chdb-mcp
OfficialThe chdb-mcp server provides an MCP interface to chDB, an in-process ClickHouse SQL OLAP engine, letting AI agents run analytical SQL queries against local files, in-memory data, and remote sources without a separate server or Docker setup.
Tools available:
query(sql, format)— Execute read-only SQL (SELECT/SHOW/DESCRIBE/EXPLAIN) using ClickHouse SQL dialect; supports output formats likeJSONCompact,CSVWithNames,Pretty, etc. Write access enabled viaCHDB_MCP_WRITE=1.list_databases()— Enumerate all databases visible to the current chDB session.list_tables(database)— List all tables within a specified database.describe_table(database, table)— Retrieve column names and types for a specific table.query_file(path, sql, format)— Query local files (Parquet, CSV, JSON, Arrow, etc.) directly using SQL with a{file}placeholder.get_sample_data(database, table, limit)— Fetch the first N rows (up to 1,000) from a table as a quick preview.list_functions(pattern)— Browse 1,000+ ClickHouse SQL functions with optional substring filtering.
Key characteristics:
Read-only by default — writes blocked unless
CHDB_MCP_WRITE=1is set.Configurable safety limits — result size cap (default 1 MiB) and query timeout (default 30s).
File allowlist — restrict file/URL/S3 access to specific path prefixes via
CHDB_MCP_FILE_ALLOWLIST.Broad data source support — Parquet, CSV, JSON, Avro, ORC, Arrow, S3, MongoDB, PostgreSQL, MySQL, Iceberg, Delta Lake, and more, natively in SQL.
Federation — query remote ClickHouse clusters and combine with local data sources.
pandas integration — zero-copy data processing with pandas DataFrames.
Allows querying local and remote ClickHouse databases with full ClickHouse SQL syntax and functions, including federation via remoteSecure().
Enables direct SQL queries on MongoDB collections using the mongodb() table function.
Enables direct SQL queries on MySQL tables using the mysql() table function.
Provides a pandas-like API and zero-copy DataFrame querying, enabling SQL queries on pandas DataFrames.
Enables direct SQL queries on PostgreSQL tables using the postgresql() table function.
Allows querying Prometheus metrics via prometheusQuery* table functions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@chdb-mcpQuery sales.parquet for total revenue by region"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
chdb-mcp
This project is superseded by mcp-clickhouse.
chDB support now ships in the official ClickHouse MCP server: install with
pip install 'mcp-clickhouse[chdb]', set CHDB_ENABLED=true (and CHDB_DATA_PATH
for persistence), and agents get a run_chdb_select_query tool backed by embedded
chDB — standalone or alongside a ClickHouse server connection. It can be enabled with
configuration only, matching the ClickHouse MCP experience.
chdb-mcp remains available on PyPI but is no longer the recommended entry point
and will only receive critical fixes.
An MCP server for chDB, the in-process SQL OLAP engine powered by ClickHouse. Lets agents (Claude Desktop, Cursor, VS Code, Codex CLI, Cline, …) query Parquet, CSV, JSON, and pandas DataFrames with one tool — no separate server, no Docker.
Why chdb-mcp?
Full ClickHouse engine, in-process. 1000+ functions (
windowFunnel,quantilesTDigest,geoToH3, the-If/-State/-Mergecombinators), typedJSONwith O(1) sub-column reads, native vectors,MergeTreestorage.Drop-in pandas API.
import datastore as pdcovers ~300 pandas-shaped methods compiled to ClickHouse SQL. v1.0 addsdataframe_query()for zero-copyPython(df).~80 formats and 12+ source connectors in core. Parquet, CSV, JSON, Avro, ORC, Arrow, Protobuf, plus
s3(),mongodb(),postgresql(),mysql(),iceberg(),deltaLake()— noINSTALL/LOADchain.Federate to remote ClickHouse in one statement. (v0.5)
remoteSecure('cluster:9440', 'db.table', ...)joins local Parquet with a production ClickHouse cluster in one optimised plan.Same SQL as your warehouse. Copy-paste ClickHouse production queries into the agent prompt — no dialect bridge.
Related MCP server: Altinity MCP
Install
pip install chdb-mcpConnect
Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{ "mcpServers": { "chdb": { "command": "chdb-mcp" } } }Cursor / VS Code — same JSON in ~/.cursor/mcp.json etc.; one-click badges land in v0.2.
Codex CLI / Claude Code / Copilot / Droid — use the cross-IDE bundle chdb-agent-plugin.
Tools (v0.1)
Tool | Description |
| Run any read-only SQL on the in-process session |
| Enumerate visible databases |
| List tables in a database |
| Column types for a table |
| Query a Parquet/CSV/JSON file via the |
| First N rows of a table |
| List ClickHouse SQL functions (optional substring filter) |
Read-only by default — SET readonly=2 blocks INSERT/CREATE/DROP/ALTER while keeping file()/url()/s3() usable. Set CHDB_MCP_WRITE=1 to drop the guard. See Security model.
In query_file, {file} is replaced with file('path', 'format') before execution:
query_file(
path="/data/sales.parquet",
sql="SELECT region, sum(revenue) FROM {file} GROUP BY region",
format="Parquet",
)Configuration
Variable | Default | Effect |
| unset | If |
|
| Per-tool result cap. Enforced engine-side ( |
|
| Wall-clock cap per query (chDB |
| empty (unrestricted) |
|
| empty | Persistent session directory (default: ephemeral) |
Security model
chDB is in-process. There is no privilege boundary between the MCP server and the host Python interpreter, so the server can't make stronger isolation guarantees than the host already gives it. The model below reflects that.
Trust tiers
Default (no
CHDB_MCP_FILE_ALLOWLIST) — no filesystem gating.query()andquery_file()can reach anything the host process can reach (anyfile(),url(),s3(),remote()...). Appropriate when the agent is trusted, or when the surrounding host application enforces the security boundary itself.Opt-in allowlist (
CHDB_MCP_FILE_ALLOWLIST=/data:/tmp/foo) — best-effort defense in depth:query_file()rejects paths whose resolved (symlink-followed) form isn't under any listed prefix.Both
query()andquery_file()reject SQL containing any table function that isn't on the safe-by-construction list (numbers/values/view/merge/dictionary/generateRandom/...). The "known" set is snapshotted fromsystem.table_functionsat session start, so the gate stays in sync with whatever the running chDB build actually exposes — including new external-source variants (paimon*,prometheusQuery*,iceberg*Azure/S3/HDFS), RCE-class functions (executable,python), and*Clustersiblings, without a hand-maintained denylist that goes stale.For
query_file(), the scan runs on the user SQL before the{file}placeholder substitution, so aUNION ALL SELECT … FROM file('/etc/passwd', …)smuggled into the query body is caught even though the explicit path is gated.The scanner is comment- and string-aware (single-pass mask covering line comments, block comments, single-quoted strings with
''/\'/\\escapes), and it normalizes backtick- and double-quote-wrapped identifiers (`file`/"file") before matching so quoted function names can't bypass it.This is not a sandbox: a determined caller can still try to exfiltrate via undiscovered functions, settings, or future chDB features. Strong enough for casual agent mistakes, not for adversarial input.
Hard isolation — for adversarial input, wrap the server in OS-level confinement: macOS App Sandbox, Linux user namespaces / seccomp, or Docker with a read-only filesystem mount. Nothing at the MCP layer can substitute for this.
What's protected
Accidental writes —
SET readonly=2is applied at session start.CHDB_MCP_WRITE=1lifts it. (Note: ClickHouse'sreadonly=2still permitsTEMPORARY TABLEwrites and runtimeSETchanges — by design, not a bug.)Runaway result sizes —
CHDB_MCP_MAX_RESULT_BYTESis enforced engine-side (max_block_size+max_result_bytes+result_overflow_mode='break'), not just as a post-hoc string slice. Large queries no longer materialize multi-MiB in chDB before truncation.Runaway wall-clock —
CHDB_MCP_QUERY_TIMEOUT_SEC(default 30s) caps each query via chDB'smax_execution_time.SQL-identifier injection —
list_tables/describe_table/get_sample_dataarguments are whitelist-regex'd ([A-Za-z_][A-Za-z0-9_]*only) and backtick-quoted before interpolation.SQL string-literal escape —
list_functions(pattern)andquery_file(path, format)arguments are passed throughquote_string, which escapes both single quotes ('→'') and backslashes (\→\\) so that ClickHouse's\'escape form cannot break out of the literal.
What's NOT protected
SQL audit. Only the readonly guard — no allow/deny list of statements. Treat the agent as having full
SELECTaccess to anything chDB can reach (subject to the allowlist when set).Setting tampering. Under
readonly=2, the agent can stillSET max_memory_usage = …to raise resource caps. Lock this down at the host or via OS-level resource limits if it matters.Memory / CPU caps. chDB's
max_memory_usageapplies, but there's noulimit/cgroupsequivalent imposed by the MCP layer.
For agents acting on untrusted input, run in a throwaway container.
Roadmap
v0.5 —
query_remote_clickhouse()federation toolv1.0 —
attach_file(),dataframe_query()(zero-copyPython(df)), HTTP/SSE transport with Bearer auth,.mcpbbundle for Claude Desktop one-click install
Troubleshooting
macOS: "Server disconnected" in Claude Desktop
If ~/Library/Logs/Claude/mcp-server-chdb.log shows PermissionError: Operation not permitted on pyvenv.cfg, your venv sits under a TCC-protected directory (~/Downloads, ~/Documents, ~/Desktop) — Claude Desktop subprocesses can't read those paths.
Fix: install elsewhere. Recommended is uvx (zero-config, isolated under ~/.local/share/uv/):
{ "mcpServers": { "chdb": { "command": "uvx", "args": ["chdb-mcp"] } } }Or build a venv yourself under ~/.local/share/chdb-mcp/.venv and point Claude Desktop at its chdb-mcp binary.
query_file returns "path is not under any prefix"
The allowlist resolves symlinks on both sides (so /tmp matches /private/tmp on macOS). If you still hit this, check the resolved form printed in the error against python -c "from pathlib import Path; print(Path('YOUR_PATH').resolve())".
"Cannot execute query in readonly mode"
SET readonly=2 blocks DDL/DML by design. Rewrite as a pure SELECT, or restart with CHDB_MCP_WRITE=1.
Per-server logs
~/Library/Logs/Claude/mcp-server-chdb.log # startup diagnostics + stderr
~/Library/Logs/Claude/mcp.log # all servers' JSON-RPC trafficDevelopment
git clone https://github.com/chdb-io/chdb-mcp && cd chdb-mcp
pip install -e ".[dev]"
pytest && ruff check src testsLicense
Apache 2.0 — see LICENSE.
Available Tools
7 toolsdescribe_tableA
Return column types for a table.
Args: database: Database name (plain identifier). table: Table name (plain identifier).
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes | ||
| table | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It does not state that the operation is read-only, whether it requires specific permissions, or what happens if the table does not exist. The description only conveys the basic action without side effects or constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with only two sentences. It front-loads the main purpose and then lists parameters in a standard format. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists, the description does not need to detail return values. However, it lacks mention of error handling or behavior for missing tables. The tool is simple, so the completeness is borderline adequate but could be improved.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no descriptions (0% coverage), so the description's annotation of each parameter as a 'plain identifier' adds meaningful context beyond the schema. This clarifies that identifiers should not be quoted or schema-qualified, which helps the agent properly invoke the tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Return column types for a table,' which is a specific verb-resource combination. It is easily distinguished from sibling tools like get_sample_data or list_tables, which perform different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, such as requiring an existing database or table, nor does it advise against using it for retrieving actual data.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_sample_dataA
Return the first N rows of a table.
Args:
database: Database name (plain identifier).
table: Table name (plain identifier).
limit: Maximum rows. Clamped to [1, 1000].
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes | ||
| table | Yes | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses limit clamping to [1,1000], which is a key behavioral trait. Does not mention potential errors or that the operation is read-only, though that is implied. Adding a note about ordering or error handling would increase transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and to the point, using a structured Args format. Every sentence adds value. Minor reduction because the Args block is somewhat verbose for a simple tool, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and presence of output schema, description covers essential aspects: purpose, parameters, limit clamping. Lacks mention of result ordering (e.g., arbitrary) or error handling for missing tables. Still adequate for most use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 0%, so description must compensate. Adds meaning to all three parameters: explains 'database' and 'table' as plain identifiers, and documents limit clamping behavior. However, does not define 'plain identifier' (e.g., case sensitivity), so slight gap remains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it returns the first N rows of a table, which is a specific verb+resource. Differentiates from sibling tools like query (arbitrary SQL) and describe_table (schema retrieval) by specifying a limited preview.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Indirectly implies use for quick sampling ('first N rows'), but does not explicitly state when not to use it (e.g., for full queries use query) or provide alternatives. Could be improved by mentioning that query supports arbitrary SQL.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_databasesA
List databases visible to the chDB session.
Returns one database name per line (TabSeparated format).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite missing annotations, the description explicitly states the output format ('TabSeparated format') and the scope ('visible to the chDB session'), providing useful behavioral detail beyond a simple list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-load the purpose and add a critical output detail. No extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, straightforward list operation) and the presence of an output schema, the description fully covers what an agent needs: what it lists and the return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0 parameters and 100% schema coverage, the description correctly adds no param details. For zero-parameter tools, the baseline is 4, and the description meets that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'List databases visible to the chDB session' with a specific verb and resource. Differentiates from sibling tools like list_tables or list_functions by focusing solely on databases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Without context on when listing databases is appropriate or how it differs from other list tools, the agent lacks decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_functionsA
List SQL functions available in the chDB engine.
Returns name, is_aggregate, case_insensitive, alias_to for
each entry in system.functions — useful for agents discovering
ClickHouse's 1000+ function library (windowFunnel, quantilesTDigest,
-If/-State/-Merge combinators, etc.) in one round trip.
Args: pattern: Optional case-insensitive substring filter on the function name. Plain text only; SQL wildcards and quotes are escaped.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It explains the read-only behavior, returned fields, and filter semantics (case-insensitive, no wildcards). Missing details on permissions or error handling, but adequate for a list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a front-loaded purpose and a clear Args section. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity, an output schema exists, and the description covers the returned fields and filter behavior, it is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, but the description fully explains the 'pattern' parameter's behavior (case-insensitive substring, plain text only, wildcards escaped), adding significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists SQL functions, specifies the returned fields (name, is_aggregate, etc.), and distinguishes from sibling tools which deal with tables, databases, queries, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a use case (discovering functions in one round trip) but does not explicitly state when to use vs alternatives or when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_tablesA
List tables in a given database.
Args: database: Database name. Must be a plain SQL identifier (letters, digits, underscore — no quotes, dots, or spaces).
| Name | Required | Description | Default |
|---|---|---|---|
| database | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds one behavioral trait: the database parameter must be a plain SQL identifier. However, it does not disclose other important behaviors like read-only nature, permission requirements, or whether only visible tables are returned. With no annotations, the description carries the full burden and partially meets it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences, no wasted words, and the primary action is stated first. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter) and the presence of an output schema, the description is nearly complete. It explains the tool's purpose and parameter constraints. A minor gap is the lack of mention of return format, but that is covered by the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description fully compensates by specifying the database parameter's format (plain SQL identifier) and providing concrete constraints (letters, digits, underscore, no quotes, dots, or spaces), adding significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists tables in a given database using a specific verb and resource, and it is easily distinguishable from sibling tools like list_databases (lists databases) and describe_table (describes a specific table).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as prerequisites (e.g., need to know database name first) or exclusions (e.g., cannot list tables across databases).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryA
Execute an arbitrary SQL statement against the chDB session.
Use ClickHouse SQL dialect. Common formats: JSONCompact (default),
CSVWithNames, TabSeparatedWithNames, Pretty. The result is
truncated at CHDB_MCP_MAX_RESULT_BYTES (default 1 MiB) and the query
is aborted after CHDB_MCP_QUERY_TIMEOUT_SEC seconds (default 30).
Args:
sql: Any read-only SQL (SELECT/SHOW/DESCRIBE/EXPLAIN). Writes require
CHDB_MCP_WRITE=1. When CHDB_MCP_FILE_ALLOWLIST is set,
any table function that isn't on the safe-by-construction list
(numbers/values/view/merge/dictionary/etc.) is rejected — that
includes file/url/s3/remote/executable/python and every other
external-reach function chDB exposes. Use query_file() for
files instead.
format: Output format passed to chDB. Defaults to JSONCompact.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | ||
| format | No | JSONCompact |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: result truncation limit (CHDB_MCP_MAX_RESULT_BYTES), query timeout (CHDB_MCP_QUERY_TIMEOUT_SEC), write permission requirement (CHDB_MCP_WRITE=1), and safety restrictions for external functions under CHDB_MCP_FILE_ALLOWLIST.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and concise, using a paragraph for core usage and bullet points for details. Every sentence provides necessary information without redundancy, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of executing arbitrary SQL with security constraints, the description is remarkably complete. It covers execution limits, write permissions, file allowlist restrictions, format options, and the existence of an output schema reduces the need to explain return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates thoroughly. The sql parameter is explained with read-only vs write usage, and the format parameter is described with default value and common formats list. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute an arbitrary SQL statement against the chDB session' which is a specific verb+resource. It distinguishes from sibling tools like query_file by explicitly directing users to that tool for file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool: for read-only SQL by default, with writes requiring a specific environment variable. It also notes that many table functions are rejected when a file allowlist is set, and directs users to query_file() for files, effectively differentiating from siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_fileA
Query a local file (Parquet/CSV/JSON/…) as if it were a table.
The literal token {file} in sql is substituted with a
file('path', 'format') table-function call before execution.
Example::
query_file(
path="/data/sales.parquet",
sql="SELECT region, sum(revenue) FROM {file} GROUP BY region",
format="Parquet",
)Args:
path: Filesystem path. If CHDB_MCP_FILE_ALLOWLIST is set, the
resolved path must sit under one of its prefixes.
sql: Query body. Must contain the literal placeholder {file}.
When CHDB_MCP_FILE_ALLOWLIST is set, the SQL is scanned
before substitution; any extra table function call other than
the placeholder (e.g. a UNION with file('/etc/passwd', ...)
or a stray url()/executable()) is rejected.
format: chDB file format hint. Common values: Parquet, CSV,
CSVWithNames, JSONEachRow, Arrow.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| sql | Yes | ||
| format | No | Parquet |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses file format support, placeholder substitution behavior, and security scanning/rejection of malicious SQL when allowlist is set. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with summary, example, and bulleted args. Slightly verbose (e.g., repeated allowlist explanations), but information density is high.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers parameters, usage, and security comprehensively. Has output schema so return values are covered. Could mention error scenarios or performance implications, but given complexity it's fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully explains each parameter: path (with allowlist constraint), sql (must contain '{file}', scanning behavior), and format (hints with common values). This compensates for the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it queries local files (Parquet, CSV, JSON, etc.) as a table. It provides a concrete example with placeholders, distinguishing it from sibling tools like 'query' (which queries database tables) and 'describe_table'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It specifies when to use (querying local files) and explains the placeholder substitution and security allowlist. However, it does not explicitly contrast with alternatives or mention when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v0.2.0- First observed
describe_table - First observed
get_sample_data - First observed
list_databases - First observed
list_functions - First observed
list_tables - First observed
query - First observed
query_file
TDQS
Each tool targets a distinct operation: listing databases vs. tables vs. functions, describing a table, retrieving sample data, executing arbitrary queries, and querying files. No overlap in purpose.
All tool names follow a clear verb_noun pattern (list_databases, list_tables, describe_table, get_sample_data, query, query_file). The naming is predictable and uniform.
With 7 tools, the server is well-scoped for a database MCP server. It covers introspection, data querying, and file integration without being overly numerous or sparse.
The tool set covers essential database exploration and querying. The query tool can handle writes when enabled, and file querying is included. Minor missing features like a dedicated DDL tool exist but are workable via raw SQL.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Analytical memory for AI agents: a real Postgres queried in plain English over MCP. One command.
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Query your warehouse or a CSV with Claude/ChatGPT over MCP, governed by table-level ACL + audit.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceMCP-Server from your Database optimized for LLMs and AI-Agents. Supports PostgreSQL, MySQL, ClickHouse, Snowflake, MSSQL, BigQuery, Oracle Database, SQLite, ElasticSearch, DuckDB547Apache 2.0

Altinity MCPofficial
FlicenseNot gradedqualityAmaintenanceProduction-ready MCP server designed to empower AI agents and LLMs to interact seamlessly with ClickHouse. It exposes your ClickHouse database as a set of standardized tools and resources that adhere to the MCP protocol, making it easy for agents built on OpenAI, Claude, or other platforms to query, explore, and analyse your data.37-- AlicenseNot gradedqualityCmaintenanceOne config, one CLI that turns your databases (Postgres, MySQL, SQLite, MongoDB) into MCP servers for Claude, GPT, Cursor, and any MCP-compatible agent.1MIT
- AlicenseNot gradedqualityAmaintenanceA dead-simple, self-hosted MCP server for querying your databases with AI agents.2MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/chdb-io/chdb-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server