mcp-databend
OfficialClick on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-databendshow tables in the analytics database"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Server for Databend
Connect AI agents to your Databend database safely. Session sandbox keeps production read-only while agents experiment. Works with Codex, Cursor, Claude Code, Gemini CLI, and any MCP-compatible client. Learn more at databend.com/mcp.
Usage
Get your Databend DSN. Format:
databend://user:password@host:port/database?warehouse=your_warehouseGet it from Databend Cloud or the docs.Session sandbox safety: writes only to
mcp_sandbox_{session_id}_*; production stays read-only. Useget_session_sandbox_prefixto retrieve the live prefix.Configure your MCP client.
Standard config works in most tools:
{
"mcpServers": {
"databend": {
"command": "uv",
"args": ["tool", "run", "--from", "mcp-databend@latest", "mcp-databend"],
"env": {
"DATABEND_DSN": "databend://user:password@host:port/database?warehouse=your_warehouse"
}
}
}
}Use the Codex CLI to add the Databend MCP server:
codex mcp add databend \
--env DATABEND_DSN='databend://user:password@host:port/database?warehouse=your_warehouse' \
-- uv tool run --from mcp-databend@latest mcp-databendUse the Claude Code CLI to add the Databend MCP server:
claude mcp add databend \
--env DATABEND_DSN='databend://user:password@host:port/database?warehouse=your_warehouse' \
-- uv tool run --from mcp-databend@latest mcp-databendClick the button to install:
Then open Cursor Settings -> MCP, select Databend, click Edit, and add DATABEND_DSN to the env section. Cursor keeps the command as a single string:
{
"mcpServers": {
"Databend": {
"command": "uv tool run --from mcp-databend@latest mcp-databend",
"env": {
"DATABEND_DSN": "databend://user:password@host:port/database?warehouse=your_warehouse"
},
"args": []
}
}
}Or install manually:
Go to Cursor Settings -> MCP -> Add new MCP Server. Paste command uv tool run --from mcp-databend@latest mcp-databend, then click Edit and add DATABEND_DSN in env.
Add the standard config above to your Gemini CLI settings.json.
Related MCP server: safedb-mcp
Safety Guarantees
Scope | Rules |
Read access |
|
Write access | Only objects prefixed with |
Sandbox objects |
|
Write rules |
|
Available Tools
Tool | Description |
| Execute SQL with sandbox validation |
| Execute multiple SQL statements |
| List all databases |
| List tables in database |
| Get table schema |
| Get current session prefix |
| List sandbox databases |
| Create sandbox database |
| Stage management |
| List connections |
Configuration
Variable | Default | Description |
| - | Connection string |
|
| Use embedded Databend |
|
| Query timeout (seconds) |
|
| Enable sandbox validation. Set to |
|
| Transport: |
|
| Bind host for HTTP/SSE |
|
| Bind port for HTTP/SSE |
Local mode stores data in .databend/.
Development
git clone https://github.com/databendlabs/mcp-databend
cd mcp-databend
uv sync
# Run locally
uv run python -m mcp_databend.main
# Debug
npx @modelcontextprotocol/inspector uv run python -m mcp_databend.main
# Test
uv run pytestAvailable Tools
13 toolscreate_session_sandbox_databaseA
Create a new sandbox database for current session.
The database name will be automatically prefixed with current session's sandbox prefix.
Args: name: Database name suffix (without prefix)
Example: create_session_sandbox_database('analytics') -> Creates 'mcp_sandbox_a1b2c3d4_analytics'
Returns: Dictionary containing result or error
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must disclose behavioral traits. It explains naming prefix and return format but does not mention side effects, error handling, or permissions. For a simple creation tool, this is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: purpose statement, argument description, example, return type. Every sentence adds value and is front-loaded with the main action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple create tool with one parameter and an output schema, the description is complete enough. It explains input, behavior, and output. Could mention constraints like uniqueness or permissions, but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries full burden. It defines 'name' as a suffix without prefix and provides an example that clarifies usage, adding significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a new sandbox database for the current session, specifying the naming convention with prefix. It is distinct from sibling tools like show_databases and execute_sql.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use the tool (to create a sandbox database) but does not explicitly mention when not to use it or provide alternatives. The context of siblings implies it is for setup, not for querying or listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_stageC
Create a Databend stage with connection Args: name: The stage name url: The stage URL (e.g., 's3://bucket-name') connection_name: Optional connection name to use
Returns: Dictionary containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| name | Yes | ||
| connection_name | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states the tool creates a stage and returns a dict, but lacks disclosure of side effects (e.g., persistence), permissions needed, behavior on duplicates, or connection requirements. With no annotations, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, structured in a readable Args/Returns format, and includes only necessary information. It could be slightly more efficient by removing the 'Returns' boilerplate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks important context about output schema details (though not required if output schema exists), behavioral guarantees, and error conditions. For a creation tool with no annotations, this is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It lists all three parameters with brief explanations and a URL example, which adds basic meaning beyond the schema. However, details like valid URL formats or constraints are missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action is 'Create' and the resource is 'Databend stage', which is distinct from siblings like show_stages. However, it lacks context on what a stage represents, which slightly reduces clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as show_stages or execute_sql. There is no explicit statement of prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_tableA
Describe a Databend table (safe operation, not affected by MCP safe mode) Args: table: The table name database: The database name
Returns: Dictionary containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| table | Yes | ||
| database | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It states 'safe operation' and mentions the return type (dictionary with query results or error info). However, it does not specify the structure of the returned dictionary (e.g., column metadata), leaving some behavioral aspects unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise at three sentences, front-loaded with the main purpose. No unnecessary words, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and low parameter coverage, the description is somewhat complete: it covers purpose, safety, parameters, and return type. However, it lacks detail on the return value's contents (e.g., what 'query results' means for a describe operation).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must add value. It provides brief descriptions for both parameters ('table: The table name', 'database: The database name'), which adds meaning beyond the schema's property names and types. Descriptions are terse but adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description explicitly states 'Describe a Databend table', a specific verb+resource. It distinguishes from siblings like 'show_tables' (lists tables) and 'execute_sql' (runs queries), making the tool's purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Notes it is a 'safe operation, not affected by MCP safe mode', providing clear context for when to use. Does not explicitly state when not to use or name alternatives, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_multi_sqlA
Execute multiple SQL queries against Databend database with MCP safe mode protection.
Safe mode (enabled by default) restricts write operations to the current session sandbox. Set DATABEND_MCP_SAFE_MODE=false to disable sandbox validation.
Args: sqls: List of SQL query strings to execute
Returns: List of dictionaries containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| sqls | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses safe mode behavior, its default restriction of write operations, and how to disable it. It also mentions return format (list of dicts with results/errors). However, it does not detail error handling or transaction behavior, which is notable for a mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: a clear summary line, followed by safe mode details, then Args and Returns. Every sentence adds value without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has moderate complexity (multi-query execution, safe mode). The description covers safe mode and return format. Since output schema exists, return value explanation is not required, but it's provided. Missing details like sequential execution or transaction borders, but overall sufficient for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only one parameter and 0% schema description coverage (schema only has 'title'), the description adds meaningful detail: 'List of SQL query strings to execute'. This explains the array contents beyond the schema's type and title, meeting the need for parameter clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes multiple SQL queries against a Databend database, with a specific verb ('execute') and resource ('multiple SQL queries'). It distinguishes from sibling tool 'execute_sql' by specifying 'multiple' and mentions safe mode protection, adding context beyond the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains safe mode and how to disable it, but does not explicitly guide when to use this tool versus alternatives like 'execute_sql' for single queries. No when-not or when-to-use guidance is provided, leaving the agent to infer from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_sqlA
Execute SQL query against Databend database.
SAFETY RULES (when DATABEND_MCP_SAFE_MODE is enabled):
Read operations (SELECT/SHOW/DESCRIBE/EXPLAIN/LIST): allowed on ALL objects
Write operations (CREATE/DROP/INSERT/UPDATE/DELETE/...): ONLY allowed on current session's sandbox
Current session sandbox prefix: use get_session_sandbox_prefix() to get it
Set DATABEND_MCP_SAFE_MODE=false to disable sandbox validation
Args: sql: SQL query string to execute
Returns: Dictionary containing query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries burden. Details safe mode behavior, sandbox restrictions, and return type. Does not cover auth, rate limits, or side effects beyond write restrictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: main purpose first, then safety rules, then Args/Returns. Could be slightly more concise but is informative and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given presence of output schema (not shown), description doesn't need to explain returns. Covers safety and usage adequately for a single-parameter tool with moderate complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage 0%, so description compensates by explaining the 'sql' parameter as a query string and adding safe mode context. No format constraints needed for a simple string.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it executes SQL queries against a Databend database. Distinguishes from siblings like execute_multi_sql and read-only tools like show_databases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides safety rules and sandbox restrictions for write operations, and references get_session_sandbox_prefix(). Lacks explicit guidance on when to use this tool vs. alternative tools like execute_multi_sql.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_session_sandbox_prefixA
Get current session's sandbox prefix for writable objects.
All write operations (CREATE/DROP/INSERT/UPDATE/DELETE/...) are ONLY allowed on objects with this prefix. This is enforced by code, not just guidelines.
Returns: Dictionary with session_id and prefix
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosure. It states that enforcement of the prefix is by code, not just guidelines, and mentions the return type (dictionary with session_id and prefix). For a simple getter, this is sufficient behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with only three sentences. It front-loads the purpose, adds context with the enforcement note, and ends with the return format. Every sentence is earned.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, has output schema), the description is complete. It explains the prefix's role and what the tool returns, which is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the description adds value by explaining the output's purpose. No parameter information is needed beyond the schema, which is already fully covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: retrieving the session's sandbox prefix for writable objects. It defines the resource and verb precisely, and the explanation of its role in write operations distinguishes it from sibling tools like show_databases or create_session_sandbox_database.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: before any write operations, as it provides the required prefix. It does not explicitly state when not to use it or mention alternative tools, but the context from sibling tools (e.g., create_session_sandbox_database) makes the usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_session_sandbox_databasesA
List sandbox databases owned by current session.
Only these databases can be modified. Other databases are read-only.
Returns: Dictionary containing current session's sandbox database list
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description covers behavioral aspects well: it returns a dictionary of sandbox databases, notes they are owned by the current session, and highlights their modifiability. It omits potential permission requirements or performance implications, but for a simple list operation this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: three sentences covering action, context, and return format. Every sentence serves a purpose, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and a simple listing function, the description is complete. It explains what the tool does, the scope, and the return type. The presence of an output schema further covers return structure, and the description adds key context about modifiability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the baseline is 4. The description adds meaningful context by specifying the scope ('owned by current session') and return type, which provides value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool lists sandbox databases owned by the current session. It distinguishes itself from the sibling 'show_databases' by specifying 'sandbox' and 'owned by current session', making its purpose specific and differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that only these databases can be modified, implying the tool should be used when the agent needs to identify modifiable databases. While it doesn't directly contrast with siblings like 'show_databases', the context is clear enough for an AI agent to infer appropriate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_stage_filesA
List files in a Databend stage (safe operation, not affected by MCP safe mode) Args: stage_name: The stage name (with @ prefix) path: Optional path within the stage
Returns: Dictionary containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| stage_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the tool is safe and returns a dictionary of results or error info. However, it lacks details about potential failure modes, rate limits, or pagination behavior, which would be helpful for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using just a few lines to cover purpose, arguments, and return type. Every sentence adds value with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with two parameters and no output schema, the description provides everything needed: what it does, how to call it, and what to expect back. It is complete given the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully explains both parameters: stage_name (with @ prefix) and path (optional). This adds significant meaning beyond the bare schema, enabling correct invocation without needing external context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists files in a Databend stage, with a specific verb ('List') and resource ('files in a Databend stage'). It distinguishes from siblings like show_stages (which lists stages) and execute_sql (which runs queries), so an agent can easily understand its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states the operation is safe and unaffected by MCP safe mode, and notes the @ prefix for the stage name. This provides clear context for when to use the tool, but it does not explicitly mention alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_connectionsA
List available Databend connections (safe operation, not affected by MCP safe mode)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must disclose behavioral traits. It mentions safety and safe mode immunity, which adds value. However, it does not detail return format or other behaviors, leaving some gaps for a simple list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It is appropriately front-loaded and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, no output schema, and a straightforward list operation, the description provides sufficient context about the tool's function and a key behavioral note (safe mode immunity). It is complete for its simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the description need not add parameter details. The baseline of 4 applies as no additional meaning is required beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists available Databend connections, using a specific verb and resource. This distinguishes it from sibling tools like show_databases or show_tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context that the operation is safe and unaffected by MCP safe mode, implying it can be used even when safe mode is active. However, it does not explicitly state when to use or avoid this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_databasesA
List available Databend databases (safe operation, not affected by MCP safe mode)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description adds behavioral context by noting it's a safe operation unaffected by MCP safe mode. This helps the agent understand constraints beyond the basic list action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no wasted words. It is front-loaded with the primary action and additional safety information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple tool with no parameters and no output schema. It states the purpose and a key behavioral trait, though the return format is not described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the description adds no parameter details. However, schema coverage is 100% and the absence of parameters is clear, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists available Databend databases, using a specific verb and resource. It distinguishes from sibling tools like show_tables and show_stages, which list different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Usage is implied by the simple action, but no exclusions or comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_functionsA
List available Databend functions (safe operation, not affected by MCP safe mode) Args: filter: The filter string, eg: "name like 'add%'" Returns: Dictionary containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must reveal behavioral traits. It mentions 'safe operation' and not being affected by MCP safe mode, which adds transparency. However, it does not disclose other traits like side effects, idempotency, or performance implications. The description adds moderate value beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two sentences plus structured 'Args:' and 'Returns:' sections. It is well-organized and front-loaded with the key purpose. Every element serves a purpose without unnecessary verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema), the description provides sufficient context: purpose, parameter explanation with example, and return type. It covers the key aspects an agent needs to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema coverage is 0%, so the description must compensate. It explains the filter parameter with an example ('name like 'add%''), which adds meaning beyond the schema's type definition. This is helpful for an AI agent to understand how to construct the filter string.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List available Databend functions', specifying the resource (functions) and action (list). It distinguishes from sibling tools like show_databases or show_tables by focusing on functions. The addition of 'safe operation, not affected by MCP safe mode' provides extra context, though the kind of functions (system vs. user-defined) is not specified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool via 'safe operation' and 'not affected by MCP safe mode', hinting that other tools may be unsafe in certain modes, but it does not explicitly state when to use this vs. alternatives or when not to use it. No sibling differentiation is provided beyond the resource type.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_stagesA
List available Databend stages (safe operation, not affected by MCP safe mode)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavior. It mentions safety and safe mode exemption, which is helpful, but it does not describe the output format (e.g., list of stage names with details) or any limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and resource, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, no-output-schema list tool, the description is mostly complete. It covers the purpose and safety, but could mention what details are returned (e.g., names only).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema coverage is 100% trivially. The description does not need to add parameter info, earning a baseline of 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'List' and the resource 'available Databend stages', and distinguishes it from sibling tools like show_databases and show_tables by specifying 'stages'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes it is a safe operation not affected by MCP safe mode, offering context for when to use it. However, it does not explicitly contrast with siblings like create_stage or list_stage_files, though the purpose is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_tablesA
List available Databend tables in a database (safe operation, not affected by MCP safe mode) Args: database: The database name filter: The filter string, eg: "name like 'test%'"
Returns: Dictionary containing either query results or error information
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | ||
| database | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes it as safe and provides return type (dictionary with results/errors), but with no annotations, more behavioral traits (e.g., no side effects, performance) could be disclosed. Adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with purpose, includes Args and Returns sections. Every sentence is earned, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with 2 optional params and no output schema, description fully covers purpose, parameters, and return structure. Sibling context is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, so description adds value: explains database as name and filter with example. Clear and useful, though filter syntax could be more precise.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'List available Databend tables in a database', specifying verb, resource, and context. Distinguishes from siblings like show_databases and describe_table.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions it's a safe operation not affected by safe mode, but lacks explicit when-to-use vs alternatives. Usage is implied by purpose, but no exclusion guidance for tools like execute_sql.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
13 tool updates
v0.3.2- First observed
create_session_sandbox_database - First observed
create_stage - First observed
describe_table - First observed
execute_multi_sql - First observed
execute_sql - First observed
get_session_sandbox_prefix - First observed
list_session_sandbox_databases - First observed
list_stage_files - First observed
show_connections - First observed
show_databases - First observed
show_functions - First observed
show_stages - First observed
show_tables
TDQS
Each tool has a clearly distinct purpose: listing metadata (databases, stages, tables, functions, connections), describing tables, listing stage files, executing SQL (single or multiple statements), creating stages, and managing sandbox databases. There is no overlap or ambiguity.
All tool names follow a consistent verb_noun pattern with lowercase and underscores, e.g., show_databases, list_stage_files, create_stage, get_session_sandbox_prefix. The naming is predictable and uniform.
With 13 tools, the set is well-scoped for a database interaction server. It covers essential operations without being overwhelming, and each tool contributes meaningfully.
The tool set covers metadata exploration, SQL execution (single and multi), stage creation, and sandbox management. The SQL execution tools effectively act as catch-alls for any other operations, making the surface complete for the domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
AI agents propose database changes as reviewable requests — no direct write access.
Safe, read-only Postgres and MySQL access for AI agents. Audit log + column-level controls.
AI agents need permission before production SQL writes. Pilot $100 · Gateway $299. Lint≠authorize.
Query 40 databases from Claude, ChatGPT, or Cursor — on any device. Read-only, encrypted, audited.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to interact with Snowflake databases through SQL queries, table previews, and metadata operations. Features built-in safety checks that block destructive operations and intelligent error handling optimized for AI workflows.1MIT
- AlicenseAqualityCmaintenanceSecure MCP server for safe, read-only DB access by AI agents, with SQL guardrails, table allowlists, PII masking, and audit logs6507MIT
- FlicenseNot gradedqualityCmaintenanceEnables AI assistants to query SQL databases safely with read-only access, allowing schema discovery and SELECT queries while blocking writes and DDL operations.-
- FlicenseNot gradedqualityCmaintenanceProvides read-only database access for AI agents across multiple databases (Postgres, MySQL, MongoDB, Elasticsearch) with enforced read-only guarantees and separate tools for prod and non-prod environments.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/databendlabs/mcp-databend'
If you have feedback or need assistance with the MCP directory API, please join our Discord server