Query BigQuery from the Codex CLI with MCP

You can query BigQuery from Codex without leaving the terminal. Either add Google's managed BigQuery MCP server to your Codex config, or connect BigQuery to Contextflo once and point Codex at one URL. The first takes a few minutes for one person. The second is built for a team.

Option 1: BigQuery's own MCP server in Codex

Google runs a managed remote MCP server for BigQuery at https://bigquery.googleapis.com/mcp. It uses OAuth with IAM. Its tools are list_dataset_ids, get_dataset_info, list_table_ids, get_table_info, execute_sql_readonly and execute_sql. Results cap at 3,000 rows and queries time out after 3 minutes.

Add it to ~/.codex/config.toml:

[mcp_servers.bigquery]
url = "https://bigquery.googleapis.com/mcp"

One catch. This server does not support automatic client registration. Create an OAuth client ID in Google Cloud Console and supply the client ID and secret when you authorize.

Another catch: execute_sql can write. Use an identity that only has BigQuery Data Viewer and BigQuery Job User.

If you prefer a local server, community stdio options exist. For example pvoo/bigquery-mcp, which only runs SELECT and WITH statements:

[mcp_servers.bigquery]
command = "uvx"
args = ["bigquery-mcp", "--project", "YOUR_PROJECT", "--location", "US"]

Option 2: Contextflo

Contextflo connects to BigQuery once, then every person on the team connects their own Codex to it.

In Google Cloud:

1. Create a service account.
2. Give it BigQuery Data Viewer, ideally at the dataset level, plus BigQuery Job User.
3. Create a JSON key.

In Contextflo: go to Data Sources, then Add data source, and choose BigQuery. Enter your Project ID, your Location (it must match the dataset region) and the service account JSON. Pick the tables to expose and invite your team.

In Codex, add the remote server to ~/.codex/config.toml:

[mcp_servers.contextflo]
url = "https://mcp.contextflo.com/mcp"

Then sign in:

codex mcp login contextflo

codex mcp list shows the server. Each person signs in with their own account.

Contextflo runs SELECT only. Keep the read-only service account anyway.

Which one to use

Just you, querying your own project: Option 1.

Your team asks questions too: Contextflo. You get table and column descriptions, shared definitions your team saves, per-person table access, and an audit trail of prompts and the SQL that ran. BigQuery job history only shows the service account.

Using Claude instead? See Claude with BigQuery.

You do the modeling, we do the rest. Connect BigQuery free.

FAQ

Is the BigQuery MCP server read-only in Codex? Not by itself. Google's remote server has execute_sql_readonly and execute_sql, and execute_sql can write. Sign in with an identity that only has BigQuery Data Viewer and BigQuery Job User, so writes fail even if the agent tries them.

Why does the Google BigQuery MCP server need an OAuth client ID? It does not support automatic client registration. You create an OAuth client ID in Google Cloud Console and supply the client ID and secret. Contextflo's MCP server supports automatic client registration, so you only sign in.

Where do I put the BigQuery MCP config for Codex? In ~/.codex/config.toml, or in a project-level .codex/config.toml. Each server is a [mcp_servers.name] table. Run codex mcp list to confirm Codex sees it.

What does BigQuery's job history show when Codex runs queries? The SQL, under whichever identity ran it. With Contextflo that is the service account, not the person who asked. Contextflo keeps its own audit trail of prompts and the SQL that ran, per person.