What it is
MCP Toolbox for Databases, from Google, works two ways. As a ready-made server, it gives agents prebuilt tools such as list_tables and execute_sql for a chosen database. As a framework, you define your own parameterised tools in a tools.yaml file, so a production agent can only run the queries you wrote. It was first released as Gen AI Toolbox for Databases, and the genai-toolbox repository has been renamed mcp-toolbox.
Run a prebuilt setup with npx -y @toolbox-sdk/server --prebuilt=postgres --stdio and connection details in environment variables, or download the binary or container. The repository ships about 40 prebuilt configurations, covering AlloyDB, BigQuery, Cloud SQL, Spanner, Firestore and Bigtable on Google Cloud, plus PostgreSQL, MySQL, SQL Server, Oracle, ClickHouse, Snowflake, Neo4j, Elasticsearch, SQLite and others. Client SDKs exist for Python, JavaScript, Go and Java.
The project is Apache-2.0 licensed with about 16,700 GitHub stars; v1.14.0 shipped on 8 October 2026, after weekly or fortnightly releases through September.
Install
npx -y @toolbox-sdk/server --prebuilt=postgres --stdioOur review
Toolbox's framework mode is the reason to choose it over a single-database server. Instead of handing a production agent execute_sql, you write named, parameterised statements in YAML, such as a hotel search that takes only a name, and the agent can call nothing else. Toolbox adds connection pooling, IAM authentication for Google Cloud databases and OpenTelemetry tracing, which are the parts teams otherwise build badly themselves.
The prebuilt mode is broad but heavy. The Postgres configuration alone defines 29 tools, from execute_sql and list_tables to lock, bloat and replication diagnostics, which is a lot of schema to load into every session. Toolsets narrow it, for example --prebuilt=postgres/data for SQL only, and that should be the default for coding agents. The prebuilt execute_sql is as open as the database user behind it, so a read-only role is the real guard.
The HTTP server needs hardening before it goes anywhere near a network. It binds to 127.0.0.1:5000, which is sensible, but --allowed-hosts and --allowed-origins both default to *, and the CLI docs warn that * is unsafe even on localhost because a malicious web page can reach the server through DNS rebinding. Traffic is plain HTTP unless you pass a certificate and key. Stdio mode, which most desktop clients use, avoids the issue.
Google now sells the other half of the argument. Its managed MCP servers for Google Cloud databases offer the prebuilt experience with nothing to run, and the Toolbox FAQ positions the open-source project as the self-hosted, faster-moving option for custom tools and non-Google databases. Teams on BigQuery or AlloyDB alone may find the managed servers enough; anyone mixing Snowflake, Postgres and Neo4j will not.
Where it earns its place
A backend engineer debugging a slow Postgres database from Claude Code
Find blocking locks, bloated tables and bad query plans without writing catalogue queries
Run the prebuilt postgres config over stdio with a read-only role; tools such as list_locks, list_top_bloated_tables and get_query_plan answer directly. It is free; the cost is 29 tool schemas in context unless you load a narrower toolset.
A team building a customer-support agent on top of an orders database
Let the agent look up order status without giving it open SQL
Define three or four parameterised tools in tools.yaml and expose only that toolset over HTTP behind TLS, with allowed hosts set to the service name. Pooling and tracing come with it.
A data lead whose warehouse is BigQuery with some Snowflake and Postgres
Choose between Google's managed MCP servers and running Toolbox
Managed servers need no hosting but cover Google Cloud databases only. Toolbox covers all three from one deployment but needs a host, TLS and someone to keep tools.yaml under review. Query costs are billed by each database as usual.
Before you commit
- Setup
- npx -y @toolbox-sdk/server --prebuilt=postgres --stdio with POSTGRES_HOST, POSTGRES_DATABASE, POSTGRES_USER and POSTGRES_PASSWORD set; documented for Gemini CLI, Antigravity, Claude Code and Codex. Binaries and containers are pinned per version, currently 1.14.0.
- Integrations
- Prebuilt toolsets per database (Postgres has 29 tools grouped as data, monitor, health, view-config and replication, mixing read-only diagnostics with write-capable execute_sql); custom tools, toolsets and prompts in tools.yaml; SDKs for ADK, LangChain and LlamaIndex.
- Data and privacy
- Runs on your own machine or server, so data goes only to the database and the MCP client. Access is whatever the database user or IAM identity allows. The CLI docs flag DNS rebinding and CORS risk from the default * hosts and origins, and HTTP traffic is unencrypted without --tls-cert and --tls-key. No GitHub security advisories are published.
- Cost at scale
- No licence fee. Costs are the database itself, per-query charges on warehouses such as BigQuery, and a small always-on host if you run it over HTTP for production agents.
- Limits
- Large prebuilt tool lists add context unless narrowed; prebuilt tools are generic, so production use means writing and maintaining YAML; the issue tracker carries about 395 open issues and pull requests.
What's good
- Custom tools in YAML confine production agents to approved queries
- About 40 prebuilt database configurations from one binary
- Connection pooling, IAM auth and OpenTelemetry built in
- Frequent releases; SDKs for Python, JS, Go and Java
What's not
- HTTP mode defaults to allowed hosts and origins of *, unsafe per its own docs
- Prebuilt Postgres loads 29 tools unless narrowed to a toolset
- Prebuilt execute_sql is only as safe as the database role
- More configuration than single-database servers
Best for
Teams that work across several databases or want to build controlled database tools for production agents.
Alternatives
MCP Toolbox for Databases: common questions
- Is MCP Toolbox for Databases worth it?
- The database server to build production agents on, because it lets you replace open SQL with queries you wrote, though its network defaults assume more care than most people take. We rate it 4.5 out of 5.
- How much does MCP Toolbox for Databases cost?
- Free and Apache-2.0 licensed; you run it yourself. Database, query and Google Cloud hosting costs are separate.
- What are the downsides of MCP Toolbox for Databases?
- HTTP mode defaults to allowed hosts and origins of *, unsafe per its own docs; prebuilt Postgres loads 29 tools unless narrowed to a toolset; prebuilt execute_sql is only as safe as the database role; more configuration than single-database servers.
- Who is MCP Toolbox for Databases best for?
- Teams that work across several databases or want to build controlled database tools for production agents.
- How much does MCP Toolbox for Databases cost for a team or in production?
- No licence fee. Costs are the database itself, per-query charges on warehouses such as BigQuery, and a small always-on host if you run it over HTTP for production agents.
- Is MCP Toolbox for Databases safe for company data?
- Runs on your own machine or server, so data goes only to the database and the MCP client. Access is whatever the database user or IAM identity allows. The CLI docs flag DNS rebinding and CORS risk from the default * hosts and origins, and HTTP traffic is unencrypted without --tls-cert and --tls-key. No GitHub security advisories are published.
- What are the best MCP Toolbox for Databases alternatives?
- The closest alternatives we have reviewed are Supabase MCP Server, ClickHouse MCP Server and Snowflake-managed MCP Server.
Answers checked Oct 22, 2026.
Make MCP Toolbox for Databases? Show this rating on your site
