcp-toolbox. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "mcp-toolbox-databases", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html MCP Toolbox for Databases on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![MCP Toolbox for Databases on Anchor Terminal](https://www.anchorterminal.com/badges/mcp-toolbox-databases.svg)](https://www.anchorterminal.com/tools/mcp-toolbox-databases) ``` Plain link: ```html MCP Toolbox for Databases on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say MCP Toolbox for Databases is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/mcp-toolbox-databases-dark.png - Light: https://www.anchorterminal.com/assets/share/mcp-toolbox-databases-light.png --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp