MCP Toolbox for Databases is an open source Model Context Protocol (MCP) server designed to connect AI agents, IDEs, and applications directly to enterprise databases. Built in Go and maintained by Google Cloud, it bridges the gap between large language models and structured data sources without requiring custom integration code. It addresses a common challenge in AI-assisted development: letting LLM-powered tools safely and accurately interact with live database schemas and content. Rather than building one-off database connectors for every agent or IDE plugin, MCP Toolbox provides a standardized, extensible server that speaks the MCP specification — a protocol for secure, context-aware tool calling.

What it does

  • Serves as a ready-to-run MCP server that exposes database operations as tools — including list_tables, describe_table, execute_sql, and list_databases — without writing custom logic
  • Offers a framework to define custom, production-grade tools: you specify SQL templates, input schemas, row limits, and permission scopes, then MCP Toolbox handles validation, execution, and result serialization
  • Supports multiple SDKs (Python, JavaScript/TypeScript, Go, Java) so developers can integrate the server or build tool wrappers in their preferred language
  • Enforces safety through restricted execution modes: queries can be limited to read-only, parameterized only, or constrained to predefined views — no arbitrary SQL injection by default
  • Generates OpenAPI specs and MCP manifest files automatically, enabling discovery and interoperability with MCP-compatible clients like Gemini CLI or Claude Code

Getting it running

The project provides several deployment options. The simplest is Docker:

docker run -p 8080:8080 \
  -e DATABASE_URL="postgresql://user:pass@host:5432/dbname" \
  -e MCP_TOOLBOX_MODE=generic \
  ghcr.io/googleapis/mcp-toolbox:latest

For local development, the Go binary can be built from source (requires Go 1.21+):

git clone https://github.com/googleapis/mcp-toolbox.git
cd mcp-toolbox
make build
./mcp-toolbox --database-url "sqlite://./test.db" --mode generic

The --mode generic flag enables the prebuilt database tools. To use custom tools, replace it with --mode custom --config ./config.yaml, where config.yaml defines your tool specifications — including SQL statements, input parameters, and allowed databases.

Python users can also install the SDK and launch a minimal server:

pip install toolbox-core
toolbox-server --database-url "mysql://user:pass@localhost:3306/mydb"

All modes expose an MCP-compatible /mcp/server endpoint. Logs, health checks, and OpenAPI docs are available at /healthz and /openapi.json.

Who this is for

This project targets developers and platform engineers building AI agents that need structured data access — especially those already working within the Google Cloud ecosystem or adopting the Model Context Protocol standard. Teams using Gemini, Claude, or other MCP clients benefit from immediate database tooling without writing glue code. It’s also relevant for internal AI platform teams standardizing how LLM applications query databases: the custom tools framework lets them define guardrails (e.g., “only join these three tables”, “never allow DELETE”, “parameterize all WHERE clauses”) and ship them as reusable, versioned components.

If you want database access for your AI agents but need to enforce strict SQL policies, audit query patterns, or avoid exposing raw database credentials to client-side tools, MCP Toolbox provides the scaffolding — not just the connectors.

How it compares

MCP Toolbox differs from generic database connectors like LangChain’s SQLDatabaseChain or LlamaIndex’s SQLStructStore in two key ways: it’s protocol-native (MCP-first, not LLM-adapter-first) and server-oriented. It doesn’t run inside your Python app or notebook — it’s a standalone service with built-in auth, rate limiting, and structured tool definitions. Compared to open source MCP servers like mcp-server (a generic reference implementation), MCP Toolbox is domain-specialized: it assumes databases as the primary data source and ships with opinionated, production-ready tool definitions out of the box.

It’s heavier than lightweight libraries like sqlglot or llamaparse for schema parsing, and it doesn’t replace database-specific drivers (e.g., psycopg, mysql2) — those remain the underlying execution layer. It also doesn’t handle vector search or embedding ingestion; its scope is strictly relational query and schema interaction.

Final notes

The project has 14,868 GitHub stars and is licensed under Apache 2.0. Documentation lives at mcp-toolbox.dev, with SDKs published to PyPI, npm, Go pkg, and Maven Central. The repository was renamed from genai-toolbox to mcp-toolbox to reflect its alignment with the Model Context Protocol standard.

It is not intended for users who need NoSQL support, real-time streaming results, or embedded in-process tooling — those require different architectures. For teams adopting MCP and relying on SQL-based data sources, it provides a documented, maintained, and extensible path to safe, standardized AI-to-database interaction.

View on GitHub →Official Website →