BigQuery MCP Server
MCP server providing BigQuery schema inspection and query execution for LLMs
Score Breakdown
Server Info
- Package
- mcp-server-bigquery
- Registry
- pypi
- Repository
- LucasHild/mcp-server-bigquery
- Maintainer
- Community
- Category
- Analytics & Data
- Tags
- data-warehousegooglesql
- Last Scanned
- 7 Apr 2026
Findings
7 issuesAuthentication & Identity
HIGHNo per-request auth - requires instance-per-user
Stdio-only transport. Authenticates to BigQuery via a service account key file (BIGQUERY_KEY_FILE env var or --key-file CLI arg). No MCP-level auth; any client with stdio access has full query permissions. For multi-tenant deployment, the platform must spawn a separate server instance per user.
Add HTTP/SSE transport to accept per-request Authorization headers, or implement the MCP OAuth spec.
Tool Schema Quality
MEDIUMOnly 0 of 3 schemas have parameter constraints
Most schemas lack maxLength, enum, or pattern constraints on string parameters.
Add constraints to string parameters, especially on write operations.
CRITICALDangerous execution surface: execute-query: accepts arbitrary SQL string with no validation, constraints, or maxLength
Tool allows raw code/query execution which could be exploited via prompt injection.
Use parameterized queries or validated command sets.
Permission Granularity
MEDIUM1 tools combine read and write operations
All 3 tools are labeled as read operations, but execute-query is effectively mixed read/write since it accepts arbitrary SQL with no enforcement of SELECT-only. There is no separate write tool that could be disabled independently. The tool description says 'SELECT query' but the implementation passes the query string directly to BigQuery with no validation.
Split into separate read and write tools.
LOWTool descriptions lack resource scope
Descriptions don't specify what data types or resources they access.
Add resource type statements to descriptions.
Data Exposure
LOWNo field selection on responses
Responses return full records rather than projected fields.
Implement field selection to return only relevant fields.
Maintenance & Trust
LOWCommunity-maintained by Lucas Hild
No official vendor backing.
Seek vendor verification.
Tools
3 total| Name | Description | Risk |
|---|---|---|
| execute-query | Execute a SELECT query on the BigQuery database | read |
| list-tables | List all tables in the BigQuery database | read |
| describe-table | Get the schema information for a specific table | read |
Deploy BigQuery MCP Server securely
CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.
Deploy on CompleteFlow