BigQuery MCP servers in 2026: which one to use with Claude, Cursor or Codex

There are four kinds of BigQuery MCP server in 2026: Google's managed remote server (which Claude's BigQuery connector also points at), Google's open-source MCP Toolbox, small community servers you run locally, and hosted layers like Contextflo. Which one fits depends on whether you are one person on your laptop or a team that all asks questions.

The options at a glance

Google's managed BigQuery MCP server

Google hosts a remote MCP server for BigQuery at https://bigquery.googleapis.com/mcp. It speaks Streamable HTTP, so there is nothing to install. Any client that supports remote MCP can connect: Claude, Cursor, Codex and others.

Auth is OAuth 2.0 with IAM, using the scope https://www.googleapis.com/auth/bigquery. The people connecting need these roles:

• roles/mcp.toolUser
• roles/bigquery.jobUser
• roles/bigquery.dataViewer

The server exposes six tools:

• list_dataset_ids
• get_dataset_info
• list_table_ids
• get_table_info
• execute_sql_readonly
• execute_sql

execute_sql_readonly only runs SELECT statements. execute_sql can run DML and DDL, which means it can write. Your agent can pick either one, so the safe move is to connect with an identity that only has Data Viewer and Job User. Then a write fails at the permission layer, whatever the agent tries.

Know the limits before you build on it:

• Queries time out after 3 minutes.
• Results are capped at 3,000 rows.
• execute_sql_readonly does not support Google Drive external tables or Graph Query Language.

The setup step that trips people up: the server does not support automatic client registration. You create an OAuth client in Google Cloud Console and paste the client ID and secret into your MCP client. Google documents the whole flow in the BigQuery MCP docs.

Claude's BigQuery connector

Claude's directory has a BigQuery connector published by Google. It points at the same managed endpoint above, so the tools, roles and limits are identical. The one thing to get right is the redirect URI: your OAuth client needs https://claude.ai/api/mcp/auth_callback. The full walkthrough is in how to use Claude with BigQuery.

MCP Toolbox for Databases (Google)

MCP Toolbox for Databases (the repo was formerly genai-toolbox) is Google's open-source server for many databases. It is Apache-2.0 licensed, and BigQuery is one of the supported sources. Run it with --prebuilt=bigquery.

It installs as a binary, a Docker image, through Homebrew, or with npx. It runs on your machine with your Google credentials, so it suits developers who want to read the code and keep everything local.

pvoo/bigquery-mcp

pvoo/bigquery-mcp is a small local server. You start it with one command:

uvx bigquery-mcp --project YOUR_PROJECT --location US

It only allows SELECT and WITH statements, which is a useful guard for a local tool. It is a small project, so check the repo before you depend on it.

LucasHild/mcp-server-bigquery

LucasHild/mcp-server-bigquery is a community server that runs queries, lists tables and describes schemas. It needs a project and a location.

Where Contextflo fits

Every server above gives the agent a connection. None of them tell it what your tables mean, and none of them leave you an audit trail.

Contextflo is hosted at https://mcp.contextflo.com/mcp. You connect BigQuery once with a service account that has BigQuery Data Viewer and BigQuery Job User. Contextflo generates table and column descriptions, and your team saves corrections and definitions as shared context, so the next question starts from what the last one learned.

Each person signs in with OAuth. You choose which tables each person can see. You get an audit trail of the prompts and the SQL that ran. It works with Claude, Cursor, Codex, ChatGPT and Grok.

That setup removes the OAuth client step too. Nobody creates a client in Google Cloud Console, because people sign in to Contextflo rather than to BigQuery directly. The BigQuery side is one service account. The walkthrough is in setting up BigQuery.

Per-client setup guides

Each client has its own config. We wrote one for each:

• Claude: how to use Claude with BigQuery
• Cursor: connect Cursor to BigQuery
• Codex: connect Codex to BigQuery

How to pick

• Just you, and you have IAM access already: Google's managed server. Create the OAuth client, and connect with Data Viewer and Job User only.
• You live in Claude: the directory connector. It is Google's server with a friendlier install.
• You want open source and a local process: MCP Toolbox for Databases.
• A small SELECT-only local server: pvoo/bigquery-mcp.
• Your team asks too: Contextflo. Shared context, per-person table access, and an audit trail of prompts and the SQL that ran.

Whichever you choose, do not hand the agent an identity that can write. execute_sql can run DML and DDL, so Data Viewer plus Job User is the floor for anything connected to an agent.

You do the modeling, we do the rest. Connect BigQuery free.

FAQ

Does BigQuery have an official MCP server? Yes. Google runs a managed remote MCP server at https://bigquery.googleapis.com/mcp. It uses Streamable HTTP and OAuth 2.0 with IAM, and it exposes tools to list datasets and tables, read schemas, and run SQL.

Is the BigQuery MCP server read-only? Only if you stick to the right tool. execute_sql_readonly runs SELECT statements only, while execute_sql can run DML and DDL. To be safe, connect with an identity that only has BigQuery Data Viewer and BigQuery Job User, so a write fails even if the agent tries one.

What are the limits of Google's BigQuery MCP server? Queries time out after 3 minutes and results are capped at 3,000 rows. execute_sql_readonly does not support Google Drive external tables or Graph Query Language.

Which BigQuery MCP server is best for a team? Google's server authenticates each person with their own IAM identity, but it has no shared context and no audit trail of prompts. For a team that wants shared definitions, per-person table access and an audit trail of the prompts and the SQL that ran, a hosted layer like Contextflo covers that.