Skip to main content
Glama
chdb-io

chdb-mcp

Official
by chdb-io

chdb-mcp

IMPORTANT

This project is superseded by mcp-clickhouse. chDB support now ships in the official ClickHouse MCP server: install with pip install 'mcp-clickhouse[chdb]', set CHDB_ENABLED=true (and CHDB_DATA_PATH for persistence), and agents get a run_chdb_select_query tool backed by embedded chDB — standalone or alongside a ClickHouse server connection. It can be enabled with configuration only, matching the ClickHouse MCP experience. chdb-mcp remains available on PyPI but is no longer the recommended entry point and will only receive critical fixes.

PyPI CI License Python

An MCP server for chDB, the in-process SQL OLAP engine powered by ClickHouse. Lets agents (Claude Desktop, Cursor, VS Code, Codex CLI, Cline, …) query Parquet, CSV, JSON, and pandas DataFrames with one tool — no separate server, no Docker.

Why chdb-mcp?

  • Full ClickHouse engine, in-process. 1000+ functions (windowFunnel, quantilesTDigest, geoToH3, the -If/-State/-Merge combinators), typed JSON with O(1) sub-column reads, native vectors, MergeTree storage.

  • Drop-in pandas API. import datastore as pd covers ~300 pandas-shaped methods compiled to ClickHouse SQL. v1.0 adds dataframe_query() for zero-copy Python(df).

  • ~80 formats and 12+ source connectors in core. Parquet, CSV, JSON, Avro, ORC, Arrow, Protobuf, plus s3(), mongodb(), postgresql(), mysql(), iceberg(), deltaLake() — no INSTALL/LOAD chain.

  • Federate to remote ClickHouse in one statement. (v0.5) remoteSecure('cluster:9440', 'db.table', ...) joins local Parquet with a production ClickHouse cluster in one optimised plan.

  • Same SQL as your warehouse. Copy-paste ClickHouse production queries into the agent prompt — no dialect bridge.

Related MCP server: Altinity MCP

Install

pip install chdb-mcp

Connect

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{ "mcpServers": { "chdb": { "command": "chdb-mcp" } } }

Cursor / VS Code — same JSON in ~/.cursor/mcp.json etc.; one-click badges land in v0.2.

Codex CLI / Claude Code / Copilot / Droid — use the cross-IDE bundle chdb-agent-plugin.

Tools (v0.1)

Tool

Description

query(sql, format)

Run any read-only SQL on the in-process session

list_databases()

Enumerate visible databases

list_tables(database)

List tables in a database

describe_table(database, table)

Column types for a table

query_file(path, sql, format)

Query a Parquet/CSV/JSON file via the {file} placeholder

get_sample_data(database, table, limit)

First N rows of a table

list_functions(pattern)

List ClickHouse SQL functions (optional substring filter)

Read-only by default — SET readonly=2 blocks INSERT/CREATE/DROP/ALTER while keeping file()/url()/s3() usable. Set CHDB_MCP_WRITE=1 to drop the guard. See Security model.

In query_file, {file} is replaced with file('path', 'format') before execution:

query_file(
    path="/data/sales.parquet",
    sql="SELECT region, sum(revenue) FROM {file} GROUP BY region",
    format="Parquet",
)

Configuration

Variable

Default

Effect

CHDB_MCP_WRITE

unset

If 1, allows INSERT/CREATE/DROP/ALTER

CHDB_MCP_MAX_RESULT_BYTES

1048576

Per-tool result cap. Enforced engine-side (max_result_bytes + result_overflow_mode='break') plus a final Python slice.

CHDB_MCP_QUERY_TIMEOUT_SEC

30

Wall-clock cap per query (chDB max_execution_time). 0 disables.

CHDB_MCP_FILE_ALLOWLIST

empty (unrestricted)

:-separated path prefixes. Opt-in isolation switch — when set, query_file() rejects paths outside the prefixes, and query() rejects external table functions (file/url/s3/remote/hdfs/mongodb/...). When unset, no filesystem gating happens — the host process is trusted.

CHDB_MCP_SESSION_PATH

empty

Persistent session directory (default: ephemeral)

Security model

chDB is in-process. There is no privilege boundary between the MCP server and the host Python interpreter, so the server can't make stronger isolation guarantees than the host already gives it. The model below reflects that.

Trust tiers

  1. Default (no CHDB_MCP_FILE_ALLOWLIST) — no filesystem gating. query() and query_file() can reach anything the host process can reach (any file(), url(), s3(), remote()...). Appropriate when the agent is trusted, or when the surrounding host application enforces the security boundary itself.

  2. Opt-in allowlist (CHDB_MCP_FILE_ALLOWLIST=/data:/tmp/foo) — best-effort defense in depth:

    • query_file() rejects paths whose resolved (symlink-followed) form isn't under any listed prefix.

    • Both query() and query_file() reject SQL containing any table function that isn't on the safe-by-construction list (numbers/values/view/merge/dictionary/generateRandom/...). The "known" set is snapshotted from system.table_functions at session start, so the gate stays in sync with whatever the running chDB build actually exposes — including new external-source variants (paimon*, prometheusQuery*, iceberg*Azure/S3/HDFS), RCE-class functions (executable, python), and *Cluster siblings, without a hand-maintained denylist that goes stale.

    • For query_file(), the scan runs on the user SQL before the {file} placeholder substitution, so a UNION ALL SELECT … FROM file('/etc/passwd', …) smuggled into the query body is caught even though the explicit path is gated.

    • The scanner is comment- and string-aware (single-pass mask covering line comments, block comments, single-quoted strings with '' / \' / \\ escapes), and it normalizes backtick- and double-quote-wrapped identifiers (`file` / "file") before matching so quoted function names can't bypass it.

    • This is not a sandbox: a determined caller can still try to exfiltrate via undiscovered functions, settings, or future chDB features. Strong enough for casual agent mistakes, not for adversarial input.

  3. Hard isolation — for adversarial input, wrap the server in OS-level confinement: macOS App Sandbox, Linux user namespaces / seccomp, or Docker with a read-only filesystem mount. Nothing at the MCP layer can substitute for this.

What's protected

  • Accidental writesSET readonly=2 is applied at session start. CHDB_MCP_WRITE=1 lifts it. (Note: ClickHouse's readonly=2 still permits TEMPORARY TABLE writes and runtime SET changes — by design, not a bug.)

  • Runaway result sizesCHDB_MCP_MAX_RESULT_BYTES is enforced engine-side (max_block_size + max_result_bytes + result_overflow_mode='break'), not just as a post-hoc string slice. Large queries no longer materialize multi-MiB in chDB before truncation.

  • Runaway wall-clockCHDB_MCP_QUERY_TIMEOUT_SEC (default 30s) caps each query via chDB's max_execution_time.

  • SQL-identifier injectionlist_tables / describe_table / get_sample_data arguments are whitelist-regex'd ([A-Za-z_][A-Za-z0-9_]* only) and backtick-quoted before interpolation.

  • SQL string-literal escapelist_functions(pattern) and query_file(path, format) arguments are passed through quote_string, which escapes both single quotes (''') and backslashes (\\\) so that ClickHouse's \' escape form cannot break out of the literal.

What's NOT protected

  • SQL audit. Only the readonly guard — no allow/deny list of statements. Treat the agent as having full SELECT access to anything chDB can reach (subject to the allowlist when set).

  • Setting tampering. Under readonly=2, the agent can still SET max_memory_usage = … to raise resource caps. Lock this down at the host or via OS-level resource limits if it matters.

  • Memory / CPU caps. chDB's max_memory_usage applies, but there's no ulimit/cgroups equivalent imposed by the MCP layer.

For agents acting on untrusted input, run in a throwaway container.

Roadmap

  • v0.5query_remote_clickhouse() federation tool

  • v1.0attach_file(), dataframe_query() (zero-copy Python(df)), HTTP/SSE transport with Bearer auth, .mcpb bundle for Claude Desktop one-click install

Troubleshooting

macOS: "Server disconnected" in Claude Desktop

If ~/Library/Logs/Claude/mcp-server-chdb.log shows PermissionError: Operation not permitted on pyvenv.cfg, your venv sits under a TCC-protected directory (~/Downloads, ~/Documents, ~/Desktop) — Claude Desktop subprocesses can't read those paths.

Fix: install elsewhere. Recommended is uvx (zero-config, isolated under ~/.local/share/uv/):

{ "mcpServers": { "chdb": { "command": "uvx", "args": ["chdb-mcp"] } } }

Or build a venv yourself under ~/.local/share/chdb-mcp/.venv and point Claude Desktop at its chdb-mcp binary.

query_file returns "path is not under any prefix"

The allowlist resolves symlinks on both sides (so /tmp matches /private/tmp on macOS). If you still hit this, check the resolved form printed in the error against python -c "from pathlib import Path; print(Path('YOUR_PATH').resolve())".

"Cannot execute query in readonly mode"

SET readonly=2 blocks DDL/DML by design. Rewrite as a pure SELECT, or restart with CHDB_MCP_WRITE=1.

Per-server logs

~/Library/Logs/Claude/mcp-server-chdb.log   # startup diagnostics + stderr
~/Library/Logs/Claude/mcp.log                # all servers' JSON-RPC traffic

Development

git clone https://github.com/chdb-io/chdb-mcp && cd chdb-mcp
pip install -e ".[dev]"
pytest && ruff check src tests

License

Apache 2.0 — see LICENSE.

Available Tools

7 tools
describe_tableA

Return column types for a table.

Args: database: Database name (plain identifier). table: Table name (plain identifier).

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYes
tableYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It does not state that the operation is read-only, whether it requires specific permissions, or what happens if the table does not exist. The description only conveys the basic action without side effects or constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, with only two sentences. It front-loads the main purpose and then lists parameters in a standard format. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that an output schema exists, the description does not need to detail return values. However, it lacks mention of error handling or behavior for missing tables. The tool is simple, so the completeness is borderline adequate but could be improved.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no descriptions (0% coverage), so the description's annotation of each parameter as a 'plain identifier' adds meaningful context beyond the schema. This clarifies that identifiers should not be quoted or schema-qualified, which helps the agent properly invoke the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Return column types for a table,' which is a specific verb-resource combination. It is easily distinguished from sibling tools like get_sample_data or list_tables, which perform different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, such as requiring an existing database or table, nor does it advise against using it for retrieving actual data.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_sample_dataA

Return the first N rows of a table.

Args: database: Database name (plain identifier). table: Table name (plain identifier). limit: Maximum rows. Clamped to [1, 1000].

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYes
tableYes
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses limit clamping to [1,1000], which is a key behavioral trait. Does not mention potential errors or that the operation is read-only, though that is implied. Adding a note about ordering or error handling would increase transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Short and to the point, using a structured Args format. Every sentence adds value. Minor reduction because the Args block is somewhat verbose for a simple tool, but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and presence of output schema, description covers essential aspects: purpose, parameters, limit clamping. Lacks mention of result ordering (e.g., arbitrary) or error handling for missing tables. Still adequate for most use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage 0%, so description must compensate. Adds meaning to all three parameters: explains 'database' and 'table' as plain identifiers, and documents limit clamping behavior. However, does not define 'plain identifier' (e.g., case sensitivity), so slight gap remains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it returns the first N rows of a table, which is a specific verb+resource. Differentiates from sibling tools like query (arbitrary SQL) and describe_table (schema retrieval) by specifying a limited preview.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Indirectly implies use for quick sampling ('first N rows'), but does not explicitly state when not to use it (e.g., for full queries use query) or provide alternatives. Could be improved by mentioning that query supports arbitrary SQL.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_databasesA

List databases visible to the chDB session.

Returns one database name per line (TabSeparated format).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite missing annotations, the description explicitly states the output format ('TabSeparated format') and the scope ('visible to the chDB session'), providing useful behavioral detail beyond a simple list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences front-load the purpose and add a critical output detail. No extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, straightforward list operation) and the presence of an output schema, the description fully covers what an agent needs: what it lists and the return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0 parameters and 100% schema coverage, the description correctly adds no param details. For zero-parameter tools, the baseline is 4, and the description meets that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'List databases visible to the chDB session' with a specific verb and resource. Differentiates from sibling tools like list_tables or list_functions by focusing solely on databases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Without context on when listing databases is appropriate or how it differs from other list tools, the agent lacks decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_functionsA

List SQL functions available in the chDB engine.

Returns name, is_aggregate, case_insensitive, alias_to for each entry in system.functions — useful for agents discovering ClickHouse's 1000+ function library (windowFunnel, quantilesTDigest, -If/-State/-Merge combinators, etc.) in one round trip.

Args: pattern: Optional case-insensitive substring filter on the function name. Plain text only; SQL wildcards and quotes are escaped.

ParametersJSON Schema
NameRequiredDescriptionDefault
patternNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It explains the read-only behavior, returned fields, and filter semantics (case-insensitive, no wildcards). Missing details on permissions or error handling, but adequate for a list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a front-loaded purpose and a clear Args section. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity, an output schema exists, and the description covers the returned fields and filter behavior, it is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description fully explains the 'pattern' parameter's behavior (case-insensitive substring, plain text only, wildcards escaped), adding significant value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists SQL functions, specifies the returned fields (name, is_aggregate, etc.), and distinguishes from sibling tools which deal with tables, databases, queries, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a use case (discovering functions in one round trip) but does not explicitly state when to use vs alternatives or when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tablesA

List tables in a given database.

Args: database: Database name. Must be a plain SQL identifier (letters, digits, underscore — no quotes, dots, or spaces).

ParametersJSON Schema
NameRequiredDescriptionDefault
databaseYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds one behavioral trait: the database parameter must be a plain SQL identifier. However, it does not disclose other important behaviors like read-only nature, permission requirements, or whether only visible tables are returned. With no annotations, the description carries the full burden and partially meets it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, no wasted words, and the primary action is stated first. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (one parameter) and the presence of an output schema, the description is nearly complete. It explains the tool's purpose and parameter constraints. A minor gap is the lack of mention of return format, but that is covered by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description fully compensates by specifying the database parameter's format (plain SQL identifier) and providing concrete constraints (letters, digits, underscore, no quotes, dots, or spaces), adding significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists tables in a given database using a specific verb and resource, and it is easily distinguishable from sibling tools like list_databases (lists databases) and describe_table (describes a specific table).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as prerequisites (e.g., need to know database name first) or exclusions (e.g., cannot list tables across databases).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

queryA

Execute an arbitrary SQL statement against the chDB session.

Use ClickHouse SQL dialect. Common formats: JSONCompact (default), CSVWithNames, TabSeparatedWithNames, Pretty. The result is truncated at CHDB_MCP_MAX_RESULT_BYTES (default 1 MiB) and the query is aborted after CHDB_MCP_QUERY_TIMEOUT_SEC seconds (default 30).

Args: sql: Any read-only SQL (SELECT/SHOW/DESCRIBE/EXPLAIN). Writes require CHDB_MCP_WRITE=1. When CHDB_MCP_FILE_ALLOWLIST is set, any table function that isn't on the safe-by-construction list (numbers/values/view/merge/dictionary/etc.) is rejected — that includes file/url/s3/remote/executable/python and every other external-reach function chDB exposes. Use query_file() for files instead. format: Output format passed to chDB. Defaults to JSONCompact.

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYes
formatNoJSONCompact

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavioral traits: result truncation limit (CHDB_MCP_MAX_RESULT_BYTES), query timeout (CHDB_MCP_QUERY_TIMEOUT_SEC), write permission requirement (CHDB_MCP_WRITE=1), and safety restrictions for external functions under CHDB_MCP_FILE_ALLOWLIST.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and concise, using a paragraph for core usage and bullet points for details. Every sentence provides necessary information without redundancy, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of executing arbitrary SQL with security constraints, the description is remarkably complete. It covers execution limits, write permissions, file allowlist restrictions, format options, and the existence of an output schema reduces the need to explain return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates thoroughly. The sql parameter is explained with read-only vs write usage, and the format parameter is described with default value and common formats list. This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Execute an arbitrary SQL statement against the chDB session' which is a specific verb+resource. It distinguishes from sibling tools like query_file by explicitly directing users to that tool for file operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: for read-only SQL by default, with writes requiring a specific environment variable. It also notes that many table functions are rejected when a file allowlist is set, and directs users to query_file() for files, effectively differentiating from siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_fileA

Query a local file (Parquet/CSV/JSON/…) as if it were a table.

The literal token {file} in sql is substituted with a file('path', 'format') table-function call before execution.

Example::

query_file(
    path="/data/sales.parquet",
    sql="SELECT region, sum(revenue) FROM {file} GROUP BY region",
    format="Parquet",
)

Args: path: Filesystem path. If CHDB_MCP_FILE_ALLOWLIST is set, the resolved path must sit under one of its prefixes. sql: Query body. Must contain the literal placeholder {file}. When CHDB_MCP_FILE_ALLOWLIST is set, the SQL is scanned before substitution; any extra table function call other than the placeholder (e.g. a UNION with file('/etc/passwd', ...) or a stray url()/executable()) is rejected. format: chDB file format hint. Common values: Parquet, CSV, CSVWithNames, JSONEachRow, Arrow.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
sqlYes
formatNoParquet

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses file format support, placeholder substitution behavior, and security scanning/rejection of malicious SQL when allowlist is set. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with summary, example, and bulleted args. Slightly verbose (e.g., repeated allowlist explanations), but information density is high.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers parameters, usage, and security comprehensively. Has output schema so return values are covered. Could mention error scenarios or performance implications, but given complexity it's fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully explains each parameter: path (with allowlist constraint), sql (must contain '{file}', scanning behavior), and format (hints with common values). This compensates for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it queries local files (Parquet, CSV, JSON, etc.) as a table. It provides a concrete example with placeholders, distinguishing it from sibling tools like 'query' (which queries database tables) and 'describe_table'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It specifies when to use (querying local files) and explains the placeholder substitution and security allowlist. However, it does not explicitly contrast with alternatives or mention when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 7 tool updatesv0.2.0
    • First observeddescribe_table
    • First observedget_sample_data
    • First observedlist_databases
    • First observedlist_functions
    • First observedlist_tables
    • First observedquery
    • First observedquery_file

TDQS

A4.2/5.0
Disambiguation5/5

Each tool targets a distinct operation: listing databases vs. tables vs. functions, describing a table, retrieving sample data, executing arbitrary queries, and querying files. No overlap in purpose.

Naming Consistency5/5

All tool names follow a clear verb_noun pattern (list_databases, list_tables, describe_table, get_sample_data, query, query_file). The naming is predictable and uniform.

Tool Count5/5

With 7 tools, the server is well-scoped for a database MCP server. It covers introspection, data querying, and file integration without being overly numerous or sparse.

Completeness4/5

The tool set covers essential database exploration and querying. The query tool can handle writes when enabled, and file querying is included. Minor missing features like a dedicated DDL tool exist but are workable via raw SQL.

Maintenance

ActivitySlowing
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP-Server from your Database optimized for LLMs and AI-Agents. Supports PostgreSQL, MySQL, ClickHouse, Snowflake, MSSQL, BigQuery, Oracle Database, SQLite, ElasticSearch, DuckDB
    547
    Apache 2.0
  • F
    license
    Not graded
    quality
    A
    maintenance
    Production-ready MCP server designed to empower AI agents and LLMs to interact seamlessly with ClickHouse. It exposes your ClickHouse database as a set of standardized tools and resources that adhere to the MCP protocol, making it easy for agents built on OpenAI, Claude, or other platforms to query, explore, and analyse your data.
    37
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    One config, one CLI that turns your databases (Postgres, MySQL, SQLite, MongoDB) into MCP servers for Claude, GPT, Cursor, and any MCP-compatible agent.
    1
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A dead-simple, self-hosted MCP server for querying your databases with AI agents.
    2
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/chdb-io/chdb-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server