Using Grok with Amazon Redshift over MCP

AWS's Redshift MCP server runs on your machine with your AWS credentials, and Grok can't run local servers. To ask Grok questions about Redshift, you need a hosted server. Contextflo is the one covered here: connect Redshift once with a read-only user, then add one URL to Grok.

Redshift is where finance and ops numbers tend to live. Those are the people most likely to prefer asking Grok over opening a SQL client. That makes the local-only limitation worth knowing about before you start.

Option 1: AWS's Redshift MCP server

AWS Labs publishes awslabs.redshift-mcp-server. You run it with uvx and give it AWS_PROFILE and AWS_REGION. It uses each person's AWS credentials, so it doesn't add shared context or an audit trail.

It is a stdio server that runs on the same machine as the client. Grok can't run local servers and can't reach localhost, so this server doesn't work with Grok. This is a limit of Grok connectors, not of Redshift.

Option 2: Contextflo

On the Redshift side, create a read-only user and grant it the schema you expose:

CREATE USER contextflo_ro PASSWORD '<a strong generated password>';
GRANT USAGE ON SCHEMA analytics TO contextflo_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO contextflo_ro;
ALTER DEFAULT PRIVILEGES FOR USER dbt_user IN SCHEMA analytics GRANT SELECT ON TABLES TO contextflo_ro;

The last line matters. Default privileges are set per user that creates tables, so repeat it for each user your pipelines create tables as. Replace dbt_user with yours.

Optionally, set up a WLM query group with a timeout for this user.

In Contextflo: go to Data Sources, then Add data source, and pick Redshift. Enter host, port, database, username and password. SSL is optional, and an SSH bastion is supported if your cluster is private. Pick tables and invite your team.

In Grok:

1. Open grok.com/connectors.
2. Choose New Connector, then Custom.
3. Enter https://mcp.contextflo.com/mcp.
4. Complete the sign-in.

Each person signs in with their own Contextflo account. Contextflo runs SELECT only.

What the team gets

Contextflo generates table and column descriptions, so Grok doesn't have to guess what amt_net means. Your team saves corrections and definitions as shared context. You control which tables each person can query, and you get an audit trail of prompts and the SQL that ran. There is also a weekly digest.

Which one to use

For Grok, the hosted route is the only one that works. If you also use Claude, the local AWS server is an option there, and it is compared with Contextflo in connecting Claude to Redshift.

You do the modeling, we do the rest. Connect Redshift free.

FAQ

Can Grok use the AWS Redshift MCP server? No. The awslabs.redshift-mcp-server runs locally through uvx using AWS_PROFILE and AWS_REGION. Grok connectors only reach servers on the public internet, so a local stdio server won't work there.

What does Contextflo need to connect to Redshift? A host, port, database, username and password. SSL is optional, and you can connect through an SSH bastion if the cluster isn't public.

Why does the Redshift read-only user need ALTER DEFAULT PRIVILEGES? Default privileges apply per user that creates tables. Set them FOR USER with the account your pipeline uses, such as dbt_user, or new tables won't be readable by the read-only user.

Can I stop a runaway Redshift query from Grok? Optionally, create a WLM query group with a timeout for the Contextflo user, so long queries are cut off.