BigQuery MCP Server: What It Is & How To Set It Up In 2026

A BigQuery MCP server gives an AI client such as Claude, Cursor or Gemini CLI tools to read your BigQuery schemas and run SQL. Google offers two: the managed BigQuery MCP server, a remote endpoint with nothing to install, and the open-source MCP Toolbox for Databases, which you run yourself. Neither is read-only out of the box: the managed server's execute_sql tool can run DML and DDL, and the toolbox runs any statement unless you block writes. The safeguards that hold are a least-privilege identity for the server to run as and a cap on the bytes its queries may bill.

Both servers are free; the queries they run are billed like any other. BigQuery also has AI of its own (Gemini in BigQuery, data canvas and Conversational Analytics agents), covered after the setup. Everything below is as of October 2026, with Google's sources linked.

The two BigQuery MCP servers at a glance

Option 1: Google's managed BigQuery MCP server

Google announced official MCP support on December 10, 2025: the BigQuery MCP server lets agents "natively interpret schemas and execute queries against enterprise data without the security risks or latency of moving data into context windows." By April 29, 2026, Google said more than 50 Google-managed MCP servers were generally available or in preview, and that "every Google Cloud service is now MCP-enabled by default."

There is nothing to install, though an admin may first need to enable the MCP endpoint for the project: the client connects to https://bigquery.googleapis.com/mcp, access is managed with Google Cloud IAM, and IAM deny policies, Model Armor and Cloud Audit Logs govern it (BigQuery MCP guide). Google's tool reference says to prefer execute_sql_readonly, which accepts only SELECT, over execute_sql, which runs any statement BigQuery supports, DML and DDL included; jobs from both carry the label goog-mcp-server: true. The client picks the tool, so the identity's roles decide what it can change. Either way, the admin question is who may use it.

Option 2: MCP Toolbox for Databases (runs on your machine)

Google's open-source MCP Toolbox has a prebuilt BigQuery toolset. Its documented tools include execute_sql, dataset and table metadata tools, forecast, analyze_contribution (key-driver analysis) and ask_data_insights, which calls the Conversational Analytics API. It needs Node.js and Application Default Credentials. A read-only setup:

{
  "mcpServers": {
    "bigquery": {
      "command": "npx",
      "args": ["-y", "@toolbox-sdk/server", "--prebuilt", "bigquery", "--stdio"],
      "env": {
        "BIGQUERY_PROJECT": "my-billing-project",
        "BIGQUERY_LOCATION": "US",
        "BIGQUERY_READONLY": "true",
        "BIGQUERY_MAXIMUM_BYTES_BILLED": "10737418240",
        "BIGQUERY_IMPERSONATE_SERVICE_ACCOUNT": "mcp-reader@my-billing-project.iam.gserviceaccount.com"
      }
    }
  }
}

• BIGQUERY_READONLY=true sets write mode to blocked, which allows only SELECT; the default, allowed, runs any statement.
• BIGQUERY_MAXIMUM_BYTES_BILLED caps the bytes a query may bill; queries over the cap fail before they run. 10737418240 bytes is 10 GiB.
• BIGQUERY_IMPERSONATE_SERVICE_ACCOUNT runs as a service account without a downloaded key; BIGQUERY_USE_CLIENT_OAUTH forwards each user's own OAuth token instead.
• For a dataset allowlist, define your own BigQuery source with allowedDatasets (source options); execute_sql then rejects queries that name a table outside the list or that it can't analyze, such as EXECUTE IMMEDIATE.

One line in Google's execute_sql documentation is worth reading twice: the tool is meant for developer-assistant workflows with a human in the loop and "shouldn't be used for production agents." The model in each person's client decides what to run and how to read it, and nobody else learns from one person's corrections.

How to set up a least-privilege service account for BigQuery MCP

1. Create a dedicated service account in the project that will pay for the queries.
2. Grant BigQuery Data Viewer (roles/bigquery.dataViewer) on each dataset the agent may read (the dataset, then Sharing, then Add principal), not on the whole project.
3. Grant BigQuery Job User (roles/bigquery.jobUser) on the billing project so the account can run query jobs. Google's toolbox docs use the broader BigQuery User (roles/bigquery.user).
4. Add BigQuery Metadata Viewer (roles/bigquery.metadataViewer) only if the agent must list every dataset, and roles/cloudaicompanion.user only if you use ask_data_insights. Leave out BigQuery Data Editor.
5. Impersonate rather than download a key. Your own identity needs roles/iam.serviceAccountTokenCreator on the service account.

gcloud iam service-accounts create mcp-reader --project=my-billing-project

gcloud projects add-iam-policy-binding my-billing-project \
  --member="serviceAccount:mcp-reader@my-billing-project.iam.gserviceaccount.com" \
  --role="roles/bigquery.jobUser"

gcloud iam service-accounts add-iam-policy-binding \
  mcp-reader@my-billing-project.iam.gserviceaccount.com \
  --member="user:you@example.com" \
  --role="roles/iam.serviceAccountTokenCreator"

Then grant Data Viewer on each dataset. With the managed server, the identity your client signs in with also needs MCP Tool User (roles/mcp.toolUser) to call its tools, and nothing broader.

Cost controls for AI-written SQL

• Maximum bytes billed per query. Set it in the MCP server (above) or on the job. With on-demand at $6.25 per TiB, a 10 GiB cap means no single query bills more than about $0.06.
• Custom cost controls. The pricing page lists user-level and project-level custom cost controls. A project-level cap bounds a runaway agent; a user-level cap bounds one person.
• Dry runs. execute_sql takes dry_run=true to validate a query without running it.
• Partitioning, clustering and labels. BigQuery bills the columns and blocks it reads, and labeled agent jobs show their cost in INFORMATION_SCHEMA.JOBS.

BigQuery's built-in AI: Gemini, data canvas and Conversational Analytics

If the people asking already work in BigQuery Studio, Google's own AI may be enough:

• Gemini in BigQuery generates, explains and completes SQL and Python and helps prepare data. Google's Gemini pricing page says the core features "are available to all editions at no additional cost"; SQL completion is still in preview. The SQL it writes runs on your normal compute: on-demand from $6.25 per TiB scanned (the list price in Iowa, us-central1; the first 1 TiB a month is free) or edition capacity from $0.04 per slot-hour (BigQuery pricing).
• Data canvas, GA since its Next '24 preview and included at no extra charge, chains finding tables, SQL, joins, charts and written insights on a visual canvas instead of a linear notebook (launch post). It suits analysts who want to see and edit every step.
• Conversational Analytics, generally available since July 2026, lets your data team build a data agent over a set of tables, grounded in instructions, verified queries and user-defined functions, for other people to ask in plain language. The agent "surfaces its 'thinking process' and the generated SQL behind every answer" and forecasts or flags outliers with AI.FORECAST and AI.DETECT_ANOMALIES (preview announcement). People ask it in BigQuery Studio, data canvas, Gemini Enterprise, Data Studio or your own app through the API. Agent tokens cost $3 per million input and $20 per million output once Google's free trial ends on December 31, 2026, with the queries billed on top (data agents pricing), and admins can cap "maximum query sizes in bytes" (July 2026 update).

Google's sources show no ready-made Slack or Teams app: the Slack bot it links to is an open-source demo built on the API. And Conversational Analytics has no LookML underneath; its grounding is instructions and verified queries, which is the gap a semantic layer fills. If you run Looker on BigQuery, see Looker AI and the Looker MCP server and what Looker costs.

How GetDot works with BigQuery

GetDot is an AI data analyst that writes the BigQuery SQL for each question, answers in Slack, Microsoft Teams, email or the web app, and shows the SQL with the answer. What follows is described on our BigQuery integration page and in our changelog.

Dot is also an MCP server (Dot's MCP integration), so your client asks an analyst a question, with your Dot permissions, instead of driving execute_sql directly. It connects to 45+ data sources, including Looker on top of BigQuery; its business-app connectors, such as GA4 or Google Ads, are in beta.

Connection and per-user access

You give Dot a service account key, the project ID and the location, and optionally a dataset list and a separate execution project that runs, and pays for, the queries. It needs BigQuery Metadata Viewer on the data project and Data Viewer on what it should query.

Since March 2026, an admin can switch on per-user access: queries run under each person's own Google identity, through domain-wide delegation in Google Workspace, so BigQuery's permissions and row access policies decide what they see. If Google refuses the person, the question fails; Dot never falls back to the service account.

Every query carries an audit stamp and job labels

Since our August 2026 release, every SQL query Dot runs starts with a comment naming the user, the workspace, what triggered it and a link back to the chat. On BigQuery the same facts land as job labels: dot_user, dot_user_email, dot_org, dot_chat, dot_source and dot_app (an email appears as jane-acme-com). Who spent what through Dot in the last 30 days (change region-us to your location):

SELECT
  (SELECT value FROM UNNEST(labels) WHERE key = 'dot_user_email') AS dot_user,
  COUNT(*) AS queries,
  ROUND(SUM(total_bytes_billed) / POW(1024, 4), 3) AS tib_billed
FROM `region-us`.INFORMATION_SCHEMA.JOBS
WHERE creation_time >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 30 DAY)
  AND EXISTS (SELECT 1 FROM UNNEST(labels) WHERE key = 'dot_org')
GROUP BY dot_user
ORDER BY tib_billed DESC;

Cost, access and context

• Partition-aware sampling. Dot samples recent partitions rather than whole tables. For a hard ceiling, set BigQuery's custom cost controls on the project that runs Dot's queries.
• Columns you switch off stay off. A column an admin switches off in Dot can't be read by any query in any position, SELECT * included, and Dot runs only single read-only queries.
• Context from your own project. Dot catalogs nested and repeated fields, such as a GA4 export's event_params, field by field, and reads your project's recent query history to learn which tables people actually use.

Dot is SOC 2 Type II and GDPR compliant, and its LLM providers run with zero data retention. Pricing (October 2026): Free with 300 one-time credits and full Pro features; Pro $180/month billed annually ($200 month-to-month); Team $720/month billed annually ($800 month-to-month); unlimited users, billed on credits, not seats. BigQuery compute is billed by Google, as with any tool.

BigQuery MCP vs Gemini in BigQuery vs GetDot

Which one to choose

• A BigQuery MCP server when your engineers already work in Claude Code, Cursor or Gemini CLI, with a human checking each query, and you can run it read-only with a bytes cap and a narrowly scoped identity.
• Gemini in BigQuery and data canvas when the people asking already write SQL in BigQuery Studio.
• Conversational Analytics when you want a Google-native agent, curated by your data team, over a known set of tables, for users in BigQuery Studio, Gemini Enterprise or your own app via the API.
• GetDot when most questions come from people who don't open BigQuery, or span BigQuery, Looker and other sources, and you want every query labeled with who asked. See how conversational analytics works end to end, or create a free GetDot account and connect a read-only service account.

FAQ